Privacy Policy

Miraclaw AI · miraclaw.io · Last updated: October 14, 2026

Русская версия

Who we are

Miraclaw AI is a personal AI assistant available via the Telegram bot (@miraclaw_ai_bot) and the web app at miraclaw.io, including when opened from our mobile app. Contact: t.me/murgulets · murgulets@gmail.com.

The data controller and service provider is Evgenii V. Murgulets (Мургулец Евгений Валерьевич), self-employed under the Russian professional income tax regime, INN 784001105500. Postal address: 191186, St. Petersburg, Malaya Konyushennaya st., 4/2, apt. 183. Phone: +7 921 744-33-33. Commercial terms are set out in the public offer and the terms of service.

What we collect

• Your account details: Telegram ID and name when you use Telegram; your verified email address when you sign in by email or Google; and the name and profile photo provided by Google when you choose Google sign-in. We use these details to identify your account and connect the sign-in methods you confirm.
• Messages, conversation history, saved information about you, and profile details you choose to provide, such as your name, interests and preferences, to answer your requests and personalise the assistant.
• Photos, videos, audio and documents you upload, text extracted from documents, generation requests and results. If you save a character, its reference photos are stored for reuse in your later requests.
• Data from services you choose to connect, within the permissions you grant; see below.
• Purchase and usage records, including model names, request counts and processing costs; account and security events, including IP addresses used to limit sign-in attempts.
• If you enable browser notifications, the notification delivery address and keys. If you submit a report about an AI result, its reason, your optional comment and a reference to that result are stored for the service operator to review.

Connected services

You choose whether to connect a service. Its data is accessed to carry out your requests or a feature you enabled, such as a scheduled briefing. The permissions shown when connecting determine the available access. Information retrieved for an answer can become part of the conversation and be sent to the AI providers described below.

• Google Calendar: the direct calendar connection requests calendar.events to read and create events. This connection is separate from Gmail and Google Drive.
• Gmail and Google Drive: when these connections are available and you enable them, access goes through Composio. Composio holds the access tokens; we store a connected-account identifier and account details. The Google permission screen may request broad mailbox or Drive access. The assistant uses the available tools for requested actions, including reading mail and files, sending mail and saving files.
• Other available connections: Yandex Mail, Disk and Calendar, Mail.ru, Notion, GitHub, Bitrix24, amoCRM, Ozon and Wildberries. Depending on the connected service and granted permissions, the assistant can work with mail, files, calendar events, pages, repositories, CRM records or seller-account data.

Google API data is used for the connected features you request. The Google API Services User Data Policy and its Limited Use requirements apply to use of this data. Connecting one service does not connect your other accounts automatically.

Data protection & security

• Protected connections. The public website uses HTTPS. Requests to the AI and connection providers named here use HTTPS; outgoing email uses TLS-protected SMTP.
• Connection credentials. Access and refresh tokens stored in our integration database are encrypted with AES-256-GCM. For connections managed by Composio, Composio stores the tokens under its own security arrangements. This does not mean that all messages and files are encrypted in the same way.
• Account access. Access to account history, settings and connected services requires authentication and an account access check.
• Media links. Some source files and generated results are made available by link for processing and delivery. Possession of such a link can allow access to the file without signing in.
• Disconnecting. You can disconnect a service in the app. We deactivate the connection and remove its locally stored access credentials. Where supported, we also request revocation from the provider; external revocation can require a separate action in that provider’s account settings.

AI processing

To answer your request, Miraclaw sends your message and relevant context through OpenRouter to the provider of the selected model. Context can include conversation history, saved information about you, text from documents and information retrieved from connected services. Photos sent to a model that can analyse images are included in its request.

• Images, video and audio generation: depending on the function, fal.ai receives your prompt and the source photos, audio or video needed for the task. Some video generation runs through OpenRouter. Preparing a media request, such as translating a prompt, can also involve OpenRouter.
• Speech: OpenAI receives audio for transcription and text for speech synthesis. If the branded voice function is enabled and used, ElevenLabs receives the text to be spoken; OpenAI can be used as an alternative.
• Internet search: the search query is sent to search services, including through OpenRouter, to obtain information or images for your request.

The recipient depends on the function, model and available processing route, including an alternative route if the first is unavailable. Materials you provide may contain personal data. Provider-side storage and further processing are governed by the applicable provider terms and account settings; we do not promise identical retention periods or training restrictions for every provider.

Notifications, support and service logs

If you use email sign-in or email notifications, your address and the email contents pass through our configured mail service and, when needed, its configured fallback. If you enable browser notifications, delivery uses your browser’s push service. Telegram receives messages and files delivered through the bot.

Service logs can contain account identifiers, request and payment events, model usage, file names and error details. Where operational notifications are configured, account and usage events are forwarded to the operator’s private Telegram channel. For messages received by the Telegram bot, these notifications can include the first 160 characters of a message. Reports about AI results are available to the operator together with the reported content for review.

Payments

Payments are handled by payment partners, not by us. Card and SBP payments for subscriptions and token packs are processed by Tribute (tribute.tg); payments in Telegram Stars are processed by Telegram. We never receive or store your card number, CVC or bank credentials.

When a payment succeeds, the partner sends us a notification. From it we use: your Telegram user ID and Telegram username; the identifier and name of the purchased subscription or digital product; the billing period and the date your access expires; the payment type (regular, gift or trial); and the purchase or transaction identifier. For a refund or cancellation we additionally use the refund flag, the refunded amount, the payment status and the refund reason supplied by the partner. We keep these records as proof of payment and for tax reporting.

The notification may contain further fields we do not use. If its event type is one we do not recognise, the notification body (up to 400 characters, which may include any field the partner put in it) is forwarded to the service owner’s private Telegram channel so that a person can process the payment or refund manually; that channel is accessible to the operator named above and is not public. The payment partners process your payment data as independent controllers under their own privacy policies.

Retention & deletion

Account history, saved information, files and generated results are retained to provide your account features. Temporary files and caches have separate cleanup rules; those rules do not set a single retention period for all account data. Disconnecting a service stops new access through that connection but does not remove information already saved in a conversation.

Account deletion is available in the app. It removes account content and stored connection credentials and closes access to the account. Payment records and some service audit records are retained for accounting and security. Deletion from our active storage does not mean that copies already received by other services or held in backups disappear at the same moment. You can ask about deletion and remaining records at @murgulets / murgulets@gmail.com.

You can also revoke Google access from your Google Account permissions page.