Personal data processing policy

1. General provisions

1.1. This Personal Data Processing Policy (the "Policy") sets out how personal data is processed and which security measures are taken by OOO Topfriend (OGRN 1147746617094, INN 7701397460, the "Operator").

1.2. The Policy is drawn up in accordance with Federal Law No. 152-FZ of 27 July 2006 "On Personal Data" ("152-FZ").

1.3. This Policy applies to all personal data the Operator may receive from the User when using the website https://oki.atfmedia.com/ and the services connected to it.

1.4. Use of the service at https://oki.atfmedia.com/ means the User's unconditional consent to this Policy and to the personal data processing terms stated in it.

2. Main terms

Personal data means any information relating to a directly or indirectly identified or identifiable individual (the personal data subject).

Operator means a state body, a municipal body, a legal entity or an individual that organises and/or carries out the processing of personal data.

Processing of personal data means any action with personal data (collection, recording, systematisation, accumulation, storage, clarification, extraction, use, transfer, depersonalisation, blocking, deletion, destruction).

Confidentiality of personal data means the Operator's duty not to disclose personal data to third parties and not to distribute it without the subject's consent.

3. Personal data we collect

3.1. Data provided at registration:

Email address

Full name (optional)

Password (stored in encrypted form)

3.2. Data about use of the service:

Prompts (text requests to AI models)

Generated content (texts, images, video, audio)

History of requests and of the use of different models

Balance and transaction history

Settings and preferences in the account

3.3. Payment information:

Payment details (amount, date, status)

Last 4 digits of the bank card

Subscription and purchase history

Important: full bank card data (number, CVV, expiry date) is processed only by the payment system and is not passed to the Operator.

3.4. Technical data:

IP address

Browser type and operating system

Information about pages visited

Date and time of access to the service

Cookies and similar technologies

4. Purposes of processing

4.1. The Operator processes personal data for the following purposes:

Providing access to the features of the service at https://oki.atfmedia.com/

Identifying the User and signing the User in to the account

Processing requests to AI models and generating content

Processing payments and keeping records of financial operations

Sending notices (about changes to the service, offers, and updates)

Technical support and replies to enquiries

Analysing and improving the quality of the service

Preventing fraud and keeping the service secure

Complying with the laws of the Russian Federation

4.2. The Operator does not use personal data for purposes that are not stated in this Policy without the User's additional consent.

5. Legal grounds for processing

5.1. The legal grounds for processing personal data are:

Consent of the personal data subject (Article 9 of 152-FZ)

Performance of the public-offer contract for the services (Article 6 of 152-FZ)

Exercise of the Operator's rights and legitimate interests (Article 6 of 152-FZ)

Performance of duties required by the laws of the Russian Federation

5.2. Consent to personal data processing is given by ticking the box at registration or at payment.

6. How long personal data is kept

6.1. Personal data is processed and stored for:

Account: until the User deletes the account

Request history and content: while the account is active

Financial data: 5 (five) years from the last transaction (as required by tax law)

Technical logs: 1 (one) year

6.2. After the account is deleted, personal data is destroyed within 30 (thirty) calendar days, except for data that must be kept under the laws of the Russian Federation.

7. Transfer of personal data to third parties

7.1. The Operator transfers personal data to the following third parties:

7.1.1. YooKassa (Sberbank PJSC)

Purpose: payment processing

Data: email, payment amount, purchase information

Legal ground: performance of the contract

7.1.2. AI providers (OpenRouter, KIE.AI)

Purpose: processing requests to AI models and generating content

Data: prompts, technical parameters of requests

Legal ground: performance of the contract, legitimate interest

7.1.3. State authorities

The Operator may provide personal data on an official request from law-enforcement or judicial authorities in accordance with the laws of the Russian Federation.

7.2. In all other cases personal data is not transferred to third parties without the User's express consent.

8. Rights of the personal data subject

8.1. Under Article 14 of 152-FZ the User has the right to:

Receive information about whether the Operator holds the User's personal data

Require clarification or correction of inaccurate data

Require deletion of personal data

Receive a copy of the User's personal data in a structured format

Withdraw consent to personal data processing

Challenge the Operator's actions before Roskomnadzor or in court

8.2. Deletion and editing of personal data by the User

Viewing and editing data: in the account

Account deletion: a request to cfo@atfmedia.com (a reply within 10 business days)

Data export: a request to cfo@atfmedia.com (a reply within 10 business days)

Withdrawal of consent: a request to cfo@atfmedia.com (a reply within 10 business days)

9. Measures to protect personal data

9.1. The Operator applies the following security measures:

Encryption: all data is sent over HTTPS (SSL/TLS)

Password hashing: passwords are stored in encrypted form (bcrypt)

Access control: access to the database is limited to a restricted group of people

Backups: regular automatic backups

Security monitoring: tracking of suspicious activity

Two-factor authentication: available to increase account security

9.2. Despite these measures, the Operator cannot guarantee 100% protection against unauthorised access by third parties.

10. Cookies and analytics

10.1. The website https://oki.atfmedia.com/ uses cookies to:

Keep the signed-in session

Remember interface settings

Analyse visits and how users behave on the site

10.2. The User can turn cookies off in the browser settings, but that may limit what the service can do.

10.3. The service may use web analytics tools (for example, Yandex Metrica) to collect depersonalised visit statistics.

11. Changes to the privacy policy

11.1. The Operator may change this Policy unilaterally.

11.2. A new version of the Policy takes effect when it is published on https://oki.atfmedia.com/, unless the new version says otherwise.

11.3. The current version of the Policy is always available at https://oki.atfmedia.com/

12. Contact information

12.1. For any question about personal data processing, write to:

Email: cfo@atfmedia.com

Subject: "Personal data"

12.2. The Operator will review the request within 30 (thirty) calendar days of receiving it, in accordance with Article 14 of 152-FZ.

Details of the personal data operator

OOO TOPFRIEND

Registered address: 129329 Moscow, Putevoy proezd 50, apt. 10

Tel. +7 (495) 648 41 82

OGRN: 1147746617094

INN 7701397460

KPP 771501001

Account 40702810502840001474

Correspondent account 30101810200000000593

Bank: Alfa-Bank JSC

BIC 044525593

Email cfo@atfmedia.com