Privacy Policy

Version of 26 October 2026. A translation: if it differs from the Russian version, the Russian one applies.

Section 11 (the student forum, questions at sign-up and the assistant) added on 30 October 2026.

KBTU App is a student app in Telegram for events, clubs and friends. This policy explains which personal data we collect, why, who sees it, where it is kept and how to delete it. It follows the Law of the Republic of Kazakhstan "On Personal Data and Their Protection" of 21 May 2013 No. 94-V.

KBTU App is not an official service of JSC Kazakh-British Technical University and does not act on its behalf.

1. Who processes the data

The owner and operator of the personal data database is the creator of KBTU App, Sukhrab Rustamzhanovich Nurmatov. For any question about your data: Telegram @Sowers.

2. What we collect

• From Telegram, when you open the app: your account ID, Telegram first and last name, @username, profile photo link, language.
• From the KBTU portal, until 19 October 2026, when you signed in with KBTU: last, first and middle name, student ID, year, school and programme, university email, phone, class timetable. We never kept your portal password. That way of signing in is closed; the data already received stays until you delete your account.
• From your KBTU Microsoft account, when you sign in with Microsoft: the account's ID, first and last name, sign-in name (@kbtu.kz) and the account's mail address, account type (e.g. "student"), the date the account was created and its country of use. The password is typed only on Microsoft's page: we never see or receive it.
• Typed in by you when you sign in: last name, first name, student ID and year. They are marked unconfirmed until you confirm your KBTU account with Microsoft.
• From your club's roster: KBTU's Department of Youth Policy gave us the Student Union's club lists of autumn 2026 (club, position, department, full name, school, year, city, Telegram username or university email, phone where listed). A row waits unused until it is matched to your KBTU account by your username or email and your name; then it becomes your membership, and the city and phone your profile's. You can hide or delete the city in Settings → My data, and leave the club any time.
• What you add: nickname, your own photo, "about me", showcased awards, comments, reactions, club applications, reports.
• Your activity: event registrations, check-ins, tickets, payment receipt photos (for paid events), saved events, subscriptions, friends, awards.
• Invites: if you open the app by someone's invite link before signing in with KBTU, we note whose link it was. Once you have signed in it counts for them: they see only how many people their link brought (and their "Recruiter" award, which others see like any award), never who.
• Clubs and role history: which clubs you are in, your role, and when you joined, changed role or left. The history is recorded automatically.
• Technical data: server logs (request time, address, errors), to run and protect the service; the days you opened the app, for visit statistics only the creator sees; they are kept for 30 days; which profiles you opened of people who are neither your friends nor in your club, so profiles can't be copied in bulk (200 a day at most); kept for 2 days.

We never collect: your KBTU password or account access, grades and GPA, transcript, IIN, portal photos.

3. Why

• to confirm you are a KBTU student and show your profile;
• to register you for events, check tickets at the door and keep club rosters;
• to show your timetable, friends, awards and organisation history;
• to send notifications through the bot (you can turn them off in settings);
• to protect the service from abuse and handle reports.

The legal basis is your consent, given when you sign in. Without it the app works in guest mode only.

4. Who sees your data

• All students: first name and last initial or nickname, photo, card number, year and school, awards (without dates), "about me", number of events attended.
• Your friends and people in your clubs: also your clubs, past organisations with dates and event badges.
• Organisers of an event or club, their own only: full name, @username, student ID, email and phone, when you register for their event or apply to their club.
• The team of a club you are in: full name, @username, role.
• KBTU's Department of Youth Policy: full name, student ID, year, school and role of club members, to keep the register of student organisations.
• Only you: subscriptions, saved events, timetable.

We do not sell data or pass it to advertisers.

5. Services the data passes through

• Telegram (Telegram FZ-LLC, UAE): the app opens inside Telegram, the bot sends notifications.
• Microsoft (Microsoft Corporation, USA): signing in with your KBTU account.
• Cloudflare (USA): the secure connection between your device and our server; storing the encrypted backups (Cloudflare R2).
• AI translation: the titles and descriptions of public events, the descriptions of clubs and the posts copied from clubs' public Telegram channels are translated into Kazakh, Russian and English by the first available of Cloudflare Workers AI (USA), Munito (France; the request may be served in any of its regions), OpenRouter (USA; it passes the text to the host of the model) and Groq (USA). Only these texts are sent, which everyone can see anyway, never anything from your profile; a free plan of some of these services may keep them or use them to improve its models.
• The KBTU portal: until 19 October 2026, only at the moment you signed in with KBTU. Not any more.

Telegram, Microsoft, Cloudflare, Munito, OpenRouter and Groq are outside Kazakhstan. By giving consent you also agree to this cross-border transfer.

6. Where and how long

The database is on a server in the Republic of Kazakhstan (Almaty). A backup is made every night, encrypted on our server and kept in Cloudflare R2 for about 30 days; only the operator can decrypt it: the key is neither on the server nor at Cloudflare.

Data is kept while you have an account. The days you opened the app are kept for 30 days; our copies of the bot's messages lose their text after 30 days.

After you delete your account, the data leaves the database at once and the backups within 30 days (no later than 37 days after the request, counting the week to cancel). So that deleted data doesn't come back when a backup is restored, we keep a separate record of the deletion: its time and a hash of the Telegram ID with a secret salt; the record is deleted after 40 days.

7. Your rights

• See your data in your profile; the full list on request to @Sowers.
• Correct it: nickname, photo and "about me" in your profile; anything else, write to the operator.
• Delete your account: in profile settings, "Delete account". It is deleted after 7 days and can be cancelled until then. If you have a paid ticket for an event that hasn't happened yet, the deletion waits until it has.
  Removed: student and Microsoft account details, whose invite link brought you, timetable, tickets and receipts, comments, reactions, friends, subscriptions, saved events, awards, your card number (never given to anyone again), club memberships and role history, answers in club recruitment rounds, your photo, nickname and "about me"; your Telegram name and username are erased.
  Kept without your name and without a link to your account: that you came to past events, event ratings (without comments), volunteering and taking part in finished recruitment rounds (without answers), your votes on others' applications in them (without notes), who invited you to an event, only so the clubs' numbers add up; posts and comments written on behalf of a club; photos you added to event albums (when deleting you can choose "delete my photos too"; a photo showing you is removed on request to @Sowers).
  Kept on your Telegram account: app settings, bans and the number of warnings in clubs (without their text). If you are a club's president, the club passes to the next member by rank, or to the administrator if there is nobody else.
• Withdraw consent: that is deleting your account.
• Complain about us to the authorised personal data protection body or a court.

8. Protection

The connection is encrypted (HTTPS). Only the operator has access to the database. Club role rights are checked on the server. If a data breach happens, we will tell you through the bot.

9. Age

The app is meant for students aged 16 and over.

10. Changes

If this policy changes materially, we will tell you through the bot. The current version is always at this link.

11. The student forum, questions at event sign-up and the assistant

The forum is where students ask, offer and call each other: lend a thing, go somewhere together, help, just talk. Using it is optional.

• What we keep: your threads and replies (topic, text, anonymous or not, review status, time), your "I'm in" marks, your reports (while you have an account), the people you blocked, and which threads the bot wrote to you about.
• Who sees what: only students signed in with KBTU see the forum. A thread or reply under your name shows your first name and the first letter of your last name (or your nick) and your photo. An anonymous thread or reply shows no author to anyone — students or moderators. Only the app's creator (section 1) can find out who wrote it, and only to deal with a broken rule; every such reveal is recorded in the audit log. By tapping "I'm in" you let the thread's author see you among those who responded and write to you on Telegram (@username).
• Blocking hides your named threads and replies from each other; anonymous ones aren't hidden, or blocking would give away who wrote them.
• AI check: every text is first sent to Munito (a service with servers in the European Union) to check for abuse; it isn't stored there or used for training. An anonymous text appears only once the check approves it; a named one unless the check objects; otherwise it waits for a moderator. Three reports from accounts older than two weeks hide a text until a moderator decides.
• Bot messages: when someone answers your thread or taps "I'm in" — at most one message about a thread per clock hour and without the reply's text. Turned off in Settings.
• How long: a thread leaves the feed after its topic's term (a day to 30 days) and is deleted with its replies 30 days after that. A thread or reply you delete is wiped at once; an empty record without text stays until then to count the daily limits.
• Questions at event sign-up: if an organizer added their own questions, only that event's organizers see your answers (in the attendee list and the table); they're deleted 30 days after the event. The organizer gets the attendee table as a file in Telegram — such copies stay with them.
• The campus map: a long press on the map tells us of a mistake there: your note (300 characters at most) and the spot go to the operator with your account, kept until it's fixed and 30 days after; after you delete your account, without your name.
• The assistant: when you ask the in-app assistant, your question (and the last few turns of the conversation) goes to Munito with a short brief: your school and year, today's and tomorrow's classes (subject, time, room), the coming public events and the campus places. Your name, student ID, mail and phone are not sent. We don't keep questions or answers — only how many questions you asked in a day (30 at most), deleted after 2 days. The answers are written by AI and can be wrong. The same way, a club's organizer can paste an event's announcement to fill a new event: the text goes to Munito once and isn't kept; it counts toward the same 30 a day.
• Deleting your account: your threads, replies and marks are deleted at once (section 7).

Munito is outside Kazakhstan: by giving consent to this version you also agree to this cross-border transfer.