Personal Data Processing Policy

1.1. This Policy explains how Individual entrepreneur Roman Sergeevich Chernyshev, Russian taxpayer ID 525102431403, primary state registration number 319527500082280 (the “Controller”) processes personal data on verstak.chat, app.verstak.chat, their subdomains, and within the Verstak service (together, the “Service”).

1.2. The Policy follows Russian Federal Law No. 152-FZ “On Personal Data”. It applies to website visitors, registered users, workspace members, client and contractor representatives, support contacts, and other people whose data is lawfully submitted to the Service.

1.3. Do not submit third-party personal data without a lawful basis. Text and files included in a generation request may be sent to the provider of the selected AI model.

• Account: email, name or alias, password hash, user id, consent record; where Yandex ID or VK ID is used, the external account id, name, and available email.
• Workspace: business and brand profile, settings, member roles, knowledge sources, connected channels, calendar, and activity history.
• Requests and content: chat messages, instructions, documents, links, images, video, audio, voice samples, drafts, generated results, edits, publications, and execution metadata.
• Payments: plan, amount, currency, status, payment and receipt ids, masked payment instrument, and invoice or refund details. A payment partner normally processes full card data.
• Support: requests, attachments, contact details, transactional emails, and notifications.
• Technical, analytics, and attribution data: IP address, time, page and referrer, UTM tags, advertising click IDs (such as yclid, gclid, fbclid, ttclid, and vk_click_id), other URL parameters, device, OS, browser, language, anonymous visitor and session ids, security and error logs, cookies, local settings, page views, clicks, and interface interaction recordings where analytics is allowed.

2.2. The Service does not use face or voice material to establish identity and does not operate a biometric identification system. The Service is not intended for special categories of personal data.

We process data to create and secure accounts, provide requested agent and content functions, connect platforms, take payments, provide support, prevent abuse, comply with law, and improve the Service. The bases are entering into and performing the contract, steps requested before the contract, legal obligations, protection of lawful interests with appropriate balancing, and consent where required. Marketing is sent only with separate consent.

Consent to personal-data processing is requested separately from the public offer and other documents. Withdrawal does not invalidate earlier processing or processing that has another lawful basis.

We collect, record, organize, store, update, retrieve, use, disclose to authorized processors, anonymize, restrict, erase, and destroy data using automated systems.

Account, workspace, and content data is processed while the contract is active and afterwards only as needed for export, claims, security, legal duties, and backup cycles. Financial records are retained for statutory accounting and tax periods. Data is erased or anonymized when the purpose and all other legal grounds end.

When collecting personal data of Russian citizens, the Controller uses databases located in Russia for the operations required by Russian localization law, except where the law provides otherwise.

Prompts, files, and technical context may be sent to the provider used for a requested AI or media operation. This may include OpenRouter and the developer of the selected language model, or the image, video, voice, or music provider identified in the interface or generation record.

A transfer outside Russia may take place only after the requirements of Article 12 of Law No. 152-FZ are met and a legal basis exists. Context is minimized. Do not include passport, medical, banking, or unrelated third-party information in prompts.

We may use Russian cloud and storage providers, transactional email, Yandex and VK sign-in, Yandex Metrica where allowed, the public webchat provider, payment and fiscal partners, AI and media providers selected for a request, and social networks or CMS platforms connected by the user.

We do not sell personal data or disclose it to the public. Government disclosure occurs only on a lawful request. The exact providers depend on enabled functions and the selected generation route.

For personal data that a customer submits about clients, staff, people depicted in content, or other third parties, the customer determines the purpose and legal basis and the Controller processes it on the customer’s instructions to provide the Service. The customer must provide lawful instructions, required notices and consents, and respect restrictions on publication, image, and voice rights.

Necessary cookies and local storage support sessions, security, language, theme, draft forms, the interface, and an anonymous visitor id used to attribute a visit to a later registration. Yandex Metrica and the public webchat load when a page opens and may receive IP, device, page, and interaction data.

An information banner explains this processing. Clicking “OK” confirms acknowledgement and is stored locally so the banner is not shown again. Browser restrictions may disable some Service functions.

We use access controls scoped to workspaces and roles, encrypted transport, password hashing, restricted and audited administrative access, backups, security monitoring, secrets management, and incident response. Connected-channel tokens are encrypted at rest. Users must protect credentials and avoid unnecessary sensitive data.

You may request information, correction, restriction, or deletion where the statutory conditions apply, withdraw consent, object where permitted, and complain to the Russian data-protection authority or a court. Send requests to support@verstak.chat. We may verify identity or authority and respond within the period required by Law No. 152-FZ.

Withdrawal may make the account unusable. Data retained under another legal basis is kept until that basis ends.

The current version is always available at verstak.chat/en/privacy/. Material changes may also be announced in the Service or by email. This Policy does not replace a separate consent, instruction, or notice required for a particular function.

Individual entrepreneur Roman Sergeevich Chernyshev, Russian taxpayer ID 525102431403, primary state registration number 319527500082280
Website: verstak.chat
Personal-data email: support@verstak.chat