Privacy policy

Last updated: 18 August 2026. This page describes current product behavior. It is not a claim of HIPAA or any other formal compliance certification. Liability for Optigram is governed by the terms of service.

Who we are

Optigram (www.optigram.app) is operated by Nabour Labs Inc., a corporation incorporated and registered under the laws of the Province of Ontario, Canada, and is a GoHighLevel Marketplace app that relays opted-in Telegram conversations into a location's GHL inbox. Studio brand: nabour.ca. For privacy inquiries, contact support@optigram.app.

Controller and processor roles

When you install Optigram for a GoHighLevel location, that location's owner — you, or the agency operating it — is the data controller for the personal data of its own leads and contacts, including the Telegram identities collected through the channel. Nabour Labs Inc. acts as a data processor / service provider: we process that data only to operate the service on your instructions, not for our own purposes. If a lead or contact wants to exercise privacy rights over their own data, they should contact the controller (you or your agency); email us if you need our help fulfilling that request, or if you need a Data Processing Agreement for your own compliance purposes.

What we process

• GoHighLevel OAuth access and refresh tokens for each installed location (encrypted at rest with AWS KMS).
• The Telegram bot token the agency pastes (encrypted at rest with AWS KMS), plus bot username and a hashed webhook secret.
• Contact mappings: GHL contact id, Telegram chat id, username/handle, opt-in time and source.
• Message metadata in our logs (direction, status, ids). We do not store Telegram or GHL message bodies in messages_log. Message text does transit Amazon SQS (and dead-letter queues, retained 4 days) so workers can deliver it.
• If you email support, the contents of that correspondence.

We do not operate a public waitlist or marketing lead form on this site. We do not sell or share personal information for cross-context behavioral advertising.

Why, and our legal basis

Tokens and mappings exist so the channel can deliver inbound and outbound messages after a lead opts in. Opt-in source and timestamp are kept so consent is auditable. We do not use Telegram to cold-message people who have not started the bot. Where privacy law requires a stated legal basis (for example GDPR), we and our customers rely on legitimate interests in operating the service and on performance of the subscription contract. Where a customer needs a Data Processing Agreement to satisfy their own obligations, contact support.

Processors and international transfers

Infrastructure runs on Amazon Web Services, currently in the United States (AWS us-east-1). Conversation content also flows through GoHighLevel and the Telegram Bot API under those providers' terms. If you or your leads are located outside the United States, this means personal data is transferred to and processed in the United States; we rely on our processors' standard safeguards for that transfer. GoHighLevel, Telegram, and Amazon Web Services have their own privacy policies; Nabour Labs Inc. is not responsible for their practices. Analytics, if enabled on this marketing host only, uses Google Analytics 4 with cookies scoped to the marketing hostname (not .optigram.app), so they do not ride on app. or api. requests. The admin dashboard is noindexed and does not load that analytics snippet.

Retention and deletion

Uninstalling Optigram in GoHighLevel (or using Delete data in the dashboard) removes the Telegram webhook and deletes that location's encrypted tokens, contact mappings, opt-in tokens, and message-log rows. Reinstalling is a new install, not a restore. When a contact is deleted in GoHighLevel, a ContactDelete webhook purges that contact's mapping, related log rows, and unused opt-in tokens. For help, email support@optigram.app from an address we can associate with the install (see Support & data).

Your rights

Depending on where you or your contacts are located, applicable law (such as PIPEDA and Quebec's Law 25 in Canada, GDPR in the EU/UK, or state privacy laws such as the CCPA in the US) may give individuals rights to access, correct, export, or delete their personal data, and to know what's collected about them. Customers and agencies (as controllers) are responsible for handling these requests from their own leads and contacts; where the data lives with us, email support@optigram.app and we will assist. If you contact us directly about your own account or correspondence with us, the same email is the way to reach us for access or deletion requests.

Children's privacy

Optigram is a business tool for GoHighLevel agencies and their teams. It is not directed at children, and we do not knowingly collect personal information from children through the product itself.

Security

We use commercially reasonable measures to protect data we process, including encrypting access, refresh, and bot tokens at rest with AWS KMS and restricting production access to what is needed to operate and support the service. No method of transmission or storage is completely secure, and we do not warrant that the service is free of security issues. If we become aware of a breach affecting your data, we will notify you as required by applicable law, using the email associated with your install where we have it.

Cookies

This marketing site may set a Google Analytics cookie on the marketing hostname only, and only when a measurement id is configured. Where required by law, we will only load that analytics snippet after obtaining the visitor's consent. The dashboard at app.optigram.app uses a first-party session cookie for standalone (non-iframe) visits; the GHL embed uses a bearer token in session storage instead.

Changes to this policy

We may update this policy from time to time; the “Last updated” date above reflects the most recent revision. Material changes will be reflected here, and where required by law, we'll provide additional notice.