PERSONAL DATA PROCESSING POLICY

This Policy describes how Garipoff LLC (the Operator) processes and protects personal data collected through the websites spotmax.ru and maxos.space (the Site), the SpotMax application and related services (the Service). The Policy is issued under Russian Federal Law No. 152-FZ "On Personal Data". By using the Site or the Service, submitting a request or creating an account you confirm that you have read this Policy.

Account holders: email address; name if provided; a link to a profile picture received from the sign-in provider; plan and payment records (date, amount, method, payment identifier). Card details are handled by payment providers and never reach the Operator. Request form: full name; organisation and role if provided; phone or messenger handle; email; interface language. Technical data: IP address and request metadata recorded on form submission and sign-in for abuse protection. Email addresses may appear in server logs at sign-in and when messages are sent. Conversation content: speech recognition in SpotMax runs on the user's device by default, and in that mode the Operator receives no audio. If the user turns on cloud recognition, audio fragments pass through the Operator's server to a speech recognition service; the Operator does not retain them once the text is returned. Transcripts and notes are stored on the Operator's servers only when the user signs in and enables sync. Cloud features (translation, AI assistant) send the text fragments required for the feature to the respective providers. The Operator does not process special categories or biometric data. Third-party data contained in a user's conversations is processed by the user, who is responsible for having a lawful basis.

Registration and access to the Service; performance of the public offer agreement, including payments and payment documents; handling demo, pilot and enterprise requests; support and service notices; fraud and abuse prevention; compliance with legal obligations of the Operator.

Consent of the data subject (requests and registration); performance of a contract with the data subject (use of the Service); legal obligations of the Operator, including accounting and tax law.

Databases containing personal data of Russian citizens are located on servers in the Russian Federation. Account data is kept while the account exists and deleted within 30 days after account deletion, except records the Operator must retain by law. Request data is kept no longer than three years after the last contact. Technical logs are kept up to one year.

The Operator does not sell personal data or share it with third parties for their own purposes. Data is shared only with processors acting on the Operator's instructions or independent operators required by law. In the Russian Federation: hosting of the Site, the Service, databases and backups (Selectel); payments (T-Bank, Robokassa); text translation (Yandex Cloud); the mailbox receiving Site enquiries. Outside the Russian Federation (United States) four providers remain, each strictly within its function: email delivery for sign-in codes and notices (Resend); language model access for translation and assistant replies (OpenRouter); search over assistant conversations (Pinecone); cloud speech recognition when the user enables it (Deepgram). App installers are delivered through the Cloudflare network, which sees the IP address and browser details on download. Crypto payments, if chosen by the user, are processed by CryptoCloud. Cross-border transfer to that extent complies with Article 12 of Law No. 152-FZ. The Operator is progressively moving processing to Russian providers and narrowing that list: third-party font loading has been removed from the Site, Site enquiries are delivered to a mailbox hosted in Russia, and text translation uses a Russian service. Migration of email delivery to a Russian provider is in progress. The profile picture is stored in the account as a link; the Operator does not keep user files with third-party storage providers. Enterprise customers can run a configuration with cloud features disabled so that data never leaves their infrastructure. Data may be disclosed to authorised state bodies as required by law.

You may request information about the processing of your data, ask for correction, blocking or deletion, withdraw consent, and lodge a complaint with Roskomnadzor or a court. Send requests to the email below from the address linked to your account, or in writing to the Operator's address. We respond within 10 business days. You can delete your account in the Service settings.

The Operator applies the legal, organisational and technical measures required by Article 19 of Law No. 152-FZ: a person responsible for data protection is appointed, access is restricted to job needs, connections are encrypted, sign-in uses one-time codes without stored passwords, media and backups are accounted for, and unauthorised access is detected and blocked.

The Site uses only strictly necessary cookies: the selected language and the signed-in session. No third-party advertising or analytics cookies are used.

By submitting a request form or creating an account you consent to Garipoff LLC processing the personal data you provided (full name, organisation, role, phone or messenger handle, email) by automated means for the purposes in section 3, including collection, recording, storage, use, transfer to the parties in section 6, anonymisation, blocking and deletion. Consent is valid until the purposes are achieved or until withdrawn by email to the Operator.

The Operator may update this Policy. The current version is always available at spotmax.ru/privacy.