Privacy Policy

1. Data We Collect

We collect the following categories of personal data:

• Account information: email address, company name, password hash
• Contact information: phone number (when using request_contact scenarios)
• Communication data: message content processed through the Platform's messaging APIs (Telegram, MAX, etc.)
• Scenario data: bot scenario configurations, event flows, automated response scripts created by you
• Technical data: IP address, browser User-Agent, request timestamps, API access logs

2. Purposes of Processing

We process personal data for the following purposes:

• Providing access to and operation of the Platform (authentication, account management)
• Delivering messaging services through integrated communication channels
• Billing and payment processing (invoicing, transaction records)
• Technical support and troubleshooting
• Improving the Platform's functionality and user experience
• Compliance with legal obligations under the laws of the Russian Federation

3. Legal Basis

We process your personal data on the following legal grounds:

• Your explicit consent to the processing of personal data (Art. 6, 152-FZ)
• Performance of a contract to which you are a party (Terms of Service)
• Compliance with legal obligations imposed on the operator by the legislation of the Russian Federation

4. Data Storage and Retention

Personal data is stored on servers located within the territory of the Russian Federation. We retain your data for the following periods:

• Account data: for the duration of your account's existence plus 3 years after account deletion for legal compliance
• Message content: for the duration specified in your tariff plan (default: 30 days), then automatically deleted
• API access logs: retained for 12 months for security and debugging purposes
• Billing records: retained for 5 years in accordance with accounting and tax legislation

5. Your Rights

As a data subject under 152-FZ, you have the following rights:

• Right to access your personal data and obtain information about its processing
• Right to rectification of inaccurate or incomplete personal data
• Right to erasure of your personal data ("right to be forgotten") upon termination of services
• Right to withdraw consent to data processing at any time
• Right to lodge a complaint with Roskomnadzor if you believe your rights have been violated

6. Data Sharing and Third Parties

We may transfer your personal data to the following third parties:

• Payment service providers (YooKassa) — for processing payments and invoicing
• Communication platform APIs (Telegram, MAX) — for delivering messages you send through our Platform
• Hosting and infrastructure providers — for server hosting within the Russian Federation
• We do not sell, rent or trade your personal data to third parties for marketing purposes

7. Data Protection Measures

We implement the following technical and organizational measures to protect your personal data:

• Encryption of data in transit (TLS 1.3) and at rest (AES-256)
• HMAC-SHA256 signature verification for all API requests and webhooks
• Role-based access control (RBAC) with principle of least privilege
• Regular security audits and vulnerability scanning
• Database isolation per service (Database per Service pattern)

8. Cookies and Local Storage

Our Platform uses essential cookies and browser local storage (localStorage) to provide core functionality:

• Authentication token (localStorage: massaccess-token) — to keep you signed in
• Language preference (cookie: massaccess-language) — to remember your chosen interface language
• Theme preference (cookie: massaccess-theme) — to remember your light/dark theme choice
• We do not use tracking cookies, analytics cookies, or third-party advertising cookies. All stored data is strictly necessary for the Platform's operation and is not shared with third parties.

9. Cross-Border Data Transfers

While your personal data is primarily stored on servers within the Russian Federation, some processing may involve data transfers to servers located outside of Russia:

• Telegram Bot API — messages and user interactions are transmitted through Telegram's infrastructure, which may involve servers outside the Russian Federation
• YooKassa payment system — payment data is processed through YooKassa's infrastructure to complete financial transactions
• For cross-border transfers, we rely on your explicit consent provided at registration (Art. 12, 152-FZ). We take measures to ensure an adequate level of data protection during such transfers.

10. Policy Updates

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we do:

• We will post the updated version on this page and update the "Last Updated" date at the top
• For material changes, we will notify you by email (to the address associated with your account) at least 7 days before the changes take effect
• Your continued use of the Platform after the effective date of any update constitutes acceptance of the revised Privacy Policy

11. Age Restrictions

Our Platform is intended for use by individuals aged 18 years and older. We do not knowingly collect, use, or disclose personal data from children under the age of 18. If we become aware that we have inadvertently collected personal data from a child under 18, we will promptly delete such information from our records. If you believe that a child under 18 has provided us with personal data, please contact us immediately.

12. Data Protection Officer

In accordance with the requirements of the Federal Law No. 152-FZ, we have appointed a person responsible for organizing the processing of personal data (Data Protection Officer). You may contact the Data Protection Officer regarding any questions about this Privacy Policy or the processing of your personal data via the contacts below.

13. Contact Information

If you have any questions about this Privacy Policy or wish to exercise your data subject rights, please contact us:

• info@massaccess.net
• Data Operator: Web 4 Mobile LLC INN 9715420105
• Registered under the laws of the Russian Federation