Privacy policy

The operator is Vyacheslav Svyatoslavovich Chukhaldin, self-employed (professional income tax regime), Kaliningrad, Russia.

For any questions about data processing: slavich33@icloud.com, Telegram @flowerslava, or the form on the contact page.

Through the form on the contact page: your name as you entered it, a contact for my reply (Telegram or email) and the text of your message. Some technical details go with them: the request type you chose, the service you were interested in (if you came from a service page), the consent checkbox and the page language.

The sender's IP address is saved with the request, only to tell real requests from spam and to group repeated ones. It is not passed on anywhere and is deleted together with the record.

If you message @chukhaldin_site_bot on Telegram, a copy of the message reaches the site's server: the name from your profile, your username and the text. The bot forwards the message to me and saves it in the same log as requests from the form.

Like any web server, the site's server keeps a technical request log: IP address, time, the page opened, the page you came from and details about your browser. I use it to investigate outages and attacks.

The site has one visitor counter, Yandex.Metrica. It shows where visitors come from and which pages they read. The counter only switches on if you allow it in the cookie banner (section 09). Metrica's servers are in Russia, and the data stays in the country.

Session Replay is switched off in Metrica on purpose, both in the site code and in the counter settings. Session Replay records mouse movements and what people type into fields, so with it on, your name, contact and message would reach a third party. With it switched off, no outside service watches what you type into the form. If the set of counters changes, I will update this section and the date at the top of the page.

While you fill in the form, what you type stays in your browser and is not sent anywhere. If sending fails, your name, contact and message are kept for a short time in the tab's memory, only so they can be put back into the fields and you don't have to type them again. This draft never reaches the server. It is erased the next time the contact page opens, and in any case it disappears when you close the tab.

An assistant works in the bottom-right corner of the site. Everything you type into its window goes to the site's server and then to GigaChat, Sber's language model, whose servers are in Russia. GigaChat's terms allow the text it receives to be used to improve the model. So please don't write anything in the chat that you wouldn't put in an open letter: bank details, passwords, other people's data.

A conversation ID is kept in your browser's local storage so the assistant remembers what was said earlier. On the server, the conversation stays in memory for up to six hours. Conversation logs are saved to a file on the server so I can check the quality of the answers. Contacts are removed first: phone numbers, email addresses and Telegram usernames are replaced with a placeholder before anything is written.

If you leave your name and contact in the chat, they go into the same request log as the form, together with the text of the conversation and your IP address, and are sent to my Telegram the same way. You can send them only after ticking the consent box, which is never ticked in advance.

I use requests and correspondence for one thing only: to answer your request and discuss possible work together. They are never used for marketing emails or sold to anyone.

The server's technical log helps me investigate outages and attacks, the conversation logs help me check the assistant's answers, and Yandex.Metrica shows where visitors come from.

I process requests from the form and the chat with your consent (Art. 6(1)(1)). Its text is a separate document, Consent to personal data processing (Art. 9(1)). You give it with a checkbox under the form or in the assistant's window. The checkbox is never ticked in advance, and the request can't be sent without it.

Yandex.Metrica also runs only with your consent (Art. 6(1)(1)). You give it separately, with the Allow button in the cookie banner at the bottom of the page. If you decline, the site, the form and the assistant work as usual. Section 09 explains how to withdraw this consent.

If you write to me directly on Telegram or by email, the legal basis is different: you started the conversation about a possible contract (Art. 6(1)(5)).

The site is hosted on a server in Russia. Requests from the form and the chat are first written to the request log on this server and only then sent to my Telegram, so a messenger outage can't lose them. The record contains the details from the request listed in sections 02 and 03, and the sender's IP address. The copy sent to Telegram has no IP address.

Apart from the site's server, the data reaches these services:

• Telegram receives copies of requests and delivers messages to the bot. It is based abroad, and its servers are outside Russia.
• iCloud Mail (an Apple service) receives the emails you send to slavich33@icloud.com.
• GigaChat (Sber) receives the text of your conversation with the assistant to prepare an answer. Its servers are in Russia.
• Yandex.Metrica receives visit data if you have allowed the counter: your IP address, browser and device details, which pages were opened, where visitors came from and what they clicked. It gets nothing from the form or the chat.
• Cloudflare serves the domain records (DNS), which tell your browser the address of the site's server. Pages, forms and chats with the assistant do not pass through Cloudflare.

Nobody else receives the data.

It depends on the kind of data:

• Requests and correspondence are kept while they are needed to handle your request, and for no more than three years. If the conversation has ended and no work has started, I delete the data within 30 days (Art. 21(4)).
• The IP address in a request is kept as long as the request itself.
• Assistant conversation logs, with contacts removed, are kept for no more than three years.
• The server's technical log is kept for about two weeks and then erased automatically.
• The conversation in the assistant's memory lasts up to six hours.
• The form draft lasts until you close the tab.

When I delete data, I erase the record in the server log and the messages in Telegram and email.

The site opens only over a secure HTTPS connection, so everything you send travels encrypted.

The server is behind a firewall. It can only be accessed with a key, and password login is switched off. I am the only person with access to the server.

Contacts are removed from assistant conversations before they are written to the file (section 03). Session Replay in Metrica is switched off (section 02).

If data ever leaks, I will report it to Roskomnadzor, the Russian data protection authority, within 24 hours, as the law requires (Art. 21(3.1)).

You can find out what data I hold about you and what I do with it, ask me to correct or delete it, withdraw your consent, or demand that I stop processing it. Email slavich33@icloud.com, message me on Telegram, or use the form on the contact page. I'll reply the same way you wrote, unless you ask otherwise. It's free.

The law sets maximum response times. I usually reply sooner.

• Telling you what data I hold about you and how I process it: up to 10 working days (Art. 14(3), Art. 20(1)).
• Correcting inaccurate data: up to 7 working days from the day you send the correct details (Art. 20(3), Art. 21(2)). While this is being checked, I don't use that data (Art. 21(1)).
• Deleting data that was obtained unlawfully or isn't needed for the stated purpose: up to 7 working days (Art. 20(3)).
• Stopping processing at your request: up to 10 working days (Art. 21(5.1)).
• Stopping processing and deleting the data after you withdraw consent: up to 30 days (Art. 21(5)).
• Stopping processing that breaks the law: up to 3 working days after the breach is found. If the breach can't be fixed, deleting the data within 10 working days and letting you know (Art. 21(3)).

The law allows two of these deadlines, for telling you about your data and for stopping processing at your request, to be extended by up to 5 more working days (Art. 14(3), Art. 21(5.1)). If that happens, I'll write to you and explain why.

If data can't be deleted in time for technical reasons, I will stop using it and delete it within six months at most (Art. 21(6)).

If we already work under a contract, I will keep the data needed to perform it even after you withdraw consent or ask me to stop processing, as the law allows (Art. 9(2), Art. 21(5.1)).

By law, a formal written request must include the number of your identity document, when and by whom it was issued, and details of how we have been in touch (for example, the date of your request). The request must be signed, and an electronic one with an electronic signature (Art. 14(3)).

If you believe I am violating your rights, you can complain to Roskomnadzor or go to court (Art. 17).