Personal Data Processing Policy

The personal data operator is Individual Entrepreneur Teterin Pavel Alekseevich (TIN 343526476218, OGRNIP 324774600607451, address: Moscow, Russia) (hereinafter, the “Operator”).

Personal data means any information relating directly or indirectly to an identified or identifiable natural person (the data subject). Processing means any action performed with personal data: collection, recording, storage, use, transfer, deletion and others.

By using the service and giving consent to the processing of personal data, the user confirms that they have read this Policy.

The Policy is published in open access at modelmesh.shop/legal/privacy. Consent to the processing of personal data is executed as a separate document: modelmesh.shop/legal/consent.

The Operator processes personal data only for predetermined purposes:

• registration, identification and authentication of the user, logging in to the account and confirmation of the email address;
• provision of services: access to neural networks, token accounting, maintenance of the transaction history, operation of API keys;
• acceptance of payments, processing of refunds and fiscal receipts, and performance of the requirements of legislation on accounting and tax accounting;
• responding to inquiries and user support;
• ensuring the security of the service and preventing fraud and abuse (for example, obtaining bonuses through multiple accounts);
• improving the operation of the service on the basis of anonymized and aggregated statistics;
• sending service messages (login codes, notifications about payments and subscriptions, changes to the terms).

Legal grounds: the consent of the personal data subject; conclusion and performance of a contract (public offer) to which the user is a party; performance of obligations imposed on the Operator by law; protection of the legitimate interests of the Operator and third parties, provided that the rights of the data subject are not violated (Article 6 of 152-FZ).

The Operator sends advertising and informational mailings only if the user has given separate consent to receive advertising.

Depending on how the user uses the service, the Operator may process:

• email address; name, nickname, identifier and profile picture, if the user logs in through a third-party service (for example, Google, Yandex, Telegram) and has permitted their transfer;
• account data: token balance, plan and subscription, history of credits and debits, settings, information about API keys (the keys themselves are stored only as a hash);
• payment data: amount, date, status and identifier of the payment, payment method, email address for the receipt. The Operator does not receive or store the bank card number or card details — they are processed by the payment service and the bank;
• the content of requests to neural networks and generation results, uploaded files — to the extent the user has submitted them;
• technical data: IP address, browser and device type, date and time of requests, cookies, service request logs (model, volume, cost).

The Operator does not collect special categories of personal data (concerning racial or ethnic origin, political views, health, etc.) or biometric personal data for identification. It is not recommended to include such data, or personal data of third parties, in requests and uploaded materials.

The Operator performs the following actions with personal data: collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (provision, access) in the cases specified in this Policy, anonymization, blocking, deletion and destruction.

Processing is carried out by a mixed method — with and without the use of automation tools.

Personal data is stored no longer than the purposes of processing require:

• account data and usage history — for as long as the account is active;
• after deletion of the account or withdrawal of consent, the data is deleted or anonymized within a period not exceeding 30 days, unless the law requires it to be retained longer;
• payment and accounting documents (payments, receipts, balance transactions) — for the periods established by legislation on accounting and tax accounting, but not less than 5 years;
• technical logs and data for ensuring security — for up to 12 months.

The Operator carries out the recording, systematization, accumulation, storage, clarification (updating, modification) and retrieval of personal data of citizens of the Russian Federation using databases located in the territory of the Russian Federation (Part 5 of Article 18 of 152-FZ).

The Operator may transfer data only to the extent necessary to achieve the purposes of processing:

• to the YooKassa payment service — for accepting payments and processing refunds and receipts;
• to neural network providers — only the content of the request and files uploaded for generation. The email address, name and other account data are not transferred to providers;
• to organizations that ensure the operation of the service on behalf of the Operator (hosting, email delivery, monitoring) — on the basis of contracts obliging them to observe the confidentiality and security of the data (Part 3 of Article 6 of 152-FZ);
• to state authorities — in the cases and in the manner provided by law.

Some neural network providers are located outside the Russian Federation, therefore the content of requests may be transferred abroad. The Operator complies with the requirements of Article 12 of 152-FZ, including notifying Roskomnadzor of cross-border transfers. If the user includes personal data of third parties in a request, the user must have a basis for transferring it.

The Operator takes legal, organizational and technical measures to protect personal data (Articles 18.1 and 19 of 152-FZ), including:

• transmission of data between the user and the service over a secure channel (HTTPS);
• storage of API keys only as an irreversible hash;
• differentiation of access of employees and contractors to data on a need-to-know basis;
• regular backups of databases;
• rate limiting of requests and protection against automated attacks;
• logging of actions involving critical data and operations.

The user has the right to:

• obtain confirmation of the processing of their personal data and information about the purposes, methods and periods of processing, the persons to whom the data is transferred, and the source of the data;
• demand clarification, blocking or destruction of the data if it is incomplete, outdated, inaccurate, obtained unlawfully or not necessary for the stated purpose;
• withdraw consent to the processing of personal data;
• object to the processing of data for the purposes of promoting goods and services;
• appeal the actions or inaction of the Operator to Roskomnadzor or in court and claim compensation for losses and compensation for moral damage.

To exercise these rights, a request must be sent by phone +7 961 674-10-00 or via the support chat / Telegram in your personal account or to the address: Moscow, Russia. The Operator responds within 10 business days of receiving the request; this period may be extended by no more than 5 business days with a reasoned notice (Article 14 of 152-FZ).

Upon withdrawal of consent, the Operator ceases processing and destroys the data within up to 30 days, unless it has another lawful basis for processing (Part 5 of Article 21 of 152-FZ). The provision of services is impossible without personal data, therefore withdrawal of consent means ceasing to use the service and deletion of the account.

Cookies are small files that a website saves in the user’s browser. Browser local storage plays a similar role.

The website uses:

• strictly necessary cookies — maintaining the session after login and protection against request forgery. Logging in to the account is impossible without them;
• functional data in the browser’s local storage — the selected interface theme. It is not transmitted to the server.

The website does not currently use third-party analytics or advertising cookies. If they appear, the Operator will use them only after the user’s consent and will update this Policy.

The user may delete cookies or prohibit their storage in the browser settings. Prohibiting strictly necessary cookies will make it impossible to log in to the account.

The service is intended only for persons who have reached the age of 18 (public offer, section on registration), and the Operator does not intentionally collect data of minors. If it turns out that an account was registered by a minor, the Operator blocks the account and deletes its data, except for data that it is required to retain by law.

The Operator may amend the Policy. The new version takes effect from the moment of its publication on the website; the date of the version is indicated at the top of the page.

Questions about the processing of personal data: phone +7 961 674-10-00, support chat / Telegram in the personal account, address: Moscow, Russia.