Personal Data Processing Policy

This Policy defines how personal data of individuals using the https://norma-assistant.ru website and the «NormaCore AI» service is processed and protected.

The Policy is published pursuant to clause 2 of part 2 of Article 18.1 of Federal Law No. 152-FZ of 27 July 2006 «On Personal Data».

This English text is an informational translation. In case of any discrepancy the Russian version prevails.

1. General provisions

The personal data operator is Оганесян Артём Арменович, e-mail: artemaideveloper@gmail.com (the «Operator»).

The Operator processes personal data lawfully and fairly, limited to specific, pre-defined and legitimate purposes.

Use of the Website constitutes acceptance of this Policy.

2. Key definitions

Personal data — any information relating to a directly or indirectly identified or identifiable individual (the data subject).

Processing — any operation performed on personal data, including collection, recording, storage, use, transfer, blocking, deletion and destruction.

Other terms have the meaning set out in Article 3 of Federal Law No. 152-FZ.

3. Data subjects and data categories

The Operator processes personal data of: unregistered website visitors; registered users; individuals who submit a request via website forms.

Registration and account data: name, e-mail address, password hash (plaintext passwords are never stored), Google account details when Google sign-in is used.

Contact form data: name, contact details provided by the user and the message text.

Data collected automatically: IP address, date and time of the request, browser and device information (User-Agent), requested pages, session identifier and cookies.

Payment card details are neither collected nor stored by the Operator; they are processed by the payment provider acting as an independent operator.

The Operator does not process special categories of personal data or biometric data, and does not process data of minors. The Service is intended for persons aged 18+.

4. Purposes of processing

Personal data is processed solely for: user registration and authentication; provision of the Service including request history; handling of contact requests; subscription management and payment records; account recovery; security and fraud prevention; anonymised traffic analytics; and compliance with statutory obligations.

The Operator does not take decisions producing legal effects concerning the data subject based solely on automated processing.

5. Legal grounds

Legal grounds: consent of the data subject (Art. 6(1)(1) of Law No. 152-FZ); performance of a contract to which the data subject is a party (Art. 6(1)(5)); compliance with statutory obligations (Art. 6(1)(2)); and Federal Law No. 149-FZ.

Consent is given by ticking the corresponding checkbox before the data is submitted. The fact, date, time and document version are recorded in an electronic log.

6. Processing procedure

Processing is carried out both by automated and non-automated means.

Databases containing personal data of citizens of the Russian Federation are located within the territory of the Russian Federation (Art. 18(5) of Law No. 152-FZ).

The Operator does not carry out cross-border transfers of personal data.

7. Disclosure to third parties

The Operator does not sell personal data. Data may be disclosed to processors acting on the Operator's instructions (hosting, e-mail delivery, payment provider) under contracts imposing confidentiality obligations; to competent state authorities where required by law; and with the separate consent of the data subject.

Question texts submitted to the Service are processed by an AI technology provider. Users should not include third-party personal data or confidential information in their questions.

8. Retention periods

Personal data is processed until the purposes are achieved or consent is withdrawn.

Account data — for the lifetime of the account plus one year; contact requests — one year; access and technical logs — one year; consent records — three years after withdrawal or account deletion; payment records — as required by accounting law.

Upon achievement of the purposes or withdrawal of consent, personal data is destroyed within thirty days (Art. 21(4)-(5) of Law No. 152-FZ). Unlawful processing is ceased within three business days (Art. 21(3)).

9. Security measures

The Operator applies legal, organisational and technical measures under Art. 19 of Law No. 152-FZ and Government Decree No. 1119 of 1 November 2012: HTTPS transport, password hashing, access control, audit logging, rate limiting, database backups and the appointment of a person responsible for personal data processing.

10. Rights of the data subject

Under Articles 14-17 of Law No. 152-FZ the data subject has the right to obtain information about the processing, to demand rectification, blocking or destruction of data, to withdraw consent, to object to processing for marketing purposes, and to lodge a complaint with Roskomnadzor or in court.

Requests should be sent to artemaideveloper@gmail.com. The Operator responds within ten business days, extendable by up to five business days (Art. 20(1) of Law No. 152-FZ).

11. Cookies and analytics

The Website uses strictly necessary cookies (session, authentication, free-quota accounting) and Yandex.Metrica analytics cookies for anonymised traffic statistics.

Cookies can be blocked or deleted in the browser settings; disabling strictly necessary cookies makes authentication and some features unavailable.

12. Amendments

The Operator may amend this Policy. The current version is always available at https://norma-assistant.ru/legal/privacy-policy and carries a version number and effective date.

For any questions regarding personal data processing please contact artemaideveloper@gmail.com.

SHA-256: c1ac9063121e3150e500590ab317ea7ead3cf5a30e40d65ba83104ebe09b7561