Privacy Policy

Last updated: November 2026

This Privacy Policy explains how Zedapex (“we”, “us”), the company that operates Joinvoo, collects, uses and protects personal data. It covers two groups of people: customers (people and businesses who use the Joinvoo website and dashboard) and visitors (people who click a customer’s tracking link and join their Telegram channel, group or bot).

1. Our role

• For customer data (accounts, billing, support), Zedapex is the controller.
• For visitor data, the customer decides why and how it is used; Zedapex processes it on the customer’s behalf as a processor. Customers are responsible for having a lawful basis and for informing their audience where the law requires.

2. Data we collect about customers

• Account: name, email address, password (stored only as a one-way hash), and the answers you give at sign-up (for example, which platforms you advertise on).
• Connections: Telegram bot tokens, the address of your own bot server if you use one, and the Meta, TikTok and Snapchat pixel IDs and access tokens you enter. If you connect Google, the email address of the Google account you sign in with, a Google access token (stored encrypted), your Google Ads customer ID and the conversion actions you choose. If you connect Microsoft Ads, Microsoft access tokens (stored encrypted), your ad account IDs and the conversion goal names you choose. Tracker postback addresses you add, and the changes your rules make (with what was changed and when).
• API keys: the keys you make are stored only in scrambled (hashed) form, with their permissions, the IP addresses you allow, and a log of recent requests (time, address requested, result and IP address).
• White label: if you are on the Agency plan, your agency name, logo, colours, support email and the domain you connect.
• Preferences: settings such as your language, time zone and report currency.
• Billing: wallet top-ups, charges, payment references, and crypto or bank transaction references. Card details are entered on the payment provider’s page and never reach our servers.
• Referrals: who referred you, who you referred, earnings, and the wallet addresses you give for withdrawals.
• Campaign data you add: ad spend you enter or import (date, platform, campaign, amount), and the affiliate programs you connect.
• Alerts: if you connect Telegram alerts, the Telegram chat ID our alert bot uses to message you, and your alert preferences.
• Support: messages you send through the support chat, and the email address you give so we can reply.
• Technical: log-in times, IP address, browser, and security logs used to keep the Service safe. We use your IP address to work out the country you log in from (shown in your list of logged-in devices and in new-login alerts) and to pre-select your country when you sign up. We look the country up with an IP location provider; we do not track your precise location.

3. Data we process about visitors

The click. When someone opens a customer’s tracking link, the Service records the time, IP address, browser (user agent), approximate country, the page address including campaign tags (UTM parameters), and ad click identifiers and cookies set by Meta (fbclid, _fbc, _fbp), TikTok (ttclid, _ttp), Snapchat (ScCid, _scid), Google (gclid, gbraid, wbraid) or Microsoft (msclkid). The tracking or join page may load the customer’s own Meta, TikTok or Snapchat pixel.

The join. When that person joins the customer’s Telegram channel or group, or presses Start on their bot, Telegram tells the customer’s bot their Telegram user ID, first and last name, username and language. The Service links this to the click. If they later leave the channel or block the bot, that is recorded too.

Conversions. If the customer sets up a postback, their affiliate program, broker, casino, shop, CRM or bot may tell us that the person became a lead, signed up, deposited, bought something, qualified, or that a deposit was reversed, with the amount, currency and a transaction reference. We match this to the join.

Join requests. If the customer uses join-request mode, the customer’s bot approves the request and may send the person one welcome message with a personal link that includes their Telegram ID, so the customer’s partner can report deposits back.

Website visitors. If the customer tracks a website, the tracking link opens that website with a random, signed visitor code, and the customer’s script on their website keeps the code in a first-party cookie and local storage (jv_…, up to 30 days) and adds it to the customer’s offer links. If an ad opens the website directly, the script sends us the same click details listed above. When the customer’s partner reports a sign-up or deposit with that code, or the customer’s site reports a sign-up, the Service links it to the click. No Telegram data is involved, and the Service does not receive what visitors type into the website.

Offer rotation. If the customer sends different people to different offers, the Service records which offer each person was given, and the country and type of device (iPhone, Android or computer) used for the decision, so the person always gets the same offer and the customer can compare results.

Channel copies. If the customer copies their channel into other channels, the Service handles the content of those posts (text, captions and media references) only to publish them in the copies, and keeps the message numbers needed to apply later edits. Copying jobs, including post content, are deleted 7 days after they finish.

Manager chats. If the customer connects a manager’s Telegram account to their bot through Telegram Business, Telegram tells the bot when someone writes to that manager. Without the Team inbox add-on, the Service only uses the first message to record the conversion and does not keep message text.

Team inbox (paid add-on). If the customer turns on Team inbox, the Service keeps the conversations with their managers so the customer’s team can read and answer them in the dashboard: message text, Telegram’s references to photos and files (the files themselves stay with Telegram and are only loaded when the team opens them), who sent each reply, and the team’s internal notes, tags and statuses. Message text is encrypted at rest. Only the customer and the teammates they give access can read these conversations; Zedapex staff have no screen that shows them and do not read them, except when the customer asks us to look into a problem. They are never used for advertising, never sold, and never used to train AI models. Replies are sent through Telegram’s official Business connection, from the manager’s own account; we never ask for a Telegram login.

AI replies in Team inbox (optional, powered by Replyvoo). Only if the customer switches on AI replies, the notes the customer writes for the AI and the recent messages of the one conversation being answered (with a short summary of where that person came from) are sent to our AI provider to write the reply. Nothing from other conversations or other customers is included. The AI provider processes this only to return the reply and does not use it to train its models. The customer’s AI notes are encrypted at rest like their messages. AI-written messages are marked as such in the customer’s dashboard. The customer can switch AI replies off at any time, for all chats or for one chat.

Click quality. To filter fake traffic, the Service marks clicks that look automated (for example known bot browsers, data-centre IP ranges, or many clicks from one IP in a short time). These flags are used only for the customer’s reports.

What goes to ad platforms. For customers who connect Meta, TikTok or Snapchat, the Service sends conversion events (such as a join, registration or deposit with its value) together with the click identifiers, IP address, browser, and a hashed (scrambled, one-way) Telegram ID. For customers who connect Google Ads, the Service sends the event, its value and currency, the time, a reference number and Google’s click identifier only; for Microsoft Ads, the same, with Microsoft’s click identifier. For customers who add a tracker postback, the Service sends the values in the address they set (such as the tracker’s own click ID, the event, deposit value and currency, and the country). The raw Telegram ID, name and username are never sent to ad platforms.

White-label sites. If you log in through an agency’s results site, the agency decides what you can see and is responsible for your data in that relationship; Zedapex processes it on the agency’s behalf. You receive emails about your login in the agency’s name, not from Joinvoo.

4. How we use data

• To provide the Service: tracking joins, showing reports, and sending the events customers ask us to send.
• To bill customers, pay referral earnings, and prevent fraud, abuse and security incidents.
• To provide support and send service emails (for example, email confirmation, password resets, payment receipts and important changes).
• To send new customers a short series of tips about getting results with Joinvoo during their first month, which may include an offer for another Zedapex product (such as Castvoo). Every one of these emails has a link to stop them, and stopping them does not affect service emails.
• To improve reliability and performance, using aggregated or technical data.

Our legal bases are performance of our contract with customers, our legitimate interests in running and securing the Service, compliance with legal obligations, and consent where it is required. We do not sell personal data, and we do not use visitor data for our own advertising.

5. Who we share data with

• Telegram, to operate customers’ bots and invite links.
• Meta, TikTok, Snapchat, Google and Microsoft, only for customers who connect them, as described above.
• Trackers and other services a customer chooses (for example Voluum, RedTrack or a webhook), only the events that customer sends there.
• Agencies: if you are an agency’s client, the agency that invited you sees the results for the channels it shares with you and your login details.
• Payment providers, to process top-ups.
• Service providers who host our servers, store data, deliver email, look up the country of an IP address, and provide HTTPS for customers’ own domains, under contracts that protect it. We also fetch public exchange rates; no personal data is sent for that.
• Professional advisers and authorities, where the law requires it or to protect our rights and users.
• A buyer or successor, if our business is reorganised or sold, under the same protections.

6. How long we keep data

• Clicks that never lead to a join are deleted after 90 days.
• Join, deposit and statistics records are kept while the customer’s account is open so they can see their history. Customers can delete them or ask us to.
• Support conversations are kept for as long as needed to help you and then deleted or anonymised.
• Team inbox messages are deleted after 180 days, 30 days after the customer turns the add-on off, or at once when the account is deleted.
• Billing and payment records are kept for as long as accounting and tax law require.
• When an account is closed, its data is deleted or anonymised within a reasonable period, except where we must keep it by law.

7. Security

All connections are encrypted (HTTPS). Passwords and API keys are hashed, sign-in tokens for connected ad platforms are encrypted, access to production systems is restricted, and visitor IDs sent to ad platforms are hashed. No system is perfectly secure; if a breach affects your data, we will notify you and the authorities as the law requires.

8. International transfers

Our servers and service providers may be located in different countries. Where data moves across borders, we use providers and safeguards (such as standard contractual clauses) appropriate under applicable law.

9. Your rights

Under applicable data protection laws, including the GDPR where it applies, you may have the right to access, correct, export or delete your personal data, to restrict or object to its use, and to withdraw consent. To use these rights, contact us. Visitors should contact the channel owner first, as they control their data; if you contact us, we will pass your request on and help them respond. You may also complain to your local data protection authority.

10. Cookies

We use a small number of cookies and similar technologies. See our Cookie Policy.

11. Children

The Service is for adults. We do not knowingly collect data from children for our own purposes. Customers must not target children with tracked campaigns.

12. Changes

We may update this policy. If a change is significant, we will tell customers by email or in the dashboard before it takes effect.

13. Contact

Privacy questions and requests: [email protected]