§ 01General provisions
1.1. This Personal Data Processing Policy (hereinafter referred to as the “Policy”) was developed in accordance with the requirements of Federal Law No. 152-FZ dated July 27, 2006 “On Personal Data” and determines the procedure for collecting, storing, using and protecting personal data of users of the Flowmark service.
1.2. The policy applies to all channels of interaction with the Service:
- Telegram bot “Flowmark” (hereinafter referred to as “Telegram bot”);
- Flowmark bot in the MAX messenger (hereinafter referred to as the “MAX bot”);
- Mini App of the Service, available through the above bots (hereinafter referred to as the “Mini App”);
- website flowmark-app.com (hereinafter referred to as the “Site”).
1.3. Starting to use the Service means the user agrees with this Policy. In case of disagreement with its terms, the user is obliged to stop using the Service.
1.4. The policy has been drawn up in accordance with the requirements of Federal Law No. 152-FZ of July 27, 2006 “On Personal Data” and other regulatory legal acts of the Russian Federation in force as of the date of revision.
§ 02Personal data operator
The operator of personal data is:
Next - “Operator”.
§ 03Basic concepts
Personal data - any information relating to a directly or indirectly identified or identifiable individual (subject of personal data).
Processing of personal data — any action or set of actions with personal data: collection, recording, systematization, accumulation, storage, clarification, use, transfer, depersonalization, blocking, deletion, destruction.
User - an individual or legal entity using the Service through a Telegram bot, MAX bot or Mini App.
Asset — a user-uploaded graphic file (logo, watermark, etc.) used as a media processing tool.
Group — unification of users sharing assets and settings within the Service.
Service — Flowmark software package, including Telegram bot, MAX bot, Mini App and Website.
§ 04List of processed data
4.1. Identification data from instant messengers
The operator receives the following information automatically when a user interacts with the bot. The user does not enter this data manually - it is provided by the messenger.
| Category | Source | Note |
|---|---|---|
| Numeric identifier (user ID) | Telegram, MAX | Assigned by the messenger, does not change |
| Username (username, @handle) | Telegram | If available; public nickname |
| First and/or last name from profile | Telegram, MAX | May be fictitious - no verification carried out |
Operator does not request in the Service interface telephone numbers, email addresses, passport data and other information not specified in this section, with the exception of the data provided by the user to the payment provider upon payment.
4.2. Media files submitted for processing
Images, video recordings and audio files sent by the user for processing within the functions of the Service (overlaying logos, watermarks, captions, pixelating faces, video compression, speech transcription, censoring obscene language, editing video by text request, editing and generating images using artificial intelligence technologies).
The composition of third parties' personal data that may be contained in such files and request texts (images of people, voice, information from documents, etc.) and the purposes of its processing are determined by the User. The Operator does not familiarize itself with the content of files, does not extract information about persons from them and processes such data on behalf of the User, solely to perform the operation launched, in the manner and on the terms of clause 3.6 of the Public Offer. The User ensures the lawfulness of transferring such data for processing.
The operator does not manually moderate the content of transferred files; automatic checking of requests to artificial intelligence functions is auxiliary in nature (clause 10.8 of the Public Offer). The user is responsible for ensuring that the content of the files complies with the laws of the Russian Federation and the rights of third parties.
Regarding the function of hiding faces in images: The Service performs automatic software detection of image areas corresponding to human faces, solely for technical processing purposes - to apply pixelation, blurring or masking at the User’s request. The detected coordinates of the areas are not saved, are not transferred to third parties and are destroyed along with temporary files immediately after the operation is completed. The Operator assumes that the User uploading files with images of faces has legal grounds for processing them.
Regarding the speech decoding (transcription) function: audio and video files with speech recordings are processed automatically for technical purposes. The Operator assumes that the User has the necessary consents of the persons whose speech is contained in the downloaded files, or other legal grounds for transferring such files for processing.
Regarding functions that use artificial intelligence technologies (editing and generating images, editing video by text request, etc.): to perform the operation, files and request texts are transferred to providers of such technologies, including providers located outside the Russian Federation (clause 7.3).
4.3. Assets and imported configurations
Files of logos, watermarks, other graphic elements, as well as configuration archives and brand kits (including files in the .flowpack - Flowpack format), imported by the User or used by him through the settings import / migration functions, are processed by the Service solely to provide the technical ability to store, configure and use such materials when processing media files.
The User is responsible for the legality of placement, import and use of assets, logos, trademarks, corporate identity elements and other materials. By downloading or importing such materials, the User confirms that they have the necessary rights and permissions to use them. The operator does not pre-moderate assets and imported configurations. If materials are detected whose content violates the legislation of the Russian Federation or the rights of third parties, the Operator has the right to remove such materials and limit the User’s access to the Service in the manner prescribed by the Public Offer.
4.4. User content in the database
- Asset names specified by the user;
- texts of caption presets (caption/geotag) and other text settings;
- saved parameters of media processing sessions;
- messages sent through the feedback form in the Service;
- texts of requests and messages addressed to Service functions that use artificial intelligence technologies, including requests rejected by moderation, as part of the operation history.
4.5. Technical data
Logs of the Service operation: time of access, type of operation performed, result of the operation (success / error), technical session identifiers. The logs do not contain the contents of the files being processed, but may contain fragments of request texts sent to artificial intelligence functions.
Statistics on the use of Service functions linked to the user identifier: actions performed, choice of tools and settings. The statistics do not contain the content of files or request texts.
4.6. Website visitor data
Information collected on the Website using cookies and the Yandex Metrica web analytics service: browser identifier, IP address, device and browser information, addresses of pages viewed, referral source (including advertising and promo links), actions on the page. See § 12 for details.
§ 05Purposes and legal grounds of processing
| Purpose of processing | Legal basis |
|---|---|
| Providing Service functionality: managing assets, plan and operation history | clause 5, part 1, art. 6 152-FZ (execution of the contract) |
| Storing, importing, exporting and synchronizing custom settings, assets, brand kits and .flowpack files | clause 5, part 1, art. 6 152-FZ (execution of the contract) |
| Storing the history of operations with artificial intelligence functions: accounting for credit charges, handling user requests, combating abuse | clauses 5 and 7, part 1, art. 6 152-FZ |
| User identification, access control to plan options | clause 5, part 1, art. 6 152-FZ |
| Providing team access (displaying data of team members) | clause 1 part 1 art. 6 152-FZ (consent) |
| Technical operation of the Service, diagnosis of errors and failures | clause 7, part 1, art. 6 152-FZ (legitimate interests) |
| Processing requests via the feedback form | clause 1 part 1 art. 6 152-FZ (consent) |
| Analysing the use of functions and improving the Service | clause 7, part 1, art. 6 152-FZ (legitimate interests) |
| Analysing Website traffic and advertising effectiveness using Yandex Metrica (§ 12) | clause 1, part 1, art. 6 152-FZ (consent) |
| Ensuring the security of the Service, combating abuse | clause 7, part 1, art. 6 152-FZ |
| Compliance with the requirements of the legislation of the Russian Federation | clause 2, part 1, art. 6 152-FZ |
Processing of third parties' personal data that may be contained in the User's files and texts is carried out on behalf of the User (clause 4.2) and is not reflected in this table.
§ 06Data retention periods
| Data category | Retention period |
|---|---|
| Media files submitted for processing, as well as processed files generated by the Service and sent to the user | They are deleted from the Operator’s servers immediately after processing is completed and the result is sent. Maximum period - 24 hours |
| Media files whose processing ended with a technical error | No more 7 days from the moment the error occurs, after which they are destroyed |
| Assets | Until the user deletes or closes the account |
| User content in the database (names, texts of presets, session parameters) | Until the user deletes or closes the account |
| Feedback form messages | No more 1 year from the moment of receipt |
| Technical logs | No more 90 days |
| Statistics on the use of Service functions | Until the account is closed, after which they are anonymized |
| Texts of requests to artificial intelligence functions (operation history) | No more than 90 days from the request |
| Website visitor data (Yandex Metrica) | For the periods set by the Yandex Metrica terms of service; cookies — until deleted by the visitor or until they expire |
| Identification data (user ID, username, name) | Until the account is closed or the deletion request is satisfied |
| Blocked account details | During the limitation period (3 years), unless otherwise required by law |
Deletion of source and processed media files is not a one-off scheduled procedure but a permanently running automatic mechanism: the system itself tracks the age of all temporary files and forcibly destroys everything older than 24 hours — regardless of whether the operation was completed, interrupted or left unanswered by the user. This mechanism operates at the Service infrastructure level and requires no action from the user.
§ 07Transfer of personal data to third parties
7.1. Payment provider
Processing of payment transactions is carried out by Robokassa LLC (robokassa.com). The data provided by the user during the payment process (including the email address for receiving a cash receipt) is processed by Robokassa LLC in accordance with their own privacy policy. The operator does not have access to users' payment details.
7.2. Payment via Telegram Stars
When paying through Telegram Stars, payment transactions are processed by Telegram and the relevant platforms according to their rules. The Operator does not receive the User's payment details.
7.3. Providers of artificial intelligence technologies
To perform operations that use artificial intelligence technologies (editing and generating images, editing video by text description, etc.), the Operator engages third-party providers of such technologies, including providers located outside the Russian Federation.
Only the files and request texts necessary to perform the operation launched by the User are transferred to providers, on behalf of the User (clause 4.2). The user ID, username, profile name and technical logs (clauses 4.1, 4.5) are not transferred to providers.
7.4. Team functionality
When using the team access function (inviting other users to a group), information about the participant who accepted the invitation—username in Telegram and/or first/last name in MAX—becomes available to the group owner who generated the invitation link, as well as to the group administrators assigned to him. This information is not shared with other group members and is not published. Invitation links are valid for no more than 24 hours.
7.5. Authorized bodies
Personal data is transferred at the request of authorized government bodies of the Russian Federation in cases and in the manner prescribed by law.
7.6. Other cases
The transfer of personal data to third parties in other cases is carried out only with the consent of the User.
7.7. Distinction between messengers
Telegram bot and MAX bot are separate access points to the Service, using the common server infrastructure of the Operator. The operator does not automatically transfer or forward messages, media files and other user data from one messenger to another. Sharing settings, assets and other working data is possible exclusively within one Group and only for its members; the user's membership in the messenger does not entail the disclosure of his data to other messengers or their operators.
7.8. Website analytics
Website visitor data (clause 4.6) is processed by YANDEX LLC on behalf of the Operator as part of the Yandex Metrica service on servers located in the Russian Federation. The Operator receives aggregated statistics and session recordings from the service that do not contain information allowing the Operator to identify the visitor.
§ 08Localization of personal data
In accordance with Part 5 of Art. 18 152-FZ, the recording, systematization, accumulation, storage, clarification and retrieval of personal data of citizens of the Russian Federation are carried out using databases physically located on the territory of the Russian Federation (Moscow). Media files and user assets are stored on the Operator’s servers located in the Russian Federation.
Users' personal data processed by the Operator (clauses 4.1, 4.4–4.6) is stored on servers in the Russian Federation and is not transferred outside it by the Operator, except in the case specified below. Files and request texts necessary to perform operations using artificial intelligence technologies are, after being recorded on the Operator’s servers, transferred to providers of such technologies, including outside the Russian Federation, on behalf of the User (clauses 4.2, 7.3).
§ 09Personal data protection measures
In accordance with Art. 19 152-FZ The Operator takes the following organizational and technical protection measures:
- restriction of physical and network access to server infrastructure;
- data encryption during transmission (TLS/HTTPS);
- automatic deletion of temporary files immediately after processing is completed;
- differentiation of access rights to user data;
- Maintaining access and operation logs.
§ 10Access restriction and blocking
The Operator has the right to limit or terminate the user’s access to the Service (block the account) without prior notice in the following cases:
- posting on the Service materials prohibited for distribution by the legislation of the Russian Federation;
- violation of copyright or other rights of third parties when using the Service;
- systematic or gross violations of the terms of the Public Offer;
- intentional attempts to hack, disrupt the operation of the Service or its infrastructure;
- mass automatic sending of requests (abuse), creating an excessive load on the Service;
- other actions that pose a threat to the security of the Service, other users or the Operator.
Personal data of a blocked user is stored for the limitation period (3 years), after which it is destroyed, unless otherwise required by law.
§ 11Rights of personal data subjects
In accordance with Articles 14–17 152-FZ, the user has the right:
- get information about the composition, purposes and methods of processing your personal data;
- demand clarification their personal data, their blocking or destruction if they are incomplete, outdated, inaccurate, illegally obtained or not necessary for the stated purpose of processing;
- withdraw consent to process personal data;
- request removal your data (account, assets, presets, transaction history);
- appeal actions or inaction of the Operator to Roskomnadzor (rkn.gov.ru) or in court.
To exercise the listed rights, the user sends a request in any form by email: contact@flowmark-app.com. The period for consideration of the application is 30 (thirty) calendar days from the date of receipt.
§ 12Cookies and similar technologies
12.1. The Website uses cookies and similar technologies (browser local storage) of the Yandex Metrica web analytics service, including Webvisor. They are needed to understand how visitors find and use the Website and to evaluate the effectiveness of advertising, including in Yandex Direct.
12.2. The information collected is listed in clause 4.6. The Website contains no input forms, so data entered by the visitor is not collected.
12.3. On the first visit, the Website shows a notice about the use of cookies. By staying on the Website or closing the notice, the visitor consents to the processing of this information for the purposes specified in clause 12.1.
12.4. You can opt out of data collection by blocking cookies in your browser settings, deleting stored cookies or using extensions that block web analytics. Consent can also be withdrawn by writing to contact@flowmark-app.com.
12.5. Mini App does not set cookies; User identification is carried out through data transmitted by the messenger when opening the Mini App.
§ 13Policy Change
13.1. The operator has the right to make changes to this Policy. The date of the last update is indicated in the title of the document.
13.2. The current English version of the Policy is always available at: flowmark-app.com/en/privacy.
13.3. Continued use of the Service after changes are published means the user agrees with the updated version. If significant changes are made that affect the rights of users, the Operator notifies about this through the Service interface.