Privacy Policy

1.1.This Privacy and Personal Data Processing Policy (hereinafter referred to as the Policy) establishes the procedure for the processing and protection of personal data collected and used by Individual Entrepreneur Tamara Kim (hereinafter referred to as the Operator) in the operation of the website https://sontra.pw, the account dashboard https://account.sontra.pw, the account deletion instructions page https://sontra.pw/delete-account, as well as the related applications, software components, server infrastructure and support services of the Sontra service (hereinafter referred to as the Service).

1.2.The Policy has been developed taking into account the requirements of the legislation of the Russian Federation on personal data, information and consumer rights protection, as well as other applicable regulatory acts.

1.3.The Policy applies to the personal data of website visitors, registered users, payers, persons submitting requests to support, as well as other individuals whose data is received by the Operator in connection with the use of the Service.

1.4.The Policy does not apply to the processing of data by independent third parties, including the owners of third-party websites, mobile operating system platforms and payment services, where such parties independently determine the purposes and means of processing personal data.

1.5.Use of the Service signifies that the User has read this Policy. Where separate consent is required by law, such consent is obtained additionally in the manner established by the Operator.

• •visitors of the website and pages of the Service;
• •Users who have registered an account;
• •persons purchasing paid plans or activating the free plan;
• •persons contacting support or submitting claims, requests or notices;
• •persons whose information is necessary to comply with legal requirements, protect the rights of the Operator and resolve disputes.

4.1.Registration, creation and administration of an account

Purpose: creating an account, identifying the User, providing access to the features of the Service, ensuring the security of sign-in and account management.

Data: e-mail address, nickname, password hash, internal user identifier, date and time of registration, registration IP address, IP address and date of the last sign-in, account status, information about an account deletion request, as well as other service data without which account administration is impossible.

Grounds: conclusion and performance of the agreement with the User, taking steps at the request of the User prior to the conclusion of the agreement, performance of the Operator's obligations and, where necessary, the consent of the data subject.

4.2.Displaying the User's devices and managing account security

Purpose: populating the My Devices section (or an equivalent section), monitoring connected devices, sending service notifications, preventing unauthorized access and abuse.

Data: device model or name, operating system type and version, application version, push token, technical device identifiers to the extent necessary for the operation of the respective feature, information about service connection configurations and the date of their creation/update.

Grounds: performance of the agreement, ensuring the security of the Service and the legitimate interests of the Operator that do not infringe upon the rights and freedoms of the User.

4.3.Provision of secure connection features and technical diagnostics

Purpose: ensuring the operability of the Service, tracking plan usage, diagnosing connection quality, preventing failures, protecting the infrastructure and curbing abuse.

Data: volume of inbound and outbound traffic in bytes, date and time of connection and disconnection, session duration, information on whether the connection succeeded or failed, connection latency metrics, technical connection data, including the IP address, country of connection, configuration or technical node identifier, as well as other minimally necessary diagnostic information.

Grounds: performance of the agreement, ensuring the security of the Service, protection of the rights and legitimate interests of the Operator and Users, performance of obligations provided for by law.

4.4.Technical logs, error handling and user support

Purpose: fixing errors, improving the stability of the Service, reviewing support requests, protecting the infrastructure, preventing recurring incidents.

Data: error type, platform, application version, error message or stack trace, user identifier, date and time of the event, device information, the content of the User's request and any materials attached by the User, if submitted to support.

Grounds: performance of the agreement, the legitimate interests of the Operator in ensuring the quality and security of the Service, as well as the consent of the data subject where required by law.

4.5.Payments, plans, refunds and accounting

Purpose: accepting and confirming payments, activating a plan, maintaining accounting and tax records, processing refunds, resolving disputes and claims.

Data: the selected plan, its price and term, payment details, including the amount, currency, status, date and time of the transaction, order and transaction identifiers, information about the payment partner, as well as other information transmitted to the Operator by the payment service to the extent necessary for record-keeping and performance of the agreement.

Special condition: bank card details are, as a rule, processed by the YooKassa payment service and/or another payment partner in accordance with its own rules and documents. The Operator is not required to receive the full set of card details unless this is necessary to comply with the law or the agreement.

Grounds: performance of the agreement, compliance with the requirements of tax, accounting and other applicable legislation.

4.6.Recording of legally significant actions of the User

Purpose: confirming that the User has read and agreed to the documents of the Service, including the Public Offer, the Terms of Use, the Policy and other mandatory documents.

Data: date and time of the action, document version, consent record, IP address, device information, user identifier, payment status or activation status of the respective feature.

Grounds: conclusion and performance of the agreement, protection of the rights and legitimate interests of the Operator, confirmation of the fact that a legally significant action has been taken.

4.7.Compliance with legal requirements, protection of rights and legitimate interests

Purpose: handling requests from data subjects, preparing responses to inquiries from government authorities, protecting the rights of the Operator in the event of disputes, enforcement actions, claims, security incidents, fraud or unlawful use of the Service.

Data: any information from the categories listed above to the extent objectively necessary to achieve the stated purpose.

Grounds: legal requirements, performance of the agreement, as well as the legitimate interests of the Operator to the extent permitted by law.

• •processing is carried out on a lawful and fair basis;
• •only data that is relevant to the stated purposes and not excessive is processed;
• •databases containing personal data processed for purposes that are incompatible with each other may not be combined;
• •the Operator takes measures to ensure the accuracy, sufficiency and currency of the data;
• •personal data is stored no longer than required by the purposes of processing or by law;
• •once the purposes of processing have been achieved, the data is deleted, destroyed or anonymized, unless further storage is required by law.

6.1.The Operator carries out the collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (provision, access), blocking, deletion, destruction and anonymization of personal data.

6.2.Processing may be carried out by automated means, without the use of automation tools, or by mixed means.

6.3.When collecting the personal data of citizens of the Russian Federation, the Operator ensures that the recording, systematization, accumulation, storage, clarification and retrieval of personal data are carried out using databases located in the territory of the Russian Federation.

6.4.The Operator may entrust the processing of personal data to contractors and technical partners where this is necessary for the operation of the Service, including hosting providers, payment services, and providers of notification infrastructure, monitoring and support tools. In such cases, the Operator requires the recipients to maintain confidentiality and security and to process the data only to the agreed extent.

6.5.Transfer of personal data to third parties is also permitted where necessary to comply with the law or the agreement with the User, to process payments, to protect the rights of the Operator, to resolve a dispute, to curb abuse or to comply with a lawful request of a competent authority.

6.6.Where the actual technical model of the Service involves the use of foreign nodes, platforms or providers, the Operator carries out cross-border transfers of personal data only in compliance with the requirements of the legislation of the Russian Federation, including the submission of mandatory notifications prior to the commencement of such transfers where required by law.

7.1.Personal data is stored for the period necessary to achieve the purposes of processing, for the period during which the account is active, for the term of the paid plan or free plan, as well as for the periods established by the legislation of the Russian Federation, the Operator's internal security rules and documented procedures.

7.2.Technical logs, diagnostic information and incident records are stored no longer than objectively required to ensure operability and security, to investigate failures, to counter abuse and to protect the rights of the Operator.

7.3.Information about payments, settlements and refunds, as well as accounting documents, may be retained for the mandatory periods established by tax, accounting and other applicable legislation, even after the use of the Service has ceased.

7.4.The User may initiate account deletion through the account dashboard in the manner described on the page https://sontra.pw/delete-account. After the deletion is confirmed, the account may be marked for deletion with a waiting period of up to 90 calendar days, during which the User may cancel the request if such an option is provided by the interface of the Service.

7.5.Upon expiry of the waiting period, the personal data associated with the account is subject to deletion, destruction or anonymization to the extent that it is no longer required for the performance of the agreement, compliance with the law, record-keeping, ensuring security, handling claims and protecting the rights of the Operator.

7.6.Anonymized statistics of the Service that do not allow a specific User to be identified, directly or indirectly, may be retained and used by the Operator after the account has been deleted.

7.7.As of the date of approval of this Policy, an automated feature for exporting all of the User's data through the interface of the Service may not be available. This does not limit the right of the data subject to submit a request to the Operator and obtain information to the extent and in the manner provided for by law.

7.8.If the data subject withdraws consent, demands that processing be discontinued or submits another lawful demand, the Operator acts within the time limits and in the manner provided for by the legislation of the Russian Federation, taking into account whether the Operator has other legal grounds to continue processing certain data.

8.1.The Operator takes the necessary and sufficient organizational and technical measures to protect personal data from unlawful or accidental access, destruction, modification, blocking, copying, provision, distribution and other unlawful actions.

• •user passwords are stored in a protected form using modern hashing algorithms;
• •service VPN keys and user configuration materials are stored in encrypted form or in another protected form consistent with the architecture of the Service;
• •connections between the client and the server are protected by cryptographic means employed within the infrastructure in use;
• •access to data is restricted on a need-to-know basis;
• •monitoring, logging and incident response tools are used;
• •the Operator implements internal procedures aimed at preventing and detecting violations, as well as at minimizing the consequences of such violations.

• •to obtain information on whether their personal data is being processed, the purposes, legal grounds and methods of processing, and the retention periods;
• •to demand the rectification, blocking or destruction of data that is inaccurate, outdated, unlawfully obtained or not necessary;
• •to withdraw consent to the processing of personal data where the processing is based specifically on consent;
• •to demand that the processing of personal data be discontinued in the cases and in the manner provided for by law;
• •to appeal against the actions or omissions of the Operator to the authorized body for the protection of the rights of data subjects or to a court.

10.1.Requests relating to the processing of personal data may be sent to the e-mail address kim.agency.drive@gmail.com.

10.2.In order to protect the data, the Operator may request information that makes it possible to verify that the request originates from the proper data subject or their representative.

10.3.Responses to inquiries, demands to discontinue processing, and requests for the rectification or deletion of personal data are sent within the time limits established by the legislation of the Russian Federation.

11.1.The Operator may amend this Policy. The new edition takes effect from the moment it is posted on the website, unless a different date is specified at the time of publication.

11.2.The current edition of the Policy must be permanently available on the Operator's website and on the pages through which personal data is collected.

11.3.In all other respects not governed by this Policy, the Operator and the User are guided by the legislation of the Russian Federation.