Personal Data Processing Policy
ЧЕРНЕТКА — потребує перевірки юристом. Текст — шаблон, підготовлений без юриста, він не остаточний; поля у подвійних фігурних дужках ще потрібно заповнити.
Показано англійською для довідки. Юридично значуща версія — російська; у разі розбіжностей текстів пріоритет має російська версія. Відкрити російську версію
Published under Art. 18.1(2) of Federal Law No. 152-FZ of 27.07.2006 "On Personal Data" (152-FZ). Version 1.0.0, effective {{EFFECTIVE_DATE}}.
1. Operator
1.1. Operator: {{COMPANY_NAME}}, OGRN {{OGRN}}, INN {{INN}}, address {{LEGAL_ADDRESS}}; personal-data contact privacy@kleogeo.ru; phone {{PHONE}}.
1.2. Roskomnadzor register of personal-data operators number: {{RKN_REG_NUMBER}}.
1.3. Person responsible for organising personal-data processing (Art. 22.1 152-FZ): {{DPO_NAME}}, {{DPO_POSITION}}, privacy@kleogeo.ru.
1.4. "KleoGEO" (https://kleogeo.ru) is for organisations and sole proprietors. This Policy describes how we process data of service users (customers' employees) and site visitors. Data a customer enters in its workspace is processed on its instruction — see the DPA.
2. Roles
| Data | Our role |
|---|---|
| User account and technical data; payment contact | Operator (controller) |
| Customer content (brands, questions, facts) and raw AI answers, where they contain personal data | Processor on the customer's instruction (customer is the operator) |
3. Data subjects, data, purposes and legal bases
We do not intentionally collect special-category, biometric or minors' data. The Service is for persons 18+.
| # | Data subjects | Data | Purpose | Legal basis |
|---|---|---|---|---|
| 1 | Users (customers' employees), including owners | email, workspace role, interface language, password hash (argon2id), creation date; name only if voluntarily given (the current version does not ask for it) | Creating and maintaining the account, providing access, service communication | Consent (Art. 6(1)(1)); for the existing contract with the customer, the operator's legitimate interest in ensuring performance {{LEGAL_BASIS_NOTE}} |
| 2 | Users | IP address, user agent, time and type of action (audit log: sign-in, role changes, invitations, projects, runs, deletion, billing events); failed-login counters | Security, abuse prevention, incident investigation, evidence of actions | Operator's legitimate interest (Art. 6(1)(7)); Art. 19 152-FZ duty |
| 3 | Invited persons | email, role, invitation token hash (7 days) | Sending the invitation and its acceptance | Information from the customer; legitimate interest; then consent under item 1 |
| 4 | Customer representatives and payers (entities, sole proprietors) | name, INN, KPP, OGRN, address, bank details, receipt email, payment records (payment ID, amount, date, status). Card data is entered with the payment provider; we neither receive nor store it | Accepting payment, invoicing and receipts, accounting and tax | Performance of the contract to which the customer is party; legal duties (Art. 6(1)(2), (5)) |
| 5 | Site visitors | cookies and browser data necessary for operation (see the Cookie Policy), IP and technical data in server logs | Site operation, security | Legitimate interest; no consent needed for necessary cookies |
| 6 | Persons contacting support | email, content of the request | Answering the request | Consent / legitimate interest |
| 7 | Recipients of marketing emails (optional) | email, date and channel of consent | News and offers | Separate marketing consent; Art. 18(1) Federal Law 38-FZ |
| 8 | Any persons whose data may appear in customer data (e.g. brand owner's name, names in AI answers) | whatever the customer entered or an AI model wrote | Performing the customer's instruction | Instruction of the customer-operator (Art. 6(3) 152-FZ) |
We prohibit customers from entering personal data into questions and facts (see the AUP). We do not deliberately harvest personal data from AI answers or web pages.
4. Actions and methods
Collection, recording, systematisation, accumulation, storage, clarification (update, change), retrieval, use, transfer (provision, access) to recipients on the subprocessor list, blocking, deletion, destruction. Processing is mixed: automated and non-automated. No dissemination (public posting). No decisions with legal effect on the data subject are made solely by automated processing.
5. Storage location and localisation
5.1. Databases containing personal data of Russian citizens (accounts, audit log, consent log, backups, logs) are located in the Russian Federation ({{HOSTING_PROVIDER}}, region ru-central1 — {{HOSTING_STATUS}}) per Art. 18(5) 152-FZ.
5.2. We do not use foreign logging, monitoring, support or analytics services that receive users' personal data. The only exception is question texts sent to AI providers (section 7).
6. Disclosure to third parties
6.1. Recipients (see the subprocessor list for locations): hosting; payment provider ({{PAYMENT_PROVIDER}}); email service ({{EMAIL_PROVIDER}}); third-party AI services receive only texts of questions and brand facts, not account data.
6.2. Disclosure to public authorities on lawful requests.
6.3. We do not sell personal data.
7. Cross-border transfer and third-party AI providers
7.1. Account data, the audit log, payment details and backups are stored in Russia and are not transferred abroad.
7.2. To measure brand visibility in AI answers, the Service sends only question texts (and, where needed, brand names and facts that the customer set for comparison) to AI providers. Personal data must not be entered in these texts; customers are prohibited from entering personal data in questions and facts (Terms, AUP). Account data is not sent to AI providers.
7.3. The "ChatGPT / OpenAI" measurement point is connected through a third-party LLM aggregator {{LLM_AGGREGATOR_NAME}} (OpenAI-compatible endpoint) located in {{LLM_AGGREGATOR_COUNTRY}}; requests may be further processed by OpenAI (USA) and other model providers. This is a cross-border transfer (question texts are presumed not to be personal data, but accidental inclusion cannot be excluded). Before such transfer, the operator: (a) notified Roskomnadzor of the intended cross-border transfer (Art. 12(3) 152-FZ as currently in force) — {{RKN_CROSS_BORDER_NOTICE_STATUS}}; (b) assessed the recipient's protection measures; recipient country {{LLM_AGGREGATOR_COUNTRY}}; whether it is on the Roskomnadzor list — {{RKN_LIST_STATUS}}.
7.4. Russian measurement points (Yandex AI Studio / GenSearch, Sber GigaChat) process texts in Russia.
7.5. For data subjects in the EU, UK and elsewhere, account data is processed in Russia; transfer grounds are in addenda A–E.
8. Retention periods
Proposed; subject to approval by the lawyer.
| Data | Period | Comment |
|---|---|---|
| Account | until account or workspace deletion; then deleted within 30 days | |
| Invitation tokens (hash) | 7 days | |
| Audit log (IP, actor email, actions) | 12 months; then IP anonymised (masked), email deleted; anonymised workspace-deletion record kept 3 years | {{AUDIT_RETENTION_STATUS}} |
| Consent log | while data is processed + 3 years after withdrawal or end of relationship | Proof of consent (Art. 9(3) 152-FZ), limitation period |
| Customer content, raw AI answers, measurements | subscription term + {{RETENTION_AFTER_END_DAYS}} days (default 90); deleted on request, project or workspace deletion | |
| Payment data, invoices, acts, receipts | period required by accounting and tax law (tentatively 5 years) | Not deleted on consent withdrawal |
| Application logs | 90 days | |
| Backups | 30 days; deleted data disappears on rotation | |
| Support correspondence | 3 years | |
geo_consent cookie (when analytics is added) | 6 months |
9. Data subject rights and request procedure
9.1. A data subject may: obtain confirmation of processing and information under Art. 14 152-FZ (purposes, methods, data list, recipients, periods); demand correction, blocking, destruction; withdraw consent; complain to Roskomnadzor or a court; get a copy of their data.
9.2. Send requests to privacy@kleogeo.ru or {{LEGAL_ADDRESS}}; for email requests we may ask to confirm identity (e.g. by writing from the registered address). Some actions are available in the dashboard (Settings → Privacy): withdrawing marketing consent, data export, deletion request [to implement before launch].
9.3. Deadlines (verify against the current statute): reply to a data request within 10 business days, extendable by up to 5 business days on a reasoned notice (Art. 14); on consent withdrawal, processing stops and data is destroyed within up to 30 days unless another basis exists (e.g. accounting) (Art. 21(5)); correction and destruction on request within Art. 21 periods.
9.4. We keep a request log.
9.5. Data in a customer's workspace: requests from a data subject whose data the customer entered are forwarded to the customer-operator and we assist under the DPA.
10. Security measures (Art. 19 152-FZ)
Measures in place at this version:
- TLS encryption of connections at the external perimeter, HSTS and a strict Content Security Policy in the web app;
- passwords stored only as argon2id hashes; session is a 24-hour token in an httpOnly cookie, all sessions revoked on password change and logout; sign-in attempt limits;
- role-based access control (owner, admin, member, viewer); least-privilege for services {{LEAST_PRIVILEGE_STATUS}};
- customer data isolation: the tenant ID is in every row and storage key, and queries are filtered by it server-side;
- audit log of significant actions (sign-in, roles, invitations, projects, runs, deletion, billing);
- deletion of project and workspace data on request (including S3, ClickHouse, OpenSearch);
- card data is handled by the payment provider; we do not store it;
- organisational measures: a responsible person, a limited group with access, an incident procedure (Roskomnadzor notice: initial within 24 hours, investigation results within 72 hours, Art. 21(3.1) 152-FZ), staff training {{ORG_MEASURES_STATUS}}.
We do not claim certification or attestation until such documents are obtained.
11. Cookies
We use only strictly necessary cookies and user preferences. See the Cookie Policy.
12. Changes
A new version is published on this page with a new date. For material changes we request fresh consent where required. A version archive is available on the site.
13. Contacts
{{COMPANY_NAME}}; privacy@kleogeo.ru (personal data); security@kleogeo.ru (security); support@kleogeo.ru (support).
Addenda: jurisdiction-specific provisions
These apply in addition to the main text to data subjects covered by the relevant law. If they conflict, for such subjects the more protective provision mandatory under their law prevails.
Addendum A. EU/EEA (GDPR)
A.1. Roles. For account data, security logs and payment contacts, {{COMPANY_NAME}} is a controller. For data a customer enters into its workspace, we are a processor and the customer is the controller; terms are in the DPA (EU annex).
A.2. Legal bases (Art. 6 GDPR) per purpose.
| Purpose | Basis |
|---|---|
| Account and access to the Service | contract (6(1)(b)); for customers' employees, legitimate interest (6(1)(f)) in performing the contract with the employer |
| Security, audit log, abuse prevention | legitimate interest (6(1)(f)) |
| Payments, accounting and tax | contract (6(1)(b)); legal obligation (6(1)(c)) |
| Service emails | contract / legitimate interest |
| Marketing emails | consent (6(1)(a)), withdrawable any time |
| Optional cookies/analytics (if introduced) | consent (6(1)(a)); ePrivacy |
| Defence of rights (consent log, claims) | legitimate interest (6(1)(f)) |
A.3. Rights: access (Art. 15), rectification (16), erasure (17), restriction (18), portability (20), objection (21, including to processing based on legitimate interest and to direct marketing), withdrawal of consent (7(3)), not to be subject to solely automated decisions (22) — we make no such decisions. Reply within one month (Art. 12(3)), extendable. Contact privacy@kleogeo.ru.
A.4. EU representative (Art. 27): {{EU_REPRESENTATIVE}} [appoint or justify an exemption; where Art. 3(2) GDPR applies, no representative is a compliance risk].
A.5. Data protection officer / contact: {{DPO_NAME}}, privacy@kleogeo.ru [decide whether a DPO is mandatory under Art. 37].
A.6. International transfers. The Service operates from Russia; EU data subjects' data is transferred to Russia, a country without a European Commission adequacy decision. Mechanism: {{EU_TRANSFER_MECHANISM}} (e.g. Standard Contractual Clauses (SCC) for controller-to-processor or controller-to-controller transfers, Art. 46(2)(c), with a transfer impact assessment; Art. 49 derogations only narrowly). [Applicability and lawfulness of transfers to Russia in the current sanctions context must be assessed by counsel.] Third-party AI providers receive only question texts without personal data (section 7).
A.7. Complaint: you may lodge a complaint with the supervisory authority of your residence, workplace or the alleged infringement.
A.8. Breach notification: the supervisory authority within 72 hours where required (Art. 33 GDPR); customer controllers per the DPA.
Addendum B. United Kingdom (UK GDPR, DPA 2018, PECR)
B.1. Addendum A applies with substitutions: the supervisory authority is the Information Commissioner's Office (ICO); transfer mechanism {{UK_TRANSFER_MECHANISM}} (IDTA or the UK Addendum to the SCC).
B.2. UK representative: {{UK_REPRESENTATIVE}}.
B.3. Rights and deadlines as in Addendum A (one month).
Addendum C. United States (CCPA/CPRA and state laws)
C.1. We do not sell or "share" personal information within the meaning of CCPA/CPRA, do not use it for cross-context behavioural advertising, and do not use information we consider "sensitive" except to provide the Service.
C.2. Categories collected in the last 12 months: identifiers (email, IP, account ID); business information (organisation name, role); commercial information (payments, plan); internet activity (audit log, user agent); professional information (role). Sources: the data subject and their employer (customer). Purposes: section 3. Disclosed to service providers (hosting, payment provider, email service) for the Service's purposes.
C.3. Rights of California and other state residents: know, access, correct, delete, limit use of sensitive information, non-discrimination, opt out of sale/"sharing" (not applicable — we do not sell). Contact privacy@kleogeo.ru; identity verification; response within 45 days (extendable) {{US_DEADLINE_NOTE}}.
C.4. Applicability. The law applies when thresholds are met (per the audit at the date of this version: annual revenue above ≈ $26.6 million, or ≥ 100,000 consumers/households, or ≥ 50% of revenue from selling/"sharing"); we do not meet them at this version, and this notice is published voluntarily. Thresholds are indexed — re-check. Employee and B2B contact data are within CCPA.
Addendum D. Kazakhstan
D.1. The Law of the Republic of Kazakhstan "On Personal Data and Their Protection" may require databases with Kazakh citizens' personal data to be stored in Kazakhstan and other measures (registration, consent). Decision for customers from Kazakhstan: {{KZ_LOCALIZATION_DECISION}} [options: do not onboard KZ customers; store KZ subjects' data in KZ; limit to the customer-employer's data]. Localisation requirements were not confirmed from sources during drafting.
Addendum E. Other jurisdictions
E.1. If your country's law gives you additional rights (access, correction, deletion, objection, portability, withdrawal of consent), we respect them to the extent they apply to us. Write to privacy@kleogeo.ru; we will respond within a reasonable time and no later than the period your law sets, where applicable.
E.2. At this version, specific provisions are prepared for the EU/EEA, UK, US and Kazakhstan. Applicability of the laws of Turkey (KVKK), Brazil (LGPD), Japan (APPI), China (PIPL), UAE, Saudi Arabia and others: {{OTHER_JURISDICTIONS_STATUS}} [not assessed].
Notes for the lawyer (remove before publication)
See the Russian version. Key points: official statute texts could not be loaded during drafting; the 24/72-hour and 30-day deadlines are confirmed only by secondary sources; the 10+5 business-day deadline is unconfirmed; status fields must be reconciled with the security audit; section 7 now reflects the owner's decision of 13.10.2026 (global markets; ChatGPT point via an LLM aggregator): the Roskomnadzor cross-border notification and recipient assessment are required before enabling it; risk that aggregator/OpenAI terms prohibit use from unsupported regions. Addenda A–E are templates for local counsel; GDPR/UK GDPR/CCPA provisions are cited from general knowledge and were not checked against primary sources in this session.