Back to home

What Varta sees

Varta reads messages in the groups where you made it an admin — that is the only way to tell a scam from a conversation. Here is exactly what that means: what leaves our servers, who sees it, and how long anything is kept.

What reaches the AI

For every message we check, the model receives the message text, the group's title, up to five recent messages from the same chat as context, and the sender's @username together with public profile signals such as account age.

Numeric Telegram user IDs never leave our servers.

The @username goes with it on purpose: pretending to be an admin or a support account is itself one of the patterns Varta is looking for.

Who the AI is

Anthropic answers first, with OpenAI and Google as backups for the moments it cannot. Links are additionally checked against Google Safe Browsing. All of them work under API terms that exclude training on what we send.

The model does not change under you

Varta names an exact model version instead of following “latest”. A newer model cannot quietly start moderating your group differently — moving to one is a decision we make and ship, not something that happens overnight.

What stays, and for how long

A message that is neither flagged nor borderline
not stored at all
Flagged content, kept for your review
90 days, and its text and @username are overwritten at 90 days too, so nothing readable outlives that
Borderline calls, including the ones judged clean
30 days — this is what lets a later catch also clear the same sender's earlier messages
Your own conversations with the bot
30 days
Usage counts
30 days
Learned spam patterns
90 days from first sighting
Cross-group ban signals
180 days from the last offence

Your data, whenever you ask

Send /deletedata to the bot in a direct message. Your settings, conversation history, statistics and your ID inside learned patterns go straight away, and the bot tells you how many records it removed.

Cross-group ban signals are the one exception: they stay for up to 180 days from the last offence, so that a reset cannot clear a strike count. Ask us by email and we will handle those case by case.

Where it lives

Servers are in the European Union (Finland). AI processing happens in the United States, at the providers named above.

The Privacy Policy has the full list — every sub-processor, the legal bases, and your GDPR rights.

Read the Privacy Policy