Privacy Policy

1. What we collect

• Account. Your phone number — you sign in with a one-time code delivered to it over WhatsApp — and what you tell us during setup: your name, how you want to be addressed, and a short description of yourself.
• Conversations. The messages, files and images you send to your assistant and the replies it generates, including the cards, documents and small web apps it builds for you.
• Dictation. When you dictate a message, the audio is sent for transcription and is not kept after the text comes back.
• Voice calls with your assistant. Calls are recorded. We keep the recording, a transcript and a short summary of each call so you can replay and search it in the app.
• Team meetings. When you host or join a meeting, each participant’s microphone audio is recorded on our own media server, transcribed and summarised, and the action items agreed in the meeting become tasks. Video and shared screens are transmitted live and are NOT recorded. Audio recordings are deleted automatically after 3 days; the transcript, summary and tasks stay until they are deleted.
• Team chat. Messages, photos, files and voice messages you send to the people you are connected with — one-to-one or in a group — are stored and shown to the members of that conversation, and so is whether each one was delivered and read. Voice messages are transcribed, and the transcript is kept with the message. Your assistant can read the conversations you are in, to answer you and to do what you ask; it also reads a conversation that has gone quiet and proposes tasks to the people in it — nobody gets a task until they accept it. A call started from a conversation is handled like a team meeting (above). What you send is part of that conversation: it stays with its other members after you leave it or delete your account.
• Memory. Facts your assistant keeps about you so that it does not have to ask twice. You can read, edit and delete every one of them in the app (Settings → Memory).
• Tasks, schedules and personal finance. Tasks, reminders and scheduled runs you or your assistant create, and the income and spending records you enter or ask it to record.
• People you add to your team. When you lead a team, the phone numbers you type in or pick from your address book are uploaded so we can invite those people and hold their places in your team. Only the numbers you choose are sent — the picker hands the app only the numbers you tap and needs no access to your contacts — and you can remove a pending invitation at any time. A team code you share lets whoever signs in with a number through it join your team. That number is kept with the person’s place in your team until you remove them, and with the record of the team code they used for as long as your team exists. The people in your team can see your phone number, so they can reach you.
• Invitations. When you invite somebody who is not on Qolqanat yet, the number you chose is kept with your invitation, so that it can be recognised when they sign up with it. It is removed when you delete your account. Only the numbers you choose to invite are kept, one invitation at a time — never your address book.
• Contacts on Qolqanat. Only if you choose to find people from your contacts: on your device the app turns each number in your address book into a hash (SHA-256 with a published, versioned key) and sends only the hashes — never names, never the numbers themselves. We compare them with the numbers of people registered on Qolqanat and keep only the matches, as a link between your account and theirs; matching never stores, logs or sends back a number that matches nobody. A number you type to invite somebody who turns out to be on Qolqanat is linked the same way. The people you have saved who use Qolqanat can see that you have them saved, along with your name and — as your settings allow — your photo and status; that alone never shows them your number. A hash does not stop a determined person from guessing a number — there are too few phone numbers for that — so what actually protects people is that matching never stores anybody who is not on Qolqanat, that anybody can turn off being found by their number (which also takes them out of other people’s contact lists), and that how many numbers one account can check is strictly limited. You can withdraw the contacts permission at any time in your device settings.
• Profile photo and status. A profile photo and a one-line public status, if you add them. They are shown to the people you are connected with on Qolqanat — your team, the people you have conversations with (one-to-one or in a group), the people you have been in a meeting with, contacts who have your number, and the people in your contacts if you share them with Qolqanat — and your privacy setting can narrow the photo to your contacts and team, or to nobody. Every photo is re-encoded on our servers and its metadata is removed, including the location a phone camera writes into it. The short description of yourself you give your assistant during setup is not your status and stays private to your assistant.
• Blocks. The people you block. Neither of you can then message or call the other one-to-one, and each stops seeing the other’s photo and status; in a group you are both in, messages still reach everyone. The person you block is not told.
• Location. If you allow it, your current location (coordinates and the address they resolve to) is attached to the message you are sending, so the assistant knows where you are. We do not keep a location history.
• Calendar, photos, camera. If you connect your device calendar, a copy of your upcoming events is uploaded so the assistant can answer questions about your schedule. Photos and camera images are uploaded only when you attach them.
• Connected services. If you connect a third-party account (for example Google Calendar or Notion, or your own MCP server), we store the access credentials, encrypted, and read or write only what your requests require.
• Purchases. For App Store subscriptions we receive Apple’s signed transaction record (product, dates, status). For Google Play subscriptions we receive the purchase token and verify the product, expiry, renewal and payment status with Google. We store the purchase token encrypted and use the verified record to grant or restore your subscription. Neither store sends us your card details.
• Technical data. Push-notification tokens, time zone, language, app version, and server logs that include IP addresses.
• Error and crash reports. When a request to our servers fails, or the app or website crashes, we record what went wrong: the time, the type of error with its technical message and stack trace, the address of the request (with sign-in tokens and invite codes removed), the app version, the operating-system version and the device model, and — if you are signed in — your account. A crash in the iPhone or Android app is reported the next time you open it. We use these reports only to find and fix faults; they stay on our own servers and are not shared.

2. How we use it

Only to run the service: to sign you in, to keep your private workspace, to generate replies and carry out what you ask, to deliver calls, meetings and notifications, to keep the service secure, and to comply with the law. We do not sell your data and we do not use it for advertising or tracking.

3. Third-party AI and other processors

Qolqanat is built on third-party AI services. Using the assistant means the relevant content is sent to them for processing. The app asks for your explicit consent before this happens for the first time.

• Anthropic (Claude), USA — your messages, attached files and the context of your workspace, to generate the assistant’s replies and actions, and the team conversations the assistant reads to propose tasks.
• OpenAI (GPT), USA — when you choose a GPT model or ask for an image: your messages, attached files and the context of your workspace, to generate the assistant’s replies, actions and images.
• ElevenLabs, USA — the audio of voice calls with your assistant, to understand speech and to speak back.
• Zerdesoft, Kazakhstan — dictation audio, meeting audio and voice messages in team chat, for speech-to-text.
• Meta (WhatsApp Business) — your phone number and the one-time sign-in code, to deliver the code.
• Apple — push notifications, incoming-call notifications and App Store purchases on iPhone.
• Google — Google Play subscription purchases and verification; Firebase Cloud Messaging (FCM) delivers Android notifications, including incoming calls and assistant progress. FCM receives the device push token, account and delivery identifiers, and notification content needed for delivery.
• Hosting — our application servers and our own media server (LiveKit, self-hosted) run on rented infrastructure; meeting media does not pass through a third-party conferencing provider.

These providers process data under their own terms and privacy policies. Some of them are located outside Kazakhstan, so your data may be transferred abroad for processing.

4. Google user data (Limited Use)

If you connect Google Calendar, Qolqanat’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google data is used only to show and manage your calendar at your request; it is not used for advertising, is not sold, and is not read by humans except with your consent, for security, or where the law requires it.

5. Recording: calls and meetings

Voice calls with your assistant and the audio of team meetings are recorded, as described above. The app shows a recording indicator while this happens, and asks you to agree before you join a meeting. If you host a meeting, you are responsible for making sure the people you invite know it is recorded. If you do not agree to being recorded, do not start a call and do not join the meeting.

6. Storage and security

Each account has its own isolated workspace on our servers; the assistant that works for you runs in a sandbox that can reach only your own data. Connections use TLS. Credentials for connected services are encrypted at rest. No system is perfectly secure, but access to production data is limited to the operator.

7. How long we keep it, and how to delete it

• Delete everything yourself: in the app, open the sidebar → your profile → Delete account. This permanently deletes your account, chats with your assistant, agents, memory, tasks, finance records, call recordings, your profile photo, your contact links and blocks, the invitations you sent, and connected-service credentials. Messages you sent in team conversations are part of those conversations and stay with the other people in them.
• Delete parts: individual chats, memory facts, tasks, finance records and connected services can be removed in the app at any time. So can your profile photo and status, your contact matches and the people you blocked, and you can turn off being found by your number.
• Meeting audio is deleted automatically after 3 days. A meeting’s transcript and summary are shared records of everyone who took part; they are removed when the host’s account is deleted.
• App Store subscriptions are not cancelled by deleting the account — Apple keeps billing until you cancel in your Apple ID settings. We keep Apple’s transaction record, detached from your identity, so that a purchase can be restored.
• Google Play subscriptions are not cancelled by deleting the account. Cancel them in Google Play → profile → Payments & subscriptions → Subscriptions. We detach the verified subscription record and encrypted purchase token from your Qolqanat account and retain them so that a purchase can be restored.
• Error and crash reports are deleted automatically after 30 days, including the ones from an account that has since been deleted.
• Payment records that the law requires us to keep are retained for the period the law requires.

If you cannot use the app, write to turan@shymyr-ai.kz from any address and tell us the phone number of the account; we will confirm it through that number and delete the account within 30 days.

8. Your rights

You may ask what we hold about you, correct it, export it, or have it deleted, and you may withdraw your consent to AI processing at any time by deleting your account. Write to turan@shymyr-ai.kz.

9. Children

Qolqanat is not intended for anyone under 16, and we do not knowingly collect their data.

10. Changes

When this policy changes materially, we update the date above and, where the change affects what is collected or shared, ask for your consent again in the app.

11. Contact

Turan Mural · turan@shymyr-ai.kz