Privacy policy

1. Data controller

The controller of personal data is:

Legal name

ОБЩЕСТВО С ОГРАНИЧЕННОЙ ОТВЕТСТВЕННОСТЬЮ «АЗИЯ»

Director general

Павлюков В. С.

INN (tax number)

2466290570

KPP

246001001

OGRN (registration number)

1222400003759

Address

660099, Россия, Красноярский край, г. Красноярск, ул. Железнодорожников, д. 17, оф. 305

Bank details

Р/с 40702810901500119285 в ООО «Банк Точка», БИК 044525104, к/с 30101810745374525104

Phone

+7 933 328-36-37

E-mail

aziya.org@yandex.ru

Website

mediator8.ru

Enquiries about the processing of personal data should be sent to the controller's email address given above.

2. Definitions

Personal data — any information relating to a directly or indirectly identified or identifiable individual (the data subject).

Processing of personal data — any action or set of actions with personal data, including collection, recording, systematisation, accumulation, storage, updating, use, transfer, anonymisation, blocking, erasure and destruction.

User — a person using the Website and the Service.

3. Legal grounds for processing

Personal data is processed on the basis of Federal Law No. 152-FZ of 27.07.2006 “On personal data” and on the basis of the data subject's consent, given at registration by ticking the box accepting the Offer and this Policy.

Data needed to perform an agreement to which the data subject is a party is processed on the basis of clause 5 of part 1 of article 6 of that law.

4. What data we process

The controller processes the following categories of data:

• data given at registration: email address, password hash, name (if provided) and interface language;
• data about use of the Service: length and time of focus sessions and recovery practices, dates and times of events;
• voice recordings made by the User in the diary;
• text transcripts of those recordings;
• results of automatic analysis of the transcripts: numeric scores across five state scales and a short text summary, produced by artificial intelligence;
• technical data: the IP address of a request (used to choose the interface language and to protect against abuse) and session cookies.

Voice recordings, their transcripts and the analysis results are stored by the controller for as long as the User's account exists: they are the content of the diary and are available to the User in the entry history. Recordings are not used to train artificial intelligence models, are not used for advertising and are not disclosed to third parties beyond the cases in section 6.

The controller does not process special categories of personal data or biometric personal data: the User's voice is processed solely for speech recognition and is not used to establish identity.

5. Purposes of processing

Personal data is processed in order to:

• give access to the Service and its functions, and to authenticate and identify the User;
• transcribe voice recordings automatically and produce state scores;
• display entry history and score dynamics;
• administer the subscription and process payments;
• communicate with the User, including notices of charges and answers to enquiries;
• protect the Service from abuse and keep it operational;
• comply with the requirements of Russian law.

6. Disclosure to third parties and cross-border transfer

For speech recognition and text analysis, a recording and its transcript are transferred to the Alibaba Cloud (DashScope) cloud service, whose computing capacity is located in the Republic of Singapore. Only the audio file and the transcript text are transferred — without the email address, name or any other account identifier. This transfer is a cross-border transfer and is carried out with the User's consent given at registration and for the purpose of performing the Agreement.

To accept payments, payment data is transferred to the Robokassa payment service. Payment method details are not transferred to, and not stored by, the controller.

Database backups are made daily and stored encrypted (AES-256). The encryption key is held by the controller and is not transferred together with the copies, so those who operate the storage locations have no access to the personal data they contain.

The controller does not sell personal data. Data is disclosed to state authorities only in the cases provided for by Russian law.

7. Where and how long data is stored

The Service database and audio files are hosted on a server located in the Russian Federation. Recording, systematisation, accumulation, storage, updating and retrieval of the personal data of citizens of the Russian Federation are carried out using databases located in the Russian Federation.

Personal data is kept for as long as the User's account exists and no longer than the purposes of processing require, or until consent is withdrawn. Once the purposes are achieved, data is erased or anonymised.

After an account is deleted, data is removed from the live database immediately and from backups as they rotate naturally, within no more than 14 (fourteen) calendar days.

8. Rights of the data subject

The User may:

• obtain information about the processing of their personal data;
• change their data and interface language on their own, in the “Settings” section;
• require data to be corrected, blocked or erased where it is incomplete, outdated, inaccurate or processed unlawfully;
• withdraw consent to the processing of personal data;
• appeal against the controller's actions to the supervisory authority (Roskomnadzor) or in court.

Deleting the account together with all related data — entries, transcripts, analysis results and audio files — is done by the User in the “Settings” section. Deletion is irreversible and constitutes withdrawal of consent to the processing of personal data. To exercise the other rights it is enough to write to the controller's email address.

9. Data security

The controller takes the necessary legal, organisational and technical measures to protect personal data against unlawful access, destruction, alteration, blocking, copying and dissemination.

The connection to the Website is protected by TLS. Passwords are stored only as bcrypt hashes and cannot be recovered. Audio files are not available at a direct link: they are served only to the owner of the recording after the session is checked. Backups are encrypted before they leave for storage.

10. Minors

The Service is not intended for persons under 16. The controller does not deliberately collect personal data of such persons. If such data is found, it is deleted.

11. Changes to the Policy

The controller may amend this Policy. The current version is always published on the Website at mediator8.ru/privacy. The controller announces material changes by email. Continuing to use the Service after changes are published means agreement with the new version.