Personal data processing policy

1. General provisions

1.1 This Personal Data Processing Policy (the "Policy") defines the procedure and conditions for processing personal data by Самозанятый Кулаков Кирилл Дмитриевич (TIN 710406098539) in respect of users of the website and Service at https://diarynchy.com and *.diarynchy.com subdomains (including the web application app.diarynchy.com).

1.2 Terms are used in the meaning established by the legislation of the Russian Federation on personal data.

1.3 The Operator processes personal data on the principles of lawfulness, fairness, minimization, and limiting processing to achieving specific, predetermined, and lawful purposes.

1.4 The Operator ensures confidentiality of personal data (Art. 7 of the Personal Data Law) and takes necessary measures to fulfill obligations established by Part 2 of Article 18.1 and Part 1 of Article 19 of that law (organizational and technical protection measures).

1.5 Contacts for personal data subject inquiries: e-mail: k.kulakov@diarynchy.com; phone: +7 (910) 701-86-99. The Policy is effective from 2026-07-01 and is freely available on the website https://diarynchy.com.

1.6 A user-facing description of diary entry processing, AI features, and restrictions on information you may enter is provided in the Privacy Policy posted on the Operator's website.

2. Basic concepts used in the Policy

2.1 Automated processing of personal data — processing of personal data using computer technology.

2.2 Blocking of personal data — temporary cessation of personal data processing (except where processing is necessary to clarify personal data).

2.3 Website and Service — graphic and informational materials, computer programs, and databases ensuring availability of the Operator's resources on the Internet at https://diarynchy.com and *.diarynchy.com subdomains (including the web application app.diarynchy.com).

2.4 Personal data information system — a set of personal data contained in databases and information technologies and technical means ensuring their processing.

2.5 Depersonalization of personal data — actions as a result of which it is impossible to determine, without additional information, which User or other personal data subject the personal data relates to.

2.6 Processing of personal data — any action (operation) or set of actions (operations) performed with or without automation tools on personal data, including collection, recording, systematization, accumulation, storage, clarification (update, change), extraction, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, and destruction of personal data.

2.7 Operator — a state body, municipal body, legal entity, or individual that independently or jointly with others organizes and/or carries out personal data processing and determines the purposes of processing, the composition of personal data to be processed, and actions (operations) performed with personal data.

2.8 Personal data — any information relating directly or indirectly to a defined or definable User of https://diarynchy.com and *.diarynchy.com subdomains (including the web application app.diarynchy.com).

2.9 User — any visitor to the website and/or user of the Service at https://diarynchy.com and *.diarynchy.com subdomains (including the web application app.diarynchy.com).

2.10 Provision of personal data — actions aimed at disclosure of personal data to a specific person or specific group of persons.

2.11 Cross-border transfer of personal data — transfer of personal data to the territory of a foreign state to an authority of a foreign state, a foreign individual, or a foreign legal entity. The Operator does not carry out cross-border transfer of personal data.

2.12 Destruction of personal data — any actions as a result of which personal data are irreversibly destroyed with no possibility of further restoration of personal data content in the personal data information system and/or material carriers of personal data are destroyed.

3. Basic rights and obligations of the Operator

3.1 3.1 The Operator has the right to:

• —receive from the personal data subject reliable information and/or documents containing personal data;
• —if the personal data subject withdraws consent to processing or sends a request to cease processing, continue processing without consent where grounds specified in the Personal Data Law exist;
• —independently determine the composition and list of measures necessary and sufficient to fulfill obligations under the Personal Data Law and regulatory legal acts adopted in accordance with it, unless otherwise provided by the Personal Data Law or other federal laws.

3.2 3.2 The Operator must:

• —provide the personal data subject, upon request, with information regarding processing of their personal data;
• —organize processing of personal data in the manner established by applicable legislation of the Russian Federation;
• —respond to inquiries and requests from personal data subjects and their legal representatives in accordance with the Personal Data Law;
• —report to the authorized body for protection of personal data subjects' rights, upon request of that body, the necessary information within 10 days of receiving such request;
• —publish or otherwise ensure unrestricted access to this Personal Data Processing Policy;
• —take legal, organizational, and technical measures to protect personal data from unlawful or accidental access, destruction, modification, blocking, copying, provision, distribution, and other unlawful actions;
• —cease transfer (distribution, provision, access) of personal data, cease processing, and destroy personal data in the manner and cases provided by the Personal Data Law;
• —fulfill other obligations provided by the Personal Data Law.

4. Basic rights and obligations of personal data subjects

4.1 4.1 Personal data subjects have the right to:

• —receive information regarding processing of their personal data, except in cases provided by federal laws. Information is provided by the Operator in an accessible form and must not contain personal data relating to other data subjects, except where there are lawful grounds for disclosure. The list of information and procedure for obtaining it are established by the Personal Data Law;
• —require the operator to clarify, block, or destroy their personal data if the data are incomplete, outdated, inaccurate, unlawfully obtained, or not necessary for the stated processing purpose, and take lawful measures to protect their rights;
• —set a condition of prior consent for processing personal data for promoting goods, works, and services on the market;
• —withdraw consent to processing of personal data and send a request to cease processing;
• —appeal to the authorized body for protection of personal data subjects' rights or to court against unlawful actions or inaction of the Operator in processing their personal data;
• —exercise other rights provided by the legislation of the Russian Federation.

4.2 4.2 Personal data subjects must:

• —provide the Operator with accurate data about themselves;
• —inform the Operator of clarification (update, change) of their personal data;
• —read the entry content restrictions specified in the Privacy Policy and Terms of Use and not place passport, payment, or other information listed in those documents in the Service.

4.3 Persons who provided the Operator with inaccurate information about themselves, or information about another personal data subject without the latter's consent, bear liability in accordance with the legislation of the Russian Federation.

5. Purposes of collecting and processing personal data

5.1 Registration and authentication of Service users.

5.2 Provision of the Diarynchy service: diary entries, storage, and artificial intelligence features for text analysis and emotional patterns.

5.3 Payment operations and billing (subscription management).

5.4 User support and handling of inquiries.

5.5 Ensuring operation and security of the website and application.

5.6 Website visit analytics (with consent to analytical cookies).

5.7 Beta testing information and project mailings (for leads from the landing page).

5.8 Performance of the contract (public offer) and compliance with the legislation of the Russian Federation (including tax accounting under NPD).

6. Legal bases for processing personal data

6.1 For the purpose "Registration and authentication of Service users", legal bases are: contract (public offer and Terms of Use); data subject consent to personal data processing.

6.2 For the purpose "Provision of the Diarynchy service", legal bases are: contract (public offer and Terms of Use); data subject consent to personal data processing; separate consent to processing special categories of personal data that the user may voluntarily include in diary entries; consent to automated processing using AI technologies — when the user enables AI features.

6.3 For the purpose "Payment operations and billing", legal bases are: contract; Federal Law 161-FZ "On the National Payment System" (through the payment aggregator); Federal Law 54-FZ; Tax Code of the Russian Federation (income accounting under NPD).

6.4 For the purpose "User support and handling of inquiries", legal bases are: contract; consent (if required).

6.5 For the purpose "Ensuring operation and security of the website and application", legal bases are: contract; Federal Law 149-FZ "On Information, Information Technologies and Information Protection"; consent (for technically necessary cookies).

6.6 For the purpose "Website visit analytics", legal bases are: data subject consent to analytical cookies.

6.7 For the purpose "Beta testing information and project mailings", legal bases are: data subject consent to personal data processing and to receive mailings; Federal Law 38-FZ "On Advertising" (where advertising materials are involved).

6.8 For the purpose "Performance of the contract and compliance with legislation", legal bases are: Civil Code of the Russian Federation; contract; Tax Code of the Russian Federation; other applicable regulations.

6.9 Legal bases may also include the Operator's local regulations and contracts concluded with data subjects and/or consents issued by them in cases provided by law.

Note: Federal Law No. 152-FZ "On Personal Data" establishes general requirements for personal data processing and is not itself a legal basis for processing.

7. Scope and categories of processed personal data; categories of subjects

7.1 For "Registration and authentication": name (if provided), e-mail address, account identifiers, password hashes, verification codes, IP addresses, cookies, and session tokens.

7.2 For "Provision of the Diarynchy service": diary entry content, including text and voice recordings when used, entry metadata, automated analysis results when AI features are enabled, profile settings. The User independently determines entry content. Information about experiences, emotional state, and personal circumstances is not a special category of personal data under Article 10 of Federal Law No. 152-FZ. In some cases, the User may independently include in an entry information relating to health, intimate life, religious views, or other special categories of personal data provided for by Article 10 of Federal Law No. 152-FZ. The Service does not require such information and is not specifically designed to collect it.

7.3 For "Payment operations and billing": name, contact details, payment identifiers, amounts and statuses, partially masked payment details, receipt data. Full bank card details are processed by the payment aggregator.

7.4 For "User support": name, contacts, inquiry content, ticket metadata.

7.5 For "Operation and security": IP addresses, date and time, technical identifiers, device and browser data, access and error logs.

7.6 For "Website visit analytics": aggregated or pseudonymized visit data, referral sources, on-site actions (with consent to analytical cookies).

7.7 For "Beta testing information": name and e-mail provided when subscribing on the landing page.

7.8 For "Contract performance and legal compliance": data necessary to perform the contract, maintain tax records, and respond to lawful requests from authorized bodies.

7.9 Personal data subjects include website visitors, Service users, subscription payers, persons who contact support, and beta mailing subscribers.

8. Procedure and conditions for processing personal data

8.1 Personal data processing is carried out on the basis of User consent, the contract (public offer and Terms of Use), and other grounds provided by the legislation of the Russian Federation.

8.2 Consent to personal data processing is expressed by checking a box when registering in the Service, subscribing, signing up for beta testing on the landing page, or other actions clearly aimed at providing personal data after reviewing this Policy.

8.3 Consent to automated personal data processing using artificial intelligence technologies is obtained via a separate optional checkbox at Service registration (not pre-checked by default). Without this consent, electronic diary mode without AI features is available. The consent text is published on the Personal Data Consent page and in the Service interface.

8.4 The User may withdraw consent to processing of personal data at any time by sending a request to k.kulakov@diarynchy.com. After withdrawal, the Operator ceases processing, except where processing is permitted without the subject's consent by law or other legal bases.

8.5 For the purpose "Registration and authentication of Service users", the following actions (operations) are performed with personal data: collection, recording, systematization, accumulation, storage, clarification (update, change), extraction, use, transfer (provision, access), depersonalization, blocking, deletion, and destruction.

8.6 For the purpose "Provision of the Diarynchy service", the following actions (operations) are performed with personal data: collection, recording, systematization, accumulation, storage, clarification (update, change), extraction, use, transfer (provision, access), depersonalization, blocking, deletion, and destruction.

8.7 For the purpose "Payment operations and billing", the following actions (operations) are performed with personal data: collection, recording, systematization, accumulation, storage, clarification (update, change), extraction, use, transfer (provision, access), depersonalization, blocking, deletion, and destruction.

8.8 For the purpose "User support and handling of inquiries", the following actions (operations) are performed with personal data: collection, recording, systematization, accumulation, storage, clarification (update, change), extraction, use, transfer (provision, access), depersonalization, blocking, deletion, and destruction.

8.9 For the purpose "Ensuring operation and security of the website and application", the following actions (operations) are performed with personal data: collection, recording, systematization, accumulation, storage, clarification (update, change), extraction, use, transfer (provision, access), depersonalization, blocking, deletion, and destruction.

8.10 For the purpose "Website visit analytics", the following actions (operations) are performed with personal data: collection, recording, systematization, accumulation, storage, clarification (update, change), extraction, use, transfer (provision, access), depersonalization, blocking, deletion, and destruction.

8.11 For the purpose "Beta testing information and project mailings", the following actions (operations) are performed with personal data: collection, recording, systematization, accumulation, storage, clarification (update, change), extraction, use, transfer (provision, access), depersonalization, blocking, deletion, and destruction.

8.12 For the purpose "Performance of the contract and compliance with the legislation of the Russian Federation", the following actions (operations) are performed with personal data: collection, recording, systematization, accumulation, storage, clarification (update, change), extraction, use, transfer (provision, access), depersonalization, blocking, deletion, and destruction.

8.13 Processing is carried out with or without automation tools.

8.14 Transfer of personal data to third parties (processors) is carried out under processing agreements or other contracts with compliance with Articles 6 and 19 of the Personal Data Law. Processors include: (1) Robokassa (Russian Federation) — payment acceptance; (2) Yandex.Cloud LLC (Russian Federation) — Yandex AI Studio (AI features); (3) Yandex LLC (Russian Federation) — Yandex Metrica (website analytics with cookie consent); (4) UniSender (Russian Federation) — beta lead mailings from the landing page. Personal data of users is not transferred to foreign organizations.

8.15 Primary collection, recording, systematization, accumulation, and storage of personal data of citizens of the Russian Federation are carried out on the Operator's own technical means located in the territory of the Russian Federation. Database and backup storage is not entrusted to third-party hosting providers (Part 5 of Article 18 of the Personal Data Law). Entrusting processing of individual features (AI via Yandex AI Studio (Yandex.Cloud LLC), payments via Robokassa) does not mean diary databases are hosted by those processors.

8.16 Use of artificial intelligence technologies. Automated analytical materials are generated using language models of Yandex.Cloud LLC (Yandex AI Studio) and/or models on the Operator's infrastructure. Processing is carried out in the Russian Federation only with separate subject consent to automated processing using AI. Personal data is not transferred outside the Russian Federation. The Operator applies data minimization. Analysis is performed automatically without making legally significant decisions. The Service does not use personal data to train its own AI models.

8.17 Retention periods are defined in the Data Retention Policy (https://diarynchy.com/data-retention-policy). In brief: account and diary entry data — until account deletion plus 30 calendar days for technical removal from backups.

8.18 Cookie files are used on the website. Details are in the Cookie Policy. Analytical cookies are activated only with User consent through the cookie banner.

8.19 The Operator may transfer personal data to authorized government bodies on grounds provided by the legislation of the Russian Federation.

8.20 Special categories of personal data. Processing of special categories of personal data that the User voluntarily includes in diary entries is carried out on the basis of separate data subject consent. Such consent is obtained before the User begins using free-form diary entry. If such consent is absent or withdrawn, the Operator limits active processing of entries containing special categories of personal data and does not transfer such information to intelligent analysis systems. Full consent text — at /personal-data-consent.

9. Measures to ensure protection of personal data

9.1 The Operator takes necessary legal, organizational, and technical measures to protect Users' personal data from unlawful or accidental access, destruction, modification, blocking, copying, provision, distribution, and other unlawful actions.

9.2 9.2 Such measures include, in particular:

• —appointment of a person responsible for organizing processing and ensuring security of personal data;
• —adoption of this Policy and other local acts on personal data processing;
• —limiting the circle of persons with access to personal data and establishing access procedures;
• —encryption of personal data at rest and transmission over secure channels (TLS);
• —use of antivirus tools, firewalls, and other technical information protection means;
• —automated Guardrail review of entries before saving and/or before processing in AI systems — for Service security, minimizing data volume, detecting clearly dangerous information, masking direct identifiers, and limiting data transfer to AI systems.
• —maintenance of access logs and periodic review of compliance with personal data legislation;
• —familiarization of persons authorized to process personal data with legislation and the Operator's local acts.

10. Updating, correction, deletion and destruction of personal data; responses to subject requests

10.1 Upon confirmation of inaccurate personal data or unlawful processing, the operator updates data and/or ceases processing.

10.2 Personal data are subject to destruction upon achievement of processing purposes, upon withdrawal of consent by the subject (if processing was based on consent), upon expiry of retention periods, or upon detection of unlawful processing, unless otherwise provided by law or contract.

10.3 The personal data subject may send a request for information on processing of their personal data and/or statements for clarification, blocking, or deletion. A request may be sent to k.kulakov@diarynchy.com.

10.4 The period for providing information in response to a subject request about personal data processing is no more than 30 (thirty) calendar days from receipt of the inquiry.

10.5 Upon withdrawal of consent or a subject request to cease processing, the Operator ceases processing within no more than 10 (ten) working days from receipt of the request, with a possible extension of no more than 5 (five) working days upon sending a reasoned notice to the subject. Blocking of personal data is performed immediately or within the cessation period. Technical deletion timelines from active databases and backups are in the Data Retention Policy.

10.6 Conditions for ceasing processing: achievement of processing purposes; withdrawal of consent; detection of unlawful processing; other grounds provided by law.

10.7 The Operator may temporarily restrict or terminate User access to the Service in case of violation of law, this Policy, the Terms of Use, threat to Service security, detection of fraudulent activity, or need to remedy technical failures.

11. Policy updates

11.1 This Policy is subject to review and update in case of changes in the legislation of the Russian Federation, applicable regulations, or by decision of the Operator.

11.2 The current version of the Policy is always available on the Operator's website https://diarynchy.com.

11.3 A new version takes effect upon publication on the website, unless otherwise stated in the version itself.