Personal Data Processing Policy

1. General Provisions

1.1. The personal data operator is Individual Entrepreneur Fabio De Luca, TIN (INN) 770165669069, OGRNIP 322774600382672, address: 19 Tatyanin Park St., Moscow, email: support@aiogo.ru.

1.2. This Policy applies to data processing when using the website https://aiogo.ru, the personal account, AI OGO mobile apps, official MCP connections, integrations, support and other expressly designated interfaces of the Service.

1.3. The Operator is guided by Federal Law No. 152-FZ “On Personal Data” and other applicable legal provisions of the Russian Federation.

1.4. This Policy is an informational document. Where the law requires consent, it is requested separately. Declining optional purposes, including advertising mailings and optional analytics, does not restrict the core operation of the Service.

2. Categories of Data Subjects and Data

2.1. The Operator may process data of:

• visitors to the website and apps;
• registered Users and Customers;
• payers, if the payer is different from the User;
• persons contacting support or sending legally significant communications;
• representatives of rights holders and other claimants;
• persons whose data the User has lawfully included in a prompt or uploaded to the Service.

2.2. Depending on the feature used, the following is processed:

• email, display name, phone number and other profile data, if provided;
• identifiers, account names and technical tokens of Telegram, other messengers, apps, official bots and integrations that the User has linked to AI OGO;
• internal account identifier, information about authorization, email verification and linked sign-in methods;
• information about the plan, balance, accruals and deductions of Credits;
• amount, date, status, order number, payment transaction identifiers, masked payment method, refund and subscription information; the Operator does not receive full card details;
• prompts, negative prompts, settings, selected models, uploaded files, images, videos, audio, Results and related history;
• IP address, date and time of actions, browser and device type, operating system, language, session identifiers, cookies, error, security and anti-fraud logs;
• support tickets, attachments and correspondence with support;
• information necessary to review a complaint, protect rights, comply with the law and prevent abuse;
• consents, refusals, versions of accepted documents and information confirming the relevant action.

2.3. The Service is not intended for the targeted collection of special categories of personal data or biometric data used for identification. The User must not include such information in prompts without a lawful basis and genuine necessity. Technical processing of a photo or voice to create a Result does not in itself mean that the Operator identifies a person by biometric characteristics.

2.4. If the User provides data of another person, the User confirms having a lawful basis for its transfer and processing to the extent necessary for the selected Operation.

3. Purposes and Legal Bases

3.1. The Operator processes data for the following purposes:

3.2. The Operator does not make advertising consent a condition of registration or purchase.

3.3. Automated tools may be used for moderation, fraud detection, limit management and security. A decision that significantly restricts access may be appealed through support. The Operator may withhold information whose disclosure would allow protections to be circumvented or would violate the rights of third parties.

4. Actions Performed with Data

4.1. The Operator collects, records, systematizes, accumulates, stores, updates, retrieves, uses, matches, transfers to authorized processors, provides in cases established by law, anonymizes, blocks, deletes and destroys data, with or without the use of automated means.

4.2. Access is granted only to employees and contractors who need it for the relevant function and who are bound by confidentiality and data protection obligations.

4.3. The Operator does not sell personal data and does not make uploaded materials available to an indefinite number of persons without a separate basis.

5. Processing and Deletion Periods

5.1. Data is stored no longer than necessary for the purpose of processing, performance of the contract, dispute resolution and compliance with mandatory legal requirements.

5.2. Main processing periods:

• active account data — for as long as the Service is used; after the account is closed, a limited set of data may be stored for up to one year for security, fraud prevention, recovery, handling of support tickets and dispute resolution;
• data on orders, receipts, refunds and accounting — for the periods established by tax, accounting and cash register legislation, as a rule no less than five years;
• support tickets — up to one year after the ticket is closed, or longer in the event of an ongoing dispute;
• information on consents, refusals and document versions — for the duration of the relationship and up to three years after its termination, or longer in the event of an ongoing dispute;
• authorization, security and anti-fraud logs — up to one year, and those relating to an incident or dispute — until the investigation is completed and the applicable period for protecting rights expires;
• prompts, uploads and Results — while the account is active and the relevant history is available to the User; after the account is closed, they are deleted from active systems or anonymized within up to 30 days, unless a separate lawful basis requires otherwise;
• isolated backups of deleted data — up to 30 days; they are not used for normal operations, and upon restoration the deletion and processing restriction records are reapplied to them;
• basic statistics cookies and identifiers — within the period set by the relevant tool and applicable law;
• advanced analytics cookies and identifiers — within the period specified in the cookie settings and the relevant tool, or until consent is withdrawn, whichever occurs first;
• advertising contacts — until consent is withdrawn; proof of previously obtained consent may be stored longer to protect rights.

5.3. Once the purpose is achieved, data is deleted, destroyed or anonymized, unless further storage is required by law, contract or for the ongoing protection of rights.

5.4. Deletion from an active system may not mean immediate deletion from a restricted backup. Such backups are not used for normal operations and are deleted according to the established retention cycle.

5.5. If the User has separately permitted the use of a specific material within AI OGO, in a public gallery, in advertising or for other agreed purposes, the permitted copy may be stored for the term of the relevant permission. Such permission is requested separately, specifies the selected material and the permitted methods of use, and may provide its own procedure for terminating future use.

6. Russian Databases and Processors

6.1. Initial recording, systematization, accumulation, storage, updating and retrieval of personal data of citizens of the Russian Federation collected by the Operator are carried out using databases located in the Russian Federation where required by law.

6.2. To operate the Service, the Operator may entrust processing to:

• Russian hosting and infrastructure providers;
• cloud storage and file delivery providers;
• payment institutions and the fiscal data operator;
• authorization and contact verification providers;
• email, notification and support services;
• analytics providers: for basic website statistics, and for advanced analytics and advertising technologies — subject to the necessary consent;
• Russian and foreign Model Providers to perform the Operation selected by the User;
• contractors for security, fraud prevention and technical support.

6.3. A processor receives only the data necessary for the entrusted function and is required to comply with confidentiality, security, purpose limitation and deletion requirements.

6.4. The Operator publicly discloses the categories of recipients and the countries of cross-border transfer, but does not disclose its commercially sensitive routing scheme, internal architecture or the terms of contracts with providers, unless disclosure is expressly required by law or by a lawful request from an authorized person.

7. Cross-Border Transfer

7.1. To fulfill the selected request, text, settings and uploaded materials may be transferred to a foreign Model or infrastructure Provider. The User should not submit excessive personal, special-category, biometric or confidential information.

7.2. As of the date of this version, transfers may be made to recipients in the People’s Republic of China and the United States of America. Before the relevant cross-border transfer begins, the Operator carries out the assessment and notification actions required by law. Transfers are made only to the extent necessary and on a basis provided for by law.

7.3. When adding a recipient in another country, the Operator, before the transfer begins, carries out the required assessment, updates the notification where necessary, and updates the Policy to the extent it affects the User’s awareness.

8. Cookies and Analytics

8.1. Necessary cookies and local storage are used for sign-in, security, routing, saving settings, balance and other functions without which the work requested by the User is impossible or significantly impaired.

8.2. Yandex Metrica is used when visiting the Website for basic statistics: counting visits, identifying traffic sources, analyzing page usage, technical performance, goal completions and the effectiveness of User acquisition. For this purpose, the following may be processed: the address of the visited page without arbitrary parameters, the referral source, permitted advertising campaign parameters, technical information about the browser and device, cookies, local storage data and the Yandex Metrica visitor identifier. The content of prompts, uploaded files and Results is not transferred to basic statistics. Webvisor and click maps are not used in basic mode.

8.3. Yandex Metrica basic statistics operate regardless of the optional cookie settings selected. Advanced analytics, advertising technologies and personalization are enabled only after a separate choice by the User; this choice can be changed in the cookie settings. The terms of advertising messages are set out in the separate Consent to Receive Informational and Advertising Messages.

8.4. Declining advanced analytics and advertising technologies does not restrict registration, payment or core features.

9. Data Protection

9.1. The Operator applies the necessary legal, organizational and technical measures: access control, authentication, logging, backups, component updates, secure transmission, contractor oversight, incident response and other measures commensurate with the level of risk.

9.2. If an incident is detected, the Operator takes measures to contain it, investigate it and mitigate its consequences, and sends the notifications required by law.

9.3. No method of transmission or storage guarantees absolute security. The User is also required to protect their password, device, session and email access.

10. Data Subject Rights

10.1. The data subject has the right to obtain the information about processing provided for by law, to demand the correction, blocking or deletion of unlawfully processed data, to withdraw consent, to object to processing in cases provided for by law, and to appeal the Operator’s actions.

10.2. Requests are submitted through private support or to support@aiogo.ru. To protect the account, the Operator may verify the identity and authority of the requester. A response is provided within the time limits established by law. The procedure for providing the main consent is described in the Consent to the Processing of Personal Data.

10.3. Withdrawal of consent does not affect the lawfulness of processing prior to withdrawal. The Operator may continue processing without consent where there is another lawful basis, including performance of a contract, a legal obligation and the protection of rights.

10.4. Deleting data necessary for the account and performance of the contract may make further use of the Service impossible. This does not limit the right to withdraw optional consents without losing the core service.

11. Changes to the Policy

11.1. The Policy is updated when the law, features, scope of data or infrastructure change. A new version is published with its effective date.

11.2. If a change introduces a new purpose or other processing that requires consent, the Operator requests such consent separately before that processing begins.

12. Operator Contact Details

Individual Entrepreneur Fabio De Luca TIN (INN): 770165669069 OGRNIP: 322774600382672 Address: 19 Tatyanin Park St., Moscow Email: support@aiogo.ru Business hours: daily from 10:00 to 18:00 Moscow time