Home · Blog · 152-FZ and chatbot: who is responsible for the data and what to configure in CHBT

152-FZ and chatbot: who is responsible for the data and what to configure in CHBT

September 15, 2026 · Command CHBT · Law, 152-FZ

As soon as the bot entered the client’s phone number into the card, you have obligations under 152-FZ - regardless of whether you are an individual entrepreneur or an LLC, and regardless of the fact that “it’s just Telegram.” Below is not a retelling of the law, but an analysis of a specific structure: what from the correspondence is considered personal data, which of the two parties - you or CHBT - is responsible for what, where the data is physically located and through what channels it goes outside, how to formalize consent in the bot if there is no checkbox in the form, and what to do with the “delete my data” request. A disclaimer right away: we are developers of the designer, not lawyers. Check controversial areas with a lawyer and the current version of the law.

Let’s analyze one conversation: which of it is personal data?

Let’s take a beauty salon bot, assembled from the “Client Registration” template. The client clicked “Start” (/start), selected the “Manicure” button, wrote “Thursday after 6 pm,” sent the phone number and received “We made an appointment, we’re waiting.” Four messages. Let's see what ended up in the CHBT office during this time.

What's in CHBT	Where from	Personal information?
Telegram ID and username	Received automatically with the first message	Yes: specific person ID
Name from profile (“Anna K.”)	Automatically, in the “Contacts” card	Yes
Phone	Block "Data collection"	Yes
“Manicure, Thursday after 6 pm”	Message text	By themselves, no, but in conjunction with an ID, they describe a specific person and are processed along with the rest
Tag “record-September”	You placed the “Action” block	Information about a person is part of his data
History of conversation with date and time	Section “Conversations”	Yes, because it is tied to an identified person

The main conclusion is unpleasant, but useful: a bot that “collects nothing, only answers questions” is already processing personal data. The ID and name from the profile come with the first message, and CHBT creates a contact card automatically - in all channels, including the widget on the site (there instead of the messenger ID there is a session identifier, and the name appears after the pre-chat form or the “Leave contacts” button). The “we don’t ask anything” argument doesn’t work; The question at issue is “to what extent and on what basis.”

A separate group - special categories: health, religion, criminal record. If the clinic’s bot asks “describe what’s bothering you,” and the person writes about the diagnosis, you have received health data with all the increased requirements. A practical solution is not to collect this in free text through a bot: let the bot only ask for directions using buttons and a convenient time, and let the doctor clarify the details over the phone.

Two roles: you are the operator, CHBT is the processor on behalf

The law distinguishes between the one who determines the purposes and composition of the data and the one who processes it on someone else’s behalf. You defined your goals: you decided to ask for a phone number to confirm your appointment and set tags to send out newsletters. This means that the personal data operator is the owner of the bot. CHBT stores and processes your customer data on your behalf - this is set out in the section on processing on behalf of our personal data processing policy and in the terms of use. Refer to these documents in your policy when listing handlers.

Zoning in practice looks like this.

Answers CHBT: data is located on servers in Russia; bot tokens are stored in encrypted form and after saving are not shown in the interface; access to the project is delimited by the roles Owner / Administrator / Operator (section “Access”); your customer data is not used for our purposes and is not transferred to third parties except infrastructure providers, without whom the service does not work; upon your request, the data is deleted.

You answer: legal basis for collection - consent or performance of a contract; text of the policy and its availability prior to collection; notification to Roskomnadzor, if required in your situation; responding to customer requests for data; deciding which employee to open an office for; everything that happens to the data after CSV upload or transfer to an external system.

The plan does not affect the distribution of roles: on Free plan data is stored in the same place as on Business.

Where is the data located and on what roads does it leave CHBT

Localization requirement - databases with data of citizens of the Russian Federation are located on the territory of Russia. On the constructor side, what is needed is done for it: contact cards, conversations, tags, CRM transactions and script variables, which the bot collects in CHBT, are stored on servers in the Russian Federation. But compliance with 152-FZ itself is the responsibility of the operator, that is, the owner of the bot: the policy, legal basis, notification of Roskomnadzor remain on your side, and the placement of servers does not replace them. And it would be unfair to stop there. The data from the bot has several more places, and you open some of the roads to them yourself.

The messenger itself. Correspondence takes place through Telegram, MAX or VKontakte servers. This is the client’s choice and the site’s responsibility; you do not control it. But remember: a copy of the conversation exists not only in CHBT.
Action "HTTP request". When the script sends a POST with contact details to your CRM, Make, n8n or its server, the recipient becomes another handler. If the service is foreign, it is a cross-border transfer, it has its own rules. How such a transfer works is discussed in the article. about leads from a bot in CRM; One thing is important here - each such address must be known to you and described in the policy.
Letters to the owner. The new lead notification contains a name and contact. If your mail is on a foreign service, the data has gone there. Letters are disabled in “Account → Notifications” - decide whether they are needed, or whether Web Push and the “Dialogs” section are enough.
CSV export. The file from “Contacts” on the manager’s laptop is also a personal data base. Who uploads, where it stores, when it deletes - questions for you, CHBT does not see this.
AI agent. The text of the client's messages is sent to the language model to generate a response. The models are open, calculations are carried out through an external provider. Practical conclusion: do not place the “AI agent” block on branches where the client dictates the address, passport details or describes health; do not put customer data into the agent’s knowledge base; In the policy, specify processing using AI services.

The rule is simple: every outward arrow from CHBT is a line in your policy and your understanding of exactly where it leads.

Consent without a checkbox: how to do it in messengers and widgets

Let's be honest: there is no checkbox “I agree to the processing of personal data” in CHBT - neither in the pre-chat form of the widget, nor in the “Data Collection” block. There is another mechanism that works more naturally in a conversation: a person reads a text with conditions and takes an action - presses a button or sends a number. The script's job is to make the text appear until collection, but the action was unambiguous.

Scheme for Telegram, MAX and VKontakte

Before the first “Data collection” block, place a “Message” block with the text: “To record you, we need a phone number. By sending it, you agree to the processing of personal data - conditions on the button below.” Three buttons: “Continue” (goes to the branch where the phone is collected), “Conditions” (button link to the policy page) and “Not now” (branch where the person remains in the menu or is transferred to the operator). Immediately after “Continue” add an “Action” → “Add Tag” block, for example consent-PD-v1. The button press is recorded in the conversation history with the exact time - together with the tag, this is your confirmation of who agreed and when. Updated policy - change the tag to v2, and keep the old version for yourself: it will be clear which edition each client agreed to.

A client who comes via a deep link from a newsletter or via a QR from an insert in a parcel ends up in the same flow - consent is shown to him in the same place.

Scheme for a widget on the site

There are two options here. If the pre-chat form is enabled, it appears before any bot message - this means that the consent text must be placed on the site page itself next to the widget (usually in the footer where the policy is), and a short phrase with a link must be duplicated in the “Welcome” field of the widget. If pre-chat is not needed, disable it and collect contacts more gently: trigger “Open widget” → “Message” with consent text and link → then the “Leave contacts” button or the “Data collection” block. More details about both modes can be found in the article about chat widget for website.

Consent to mailing list is separate

Consent to process data for recording and consent to receive advertising are two different things; the second is required by the Advertising Law (Part 1 of Art. 18 of 38-FZ): consent of a specific recipient to advertising from a specific sender. Informational messages — a changed timetable, an order status — are usually not advertising; promotions and discounts are; ultimately it depends on the content. Don't combine the consents into one button. At the end of the script, suggest: “Send promotions and reminders? No more than twice a month” with the “Yes” and “No” buttons; on “Yes” — the рассылка (mailing) tag. The “Consent to mailing list” template does exactly that: it asks for consent to advertising from a named sender, and before that, separately, for consent to data processing naming the operator, the purpose, the data, the term and how to withdraw, with a link to your policy, and adds the согласие-пдн (data consent) tag. In the “Mailouts” section, the audience is selected by tag - people without a tag will not receive messages. Process refusals automatically: trigger “Keyword” to “stop”, “unsubscribe” → “Action” → “Remove tag”. How to build such segments is discussed in the article about tags as a segmentation system.

What to write in the policy if data is collected by a bot

The standard website policy usually describes feedback forms and cookies, but is silent about instant messengers. Supplement it with a section about the bot - these are the points that are most often missing when checking text:

Who is the operator: name of individual entrepreneur or LLC, tax identification number, address, e-mail for requests regarding personal data.
What data: messenger identifiers (Telegram ID, username, profile name; similar for MAX and VKontakte), phone, e-mail, content of correspondence, answers to bot questions, tags and labels that you assign.
Goals - separately: registration and confirmation of the visit; answers to questions; order status notifications; advertising broadcasts - indicating that separate consent is required for the latter.
Legal basis: consent, and for some transactions - execution of the contract (it is impossible to deliver an order without an address).
Handlers: CHBT as a chatbot constructor indicating the details from our terms and conditions; your CRM, if connected via an HTTP request; postal service, if letters are included; AI services, if you use an AI agent.
Where are they stored: databases on the territory of the Russian Federation.
Dates: until the purpose is achieved or consent is withdrawn; for clients with an appointment - for example, three years from the last visit. You determine the number; there is no automatic cleaning in CHBT.
How to revoke consent and request deletion: write to the bot the word “delete” or a letter to the specified e-mail. Below is how to process such a request.
Cookie and widget: if there is a chat on the site, the widget stores the session identifier in the visitor’s browser - mention this in the section about cookies.

The policy must be available before the person gives up the data, hence the order of the blocks from the previous section. Place it on a website page accessible without logging in; in the bot, give the link with a button like “URL” rather than text - it’s easier to click on it from your phone.

“Delete my data” request: processing script in a bot

The client has the right to withdraw consent and request that data be deleted. By law, after revocation, the operator stops processing and destroys data within a limited period of time - up to 30 days, unless there is another legal basis to continue (check the exact deadlines with the current edition). It is better if such a request is not lost in the correspondence, but is processed by the script.

Trigger "Keyword" in the “contains” mode: “delete my data”, “revoke consent”, “delete me”. If the bot at that moment leads a person along another thread, the keyword will still work - this is how the triggers in CHBT are designed. Two caveats: in a conversation that has already been transferred to the operator, triggers are not checked - a person will see the message; in the AI agent mode “Stay in conversation with AI” the text goes to the agent before the triggers are checked. Agree as a team that in these cases the operator puts a tag delete-request manually in the contact card.
“Message” block: “Accepted. We will stop processing your data and delete it within 30 days. We will send confirmation here."
Action block: "Add tag" delete-request and “Notify operator.” The tag provides a list of all requests in “Contacts” by filter, a notification so that the request is seen today.
Operator block: the conversation goes to “Conversations”, the bot becomes silent - the human acts next.

What does the responsible employee do? In “Contacts”, opens the card and clears the name, phone, e-mail, additional fields and tags - editing is available for the Owner and Administrator roles, the Operator does not change the card. This will stop the substitution of data in messages and exclude the person from any broadcasts. It is currently not possible to delete the entire card along with the history of the conversation using a button in your account - send a request to support CHBT (address - in politics), specify the project and contact ID; we will delete the data on our side. At the same time, delete the record in the external CRM, the lead letters and the line in the uploaded CSV - CHBT does not know about these copies and cannot delete them for you.

When everything is done, write a confirmation to the client from “Conversations”. If a person continues to write to the bot, the card will be created again - with a new consent, according to the same flow.

Storage, export and deletion in CHBT: what is there and what is not

Pivot table, so as not to search by sections and not build a process on a function that no.

Opportunity	B CHBT
Data on servers in RF	Yes, on all Plans
Unloading contacts	There is: CSV with one link in the “Contacts” section
Editing and clearing fields cards	Yes, roles Owner and Administrator
Deleting cards and conversation history button	No - upon request in support
Automatic shelf life (delete via N months)	No - you determine the period and request deletion
Delimitation access	There are: roles Owner / Administrator / Operator in the “Access” section, invitation by e-mail
Journal consents	No separate; confirmation - tag plus time of pressing the button in "Conversations"
Consent checkbox in pre-chat form	No - consent text in the greeting and first message

Several hygiene rules that do not depend on functions. Invite employees through “Access” personally, and not with one common login: then it is clear who saw what, and you remove the departed employee in one action. The “Operator” role sees conversations and contacts, but does not change flows, channels and payments - it is enough for linear support. Upload CSV only when you really need the file and delete it after use. The bot token is also a secret: the one who has it reads the correspondence past CHBT.

What the bot settings can’t solve

Some of the operator’s responsibilities live outside the constructor, and we don’t undertake to cover them for you - just name them so that the list is complete.

Roskomnadzor notification about the intention to process personal data. Submitted through the department’s website; There are few exceptions now, and “we only collect phones for recording”, as a rule, does not fall under them. Whether you really need it is a question for a lawyer, not for us.
Responsible for organizing processing and internal documents: order, list of processed data, procedure for responding to requests.
Cross-border transfer, if your CRM, email or analytics are located abroad. She has a separate notification procedure.
Harm assessment and protective measures - formal documents that are asked for during verification.

We describe what we see from the designer’s side: where is the data, who is touching it, how to formalize consent in a conversation. The legal side - what documents a specific business needs - check with a specialist in the field.

Checklist before launching a bot that collects contacts

We wrote down what data the bot receives automatically (ID, profile name) and what it asks for (“Data collection”); unnecessary things were removed from the script.
A section about instant messengers has appeared in the policy, CHBT is listed as a processor, external systems where the data goes are listed.
The policy has been published and can be opened without logging in; the link to it is in the bot with the button to the first “Data collection”.
The consent text is shown before collection; After the “Continue” button, a tag with the version is placed.
Consent to advertising broadcasts - with a separate button and a separate tag; refusing the word “stop” removes the tag.
The script is configured to “delete my data”: tag, notification, transfer to the operator. A person has been appointed who performs the removal and writes to support.
We decided whether letters about leads were needed by mail, and what service this mail was on.
We checked each “HTTP request” in the script: where it leads, who the recipient is, whether it is described in the policy.
If there is an AI agent, it does not stand on branches with sensitive data; there is no customer data in the knowledge base.
In “Access” there are only current employees; line support has the “Operator” role.
Special categories (health and the like) are not collected in free text through the bot.
The lawyer looked at the policy and suggested whether notification to Roskomnadzor was necessary.

None of this requires a paid plan: the Message, Action, Operator blocks and Keyword trigger are available on Free. Collect the script with consent before the bot sees the first client - redoing it on a live base is always more expensive. Create a bot for free →

Personal data processing policy CHBT Terms of use and offer Template “Consent to mailing list”Leads from a bot in CRM: HTTP request Plans