Personal Data Processing Policy

This is an informational translation. The legally binding version of the Policy is the Russian version at /legal/privacy. In case of any discrepancy, the Russian text prevails.

Operator: Бабиков Игорь Сергеевич (самозанятый, плательщик налога на профессиональный доход), INN 110211997168, contact: support@talkena.ru.

This Policy is published under Art. 18.1(2) of Federal Law No. 152-FZ and covers all personal data processed by the Service, including guest mode.

Account data (email, argon2id password hash, name, Yandex ID identifier, settings); training content (answers, speech transcripts, scores, reports, progress, error memory); optional career context (CV, job, project, goal — do not include third parties’ data); payment records (amount, status, payment ID — card details are handled by the Robokassa payment service only); technical data (IP and user-agent stored as hashes in consent/audit logs; cookies — see below); waitlist data (one selected contact — email or public Telegram username without a phone number — left before registration to receive a private beta invitation, with a consent record).

Voice audio is processed transiently for speech-to-text only and deleted immediately after recognition; raw audio is NOT stored by default and storage requires a separate opt-in consent. Voice is never used for identification; no biometric processing takes place.

Purposes: providing and personalising the service (contract + separate consent), payments and fiscal receipts (contract + law), security and abuse prevention (contract + law), transactional emails (contract), marketing emails (separate opt-in consent only).

Processors/recipients: database hosting in Russia (Selectel, Российская Федерация); the Robokassa payment service (OOO «ROBOKASSA») for payments; the AI processing provider OOO «Inter» (RouterAI, routerai.ru, Russian Federation), which receives only de-identified answer text (emails, names, phone numbers, links and account identifiers are removed automatically) and acts as an aggregator routing requests to third-party language models, including foreign ones; the Yandex.Metrica web-analytics service (OOO «Yandex»), which processes traffic and behavioural statistics on servers located in Russia (no cross-border transfer), only on the public pages (home and pricing), only after the visitor accepts optional cookies, and never inside the authenticated service; an SMTP provider for transactional email.

Databases with personal data of Russian citizens are located in Russia (Art. 18(5) of 152-FZ). Account data, payment records, training content and logs never leave Russia. AI features run through the RouterAI aggregator, which routes requests to third-party language models, including ones located outside Russia: for that part the Operator transfers only minimised de-identified text without direct identifiers, notifies Roskomnadzor before any such transfer (Art. 12 of 152-FZ), and relies on the necessity to perform the contract (Art. 12(10)(3)); users are informed in the consent list in the app.

Technically necessary cookies and local storage entries: aiec_access / aiec_refresh (httpOnly authentication), aiec_oauth (short-lived OAuth protection), interface locale, and UI preferences (theme, tutor, cookie-choice flag) — processed to perform the contract. Optional analytics cookies: on the public pages only (home and pricing) the Yandex.Metrica service (OOO «Yandex») sets its own cookies and collects de-identified technical and behavioural data (anonymous visitor ID, IP, browser and device, OS, referrer and campaign tags, viewed pages, on-page actions, and session recording via Webvisor; input field contents such as email are masked and not collected). Analytics cookies are set ONLY after explicit consent via the cookie banner and are never loaded before consent or after refusal; the choice can be changed at any time via the cookie-management link on public pages. Legal basis — consent of the data subject (Art. 6(1)(1) of 152-FZ). No advertising trackers are used.

Retention: account data and training content — until account deletion or consent withdrawal; voice audio — deleted immediately after recognition; consent/audit logs — 3 years after account deletion or withdrawal; payment records — 5 years (tax law); security logs — up to 90 days; the selected waitlist contact (email or Telegram username) — until launch and invitation or consent withdrawal, at most 12 months. Data is destroyed within 30 days after the purpose is achieved or consent is withdrawn (Art. 21 of 152-FZ).

Your rights (Art. 14 of 152-FZ): access and export (Settings → Export), rectification, blocking, deletion, consent withdrawal (Settings → Consents), account deletion, unsubscribing from marketing at any time, and complaints to Roskomnadzor or court. Requests to support@talkena.ru are answered within 10 business days (extendable by 5).

Security: TLS, argon2id password hashing, httpOnly session cookies, strict per-user access control, PII minimisation before AI processing, rate limiting, audit logs. Incident notifications to Roskomnadzor within 24/72 hours (Art. 21(3.1)).

Revision 1.4, effective 2026-07-26.