Personal data processing policy

This Personal Data Processing Policy (hereinafter — the “Policy”) defines the procedure for processing and protecting the personal data of users of the “Lumi AI” service (hereinafter — the “Service”) and has been drawn up in accordance with Federal Law No. 152-FZ of July 27, 2006 “On Personal Data,” Federal Law No. 149-FZ of July 27, 2006 “On Information, Information Technologies, and the Protection of Information,” as well as other regulatory legal acts of the Russian Federation in the field of personal data processing.

This Policy applies to information that the Operator may obtain about the user during their use of the Service. The Policy does not apply to third-party sites and services that may be linked from the Service.

The personal data operator is:

• Individual Entrepreneur Konstantin Ravilyevich Vakhitov
• ИНН: 541500228607
• ОГРНИП: 326547600121700
• Address: 630501, Novosibirsk Oblast, Novosibirsky District, urban settlement Krasnoobsk, 3rd microdistrict, bld. 14/1
• Email address: kv.pro00@mail.ru

All questions related to the processing of personal data are to be sent to the specified email address.

3.1. Data provided by the user:

• email address;
• name or nickname used to address the user.

3.2. Data collected automatically when using the Service:

• IP address;
• device and browser information (User-Agent);
• session identifier;
• date and time of requests to the Service;
• cookies specified in Section 8.

The Operator does not request special categories of personal data (racial or ethnic origin, political, religious, or philosophical beliefs, state of health, intimate life) or biometric personal data.

The Operator processes personal data for the purposes of:

• preparing, concluding, and performing the public offer;
• registering the user in the Service, identification, and providing access to the account;
• processing payments, arranging and servicing Plus Packages, and refunding funds;
• personalizing communication with AI characters and building long-term dialogue memory;
• ensuring the technical functionality and security of the Service, and protection against fraud and abuse;
• sending the user notifications related to the use of the Service (service and system messages);
• reviewing user requests and responding to them;
• improving the quality of the Service.

The Operator processes personal data on the following legal grounds:

• the user's consent to the processing of personal data, which is given by ticking a separate box (checkbox) during registration confirming that the user has read the text of the Policy and consents to the processing of personal data. The consent is not part of accepting the offer and may be withdrawn separately;
• the necessity of performing an agreement to which the user is a party (clause 5 of part 1 of Article 6 of Federal Law No. 152-FZ);
• the necessity of the Operator pursuing legitimate interests, provided that the rights and freedoms of the user are not violated.

The Operator carries out the collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, transfer (provision, access), anonymization, blocking, deletion, and destruction of personal data.

Personal data is processed both with and without the use of automation tools.

Data is transferred to third parties only in the following cases and to the extent necessary to achieve the corresponding purposes:

• to providers of infrastructure services (hosting, databases, file storage) engaged for the technical operation of the Service, subject to their observance of confidentiality;
• to artificial intelligence service providers that process user requests to generate the responses of AI characters;
• to payment services engaged to accept and process payments — to the extent necessary to carry out settlements;
• to other persons — where there is the user's explicit consent or in cases directly provided for by the laws of the Russian Federation (upon requests from authorized bodies).

The Service uses cookies and similar technologies to:

• maintain the user's session and secure authorization;
• save user settings (for example, the chosen appearance theme);
• ensure the correct operation of the Service's technical components.

Disabling cookies may limit the functionality of the Service.

The Operator processes personal data throughout the entire period the user's account is active or until the consent to the processing of personal data is withdrawn. After the account is deleted, personal data is deleted or anonymized within no more than 30 calendar days, except in cases where a longer retention period is required by the laws of the Russian Federation (including tax and accounting laws — for information about payments made). Backup copies may contain deleted data for a limited period determined by the backup rotation cycle, after which they are automatically overwritten.

The Operator takes the necessary legal, organizational, and technical measures to protect personal data from unlawful or accidental access, destruction, modification, blocking, copying, distribution, as well as from other unlawful actions of third parties, including:

• storing passwords as cryptographic hashes that make it impossible to recover them;
• using a secure data transfer protocol (HTTPS/TLS);
• restricting access to data and storing it on servers with limited physical and logical access;
• regularly updating and monitoring the software used.

To exercise the rights established by law, the user sends a request to the Operator's email address with the subject “Personal Data.” The request must specify: first and last name, the email address used at registration, and the substance of the request. The Operator reviews the request and provides a response within the time frames established by the laws of the Russian Federation.

Withdrawing consent to the processing of personal data whose provision is necessary for the performance of the agreement and/or compliance with legal requirements makes further use of the Service impossible and results in the deletion of the account.

The Operator has the right to make changes to this Policy. The current version is always posted on the /privacy page, indicating the date of the version. Continued use of the Service after the changes are published constitutes the user's consent to the new version of the Policy.

All questions, comments, and requests related to the processing of personal data are to be sent to the Operator at the email address: kv.pro00@mail.ru