Personal Data Processing Policy

1. General provisions

This Privacy Policy describes how the Operator processes and protects personal data when Users access AITale. It is prepared under Federal Law No. 152-FZ on Personal Data and other applicable Russian legislation.

2. Key terms

Personal data means information relating to an identified or identifiable person. Processing includes collection, recording, organization, storage, updating, retrieval, use, transfer, anonymization, blocking and deletion. Automated processing uses computing systems.

3. Purposes of processing

• Register and authenticate Users and maintain Accounts.
• Provide Platform features, process generation requests and deliver results.
• Accept payments, maintain the Balance and comply with accounting and legal duties.
• Respond to support requests, improve security, prevent abuse and diagnose errors.
• Send service messages and, where separate consent exists, informational or promotional messages.

4. Legal grounds

Processing is based on the User's consent, performance of the User Agreement, the Operator's statutory obligations and other grounds permitted by Russian law. Publicly available data is processed only where a lawful basis exists.

5. Categories of data

• Account information such as email address, identifiers and authentication data.
• Payment and transaction information received from payment providers; full payment-card data is not stored by the Operator.
• Technical information including IP address, device, browser, cookies, request logs and security events.
• Support correspondence supplied by the User and technical information about generation requests. Prompts, uploaded files and generated results are User Content and must not contain personal data.
• Data received from Telegram, MAX, VK or another integration when the User signs in through that service.

6. User content

Account personal data used for registration, authentication, payment, support and security is separate from User Content. The Platform, including the Online Photo Studio and AITale Family, is not intended to process personal data within prompts, images, audio, video or other uploaded files.

Users must not submit their own or any third party's personal data, including photographs, audio or video of identifiable persons, document images, names, addresses, telephone numbers, location information, voice recordings, medical information, special categories of personal data or any information that permits a person to be identified alone or together with a prompt or metadata.

Before submission, the User must remove personal data and metadata or reliably anonymize the content. Consent covering the User's Account does not cover personal data in User Content and does not authorize submission of another person's data.

The selected external AI provider receives only the content and parameters needed to perform the request. The Operator does not add the User's email address, name, IP address, internal Account identifier, password or payment information. Under this Policy, the submitted content must contain no personal data.

The Operator may inspect, reject, stop or delete content when prohibited data is detected. Such measures do not create a duty to inspect every file and cannot guarantee detection of every violation. Accidental receipt caused by a User's breach does not constitute acceptance of a personal-data processing instruction and is limited to containment, security, incident handling, legal compliance and deletion.

Generated files are normally retained for the period shown in the interface and may then be automatically deleted. The User should download any results that must be preserved.

7. Disclosure to third parties

Data may be shared only to the extent necessary with hosting, infrastructure, analytics, communication, payment and AI service providers, or where disclosure is required by law. Processors must observe applicable confidentiality and security duties.

8. External services and place of processing

The selected AI provider receives the prompt, file and generation parameters required to perform the request, which must not contain personal data. Account, authentication, payment and balance personal data is stored and processed using databases located in the Russian Federation.

If a future feature requires a different scope, method or territory of personal-data processing, its terms will be published separately and accepted before the feature is used.

9. Retention and deletion

Data is retained only for as long as needed for the stated purposes, the User Agreement and mandatory legal periods. It is deleted or anonymized when the purpose or legal basis ends, unless continued retention is required by law.

11. Data security

The Operator applies reasonable legal, organizational and technical safeguards against unauthorized access, alteration, disclosure, blocking, copying or destruction. No internet transmission or storage method can provide an absolute guarantee.

12. Data-subject rights

• Request information about processing and access to personal data.
• Request correction, blocking or deletion of inaccurate or unlawfully processed data.
• Withdraw consent where processing relies on consent.
• Complain to the competent authority or court as provided by law.

13. User responsibilities

The User must provide accurate Account information, keep it up to date, and ensure that User Content contains no personal data or protected secrets. A breach does not constitute consent by the data subject or a lawful basis for processing.

14. Policy changes

The Operator may update this Policy. The new version takes effect when published unless it states otherwise. Continued use after publication indicates acceptance; Users may stop using the Platform and request deletion if they disagree.

Operator details