1. General Provisions

1.1. This Privacy Policy sets out the procedures for collecting, storing, processing, using, and disclosing personal data of users (hereinafter — Users) of the Telegram bot and AI assistants (hereinafter — Services) operated by FMP Company (hereinafter — Operator).

1.2. The Services include:

• The FMP Management Bot Telegram bot (@fmp_management_bot) — for managing access to AI assistants;
• GPT Assistants — specialized AI helpers built on the OpenAI ChatGPT platform, created by the Operator to provide business consulting.

1.3. By using any of the Services, the User acknowledges that they have read this Privacy Policy and consents to the processing of personal data under the conditions set forth herein.

1.4. If the User does not agree with the terms of this Privacy Policy, they must discontinue use of the Services.

1.5. This Privacy Policy applies solely to data collected through the specified Services and does not govern data collection by other FMP Company resources.

2. Data Controller

2.1. The data controller is FMP Company (FMP — Future Management Platform).

2.2. The Operator's contact information is provided in section 16. Contact Us of this Policy.

2.3. The Operator determines the purposes and means of processing Users' personal data and is responsible for their protection in accordance with applicable Ukrainian law and the General Data Protection Regulation (GDPR) of the European Union — where applicable.

3. Data We Collect

3.1. In the course of using the Services, the following categories of data may be collected:

Data provided by the User:

• Full name (first name and last name);
• Email address;
• Telegram ID and username (@username);
• Content entered in chat (queries, responses, uploaded documents).

Data collected automatically:

• Session identifiers for AI assistant interactions;
• Date and time of Services usage;
• Usage statistics (number of authorizations, assistants obtained, ratings);
• Telegram technical metadata (chat_id, message_id).

3.2. The Operator does not collect or process special category data (racial origin, political opinions, health status, etc.) unless the User voluntarily provides such information in chat text.

4. Data Processed in the Telegram Bot

4.1. When registering with the Telegram bot, the User provides:

• Full name;
• Email address.

4.2. Telegram automatically transmits to the bot:

• Telegram ID (numeric identifier);
• First name and last name from the Telegram profile;
• Username (@username), if set;
• Language code (language_code).

4.3. This data is stored in the Operator's secured database and is used for:

• User identification;
• Managing access to AI assistants;
• Generating authorization tokens;
• Sending notifications about request statuses.

5. Data Processed in GPT Assistants

5.1. GPT Assistants operate on the OpenAI ChatGPT platform. When using GPT Assistants, the following data is processed:

• Text of queries and responses in chat;
• First name, last name, and email (transmitted via authorization token);
• Uploaded files and documents (if provided by the User).

5.2. GPT Assistants do not have persistent memory between sessions. Each new conversation starts without access to previous chats.

5.3. GPT Assistants do not store the User's personal data after a session ends. Data entered in chat is processed solely within the current session for response generation.

5.4. The Operator does not have access to the content of the User's chats with GPT Assistants. This data is processed directly by the OpenAI platform in accordance with its privacy policy.

6. Data Processing by OpenAI

6.1. GPT Assistants are built on the OpenAI platform. When using GPT Assistants, User data is also processed by OpenAI in accordance with:

• OpenAI Privacy Policy;
• OpenAI Terms of Use;
• OpenAI Usage Policies.

6.2. According to OpenAI's policy for GPT Assistants (GPTs): chat inputs and outputs are not used for training OpenAI models unless the User has separately opted in through their ChatGPT account settings.

6.3. OpenAI may temporarily store data on its servers (located in the US and other countries) for a limited period to ensure security and prevent abuse.

6.4. The Operator is not responsible for data processing carried out directly by OpenAI. Users are encouraged to review OpenAI's policies independently.

7. Purpose of Data Use

7.1. The Operator processes Users' personal data solely for the following purposes:

• User identification and granting access to AI assistants;
• Personalizing interactions with AI assistants (greeting by name, auto-filling forms);
• Managing requests for obtaining assistants;
• Sending assistant outputs (consultations, documents) to the User's email;
• Collecting feedback and ratings to improve Service quality;
• Technical support and problem resolution;
• Ensuring Service security and preventing abuse;
• Generating aggregated usage statistics (without identifying individual Users).

7.2. The Operator does not use Users' personal data for targeted advertising, marketing mailings, or sale to third parties.

8. Data Storage and Security

8.1. Users' personal data is stored on the Operator's secured server.

8.2. The following security measures are implemented:

• Encrypted connections (HTTPS/TLS) for all data transmissions;
• Authorization tokens generated using cryptographically secure methods;
• Restricted and controlled database access;
• API Key verification for requests from GPT Assistants;
• Telegram webhook requests verified using a secret token.

8.3. Personal data is retained for the entire duration of the User's use of the Services. After account deletion, data is removed within 30 (thirty) days.

8.4. Aggregated statistics (without personal data) may be retained indefinitely.

9. Sharing Data with Third Parties

9.1. The Operator does not sell, trade, or transfer Users' personal data to third parties except as specified in this Policy.

9.2. Data may be shared with the following categories of recipients:

• OpenAI — chat text and authorization data are transmitted via GPT Actions to enable AI assistant functionality;
• Google (Apps Script) — name, email, and form content are transmitted for processing consultation requests, feedback, etc.;
• Telegram — for bot operations and message delivery;
• Hosting provider — for server-side data storage.

9.3. Disclosure of personal data without the User's consent is permitted in cases prescribed by Ukrainian law, including lawful requests from government authorities.

10. Authorization Tokens

10.1. To link the Telegram bot with GPT Assistants, authorization tokens are used — unique identifiers generated for each "User — Assistant" pair.

10.2. Tokens are used to:

• Identify the User within a GPT Assistant;
• Retrieve name and email for session personalization;
• Auto-fill contact information in forms.

10.3. Tokens do not contain personal data. A token is a random character string that allows the server to identify the User only when accessed through the API.

10.4. The User is obligated not to share their tokens with third parties. In the event of token compromise, the User may contact the Operator to request reissuance.

11. Data Processing via Google Apps Script

11.1. Certain GPT Assistant actions (submitting consultation requests, feedback, ideas, or issues) are executed through Google Apps Script.

11.2. The following data is transmitted to Google servers:

• The User's first name and last name;
• Email address;
• Message or request text;
• Assistant code and name.

11.3. This data is processed in accordance with the Google Privacy Policy.

12. User Rights

12.1. The User has the right to:

• Know — what personal data about them is stored;
• Access — request a copy of their personal data;
• Rectify — update or correct inaccurate data;
• Erase — request deletion of all personal data ("right to be forgotten");
• Restrict processing — request limitation of personal data processing;
• Object — refuse data processing for specific purposes;
• Portability — receive their data in a structured, machine-readable format.

12.2. To exercise any of these rights, the User may contact the Operator using the details provided in section 16. Contact Us.

12.3. The Operator will respond to any request within 30 (thirty) days of its receipt.

12.4. Deletion of personal data may result in termination of access to the Services and revocation of issued authorization tokens.

13. Cookies and Tracking Technologies

13.1. The Telegram bot and GPT Assistants do not use cookies, tracking pixels, or similar technologies.

13.2. The ChatGPT platform may use its own cookies in accordance with the OpenAI Privacy Policy. The Operator has no control over these cookies.

14. Children

14.1. The Services are not intended for persons under the age of 16. The Operator does not knowingly collect personal data from children.

14.2. If the Operator becomes aware that a child's personal data has been collected without parental or legal guardian consent, such data will be deleted immediately.

15. Changes to This Privacy Policy

15.1. The Operator reserves the right to update this Privacy Policy by publishing a new version.

15.2. The date of the last revision is indicated at the top of this document.

15.3. Continued use of the Services after publication of an updated Policy constitutes the User's acceptance of the new version.

15.4. The Operator recommends that Users periodically review this Policy to stay informed of any changes.