Privacy Policy

1. Legal Basis for Processing

Processing is carried out under Federal Law No. 152-FZ, the data subject's consent (see the separate "Consent to Personal Data Processing" document), and the service agreement entered into upon registration.

2. Processing Purposes

• Account registration and identification, providing access to the Service.
• Performing the service agreement, processing payments, tracking plan usage limits.
• Sending your requests to AI providers to generate responses.
• Sending transactional notifications (registration confirmation, password reset, generation status, task reminders).
• Technical support and handling inquiries.
• Complying with Russian legal requirements.

3. Categories of Data Processed

• Registration data: name, email address, password (stored as a hash).
• Contact data (optional): Telegram identifier, if you connect the bot.
• Payment data: processed by our payment provider (YooKassa) — card details are never sent to or stored by the Service.
• Request content: chat messages, knowledge base notes, image/video/audio generation prompts, voice messages (when using speech recognition).
• Usage data: AI request type/provider, token counts, timestamps — for statistics and plan limits.
• Technical data: IP address, device/browser type, cookies — for Service operation and security.
• Third-party API keys: if you provide your own keys, they are stored encrypted.

4. Data Subjects

Personal data of registered Service users — individuals aged 18 or older — is processed.

5. Processing Methods

Processing is mixed: automated (the Service's server infrastructure) and, in some cases (support inquiries), non-automated.

6. Third-Party Recipients

• AI providers (OpenAI, Anthropic, Google, Mistral, Groq, xAI, and others, depending on the selected model) — receive request content to generate a response. Most are located outside Russia — see "Cross-Border Data Transfer Consent".
• YooKassa — payment processing.
• Telegram — when you voluntarily connect the bot, for message delivery.
• Hosting/infrastructure provider — technical hosting of the Service.
• Email (SMTP) provider — delivery of transactional emails.

We do not sell personal data or share it for any purpose other than those listed above.

7. Cross-Border Data Transfer

To generate AI responses, your request content may be transferred to operators located outside Russia (see section 6). Cross-border transfer only happens with your separate consent — see "Cross-Border Data Transfer Consent".

8. Retention Period

Data is retained until you delete your account or withdraw consent, whichever comes first, unless Russian law requires longer retention (e.g. payment records). Database backups are created daily and kept for 14 days. On account deletion, data is permanently removed, including from backups once their rotation period elapses.

9. Security Measures

Organizational and technical measures are applied: access control, encryption of stored secrets (passwords, API keys, payment tokens), secure connections (HTTPS/TLS), backups, and account security event logging.

10. Cookies

The Service only uses strictly necessary (session) cookies — for authentication and CSRF protection. No analytics, advertising, or other non-essential cookies are currently used; separate consent will be requested before any are introduced.

11. Your Rights

• Obtain information about, and access to, your data — via your dashboard or a request to info@orenagi.com.
• Request correction, blocking, or deletion of incomplete, outdated, or inaccurate data.
• Withdraw consent at any time — delete your account in Profile, or request it via the email above.
• Export your data — Knowledge Base export is available on the KB page.
• Appeal the Operator's actions or omissions to Roskomnadzor, the prosecutor's office, or a court.

12. Data Protection Contact

Personal data inquiries: info@orenagi.com

13. Changes to This Policy

The Operator may amend this Policy. The current version is always available at this address; the last-updated date is shown at the top. Material changes will be announced separately.