Privacy Policy

This Policy is prepared in accordance with Russian Federal Law No. 152-FZ dated 27 July 2006 "On Personal Data" and governs how personal data of Users of vocaloff.ru is processed.

1. Controller

• The Controller is a sole proprietor (ИП), tax ID (ИНН) 561408735904.
• The Controller's full legal details are disclosed in the electronic fiscal receipt emailed to the User on every payment (54-FZ).
• Contact for personal-data requests: hello@vocaloff.ru.

2. Data we process

• Identification: email, display name, avatar — received from Google and Yandex OAuth providers when you sign in.
• OAuth provider's unique user ID — used only to match the account.
• Technical data: IP address, user-agent, session identifier, preferred interface language.
• Usage data: generation history (file name, duration, processing mode, status, timestamps). Stored for 24 hours, then deleted.
• Payment data: YooKassa payment ID, date, amount, chosen tariff. Card numbers and CVV codes are never transmitted to or stored by the Controller; they are handled exclusively by the payment agent YooKassa (ЮMoney LLC).
• Uploaded audio files — retained for up to 24 hours for processing and download, then automatically deleted.

3. What we do NOT collect

• Bank card numbers, CVV codes, card expiry dates.
• Account passwords (login is only via Google/Yandex OAuth).
• Passport data, physical addresses, phone numbers — not requested.

4. Purposes of processing

• Providing access to the Service.
• User identification and account protection.
• Accounting for payments and minute consumption.
• Communicating with the User regarding service delivery.
• Issuing fiscal receipts pursuant to 54-FZ.
• Protecting the Service from fraud and automated attacks.
• Fulfilling obligations under Russian law.

5. Legal grounds

• Consent of the data subject, expressed by accepting the Offer and registering (Art. 6(1)(1) of 152-FZ).
• Performance of a contract to which the data subject is a party (Art. 6(1)(5)).
• Compliance with statutory duties — 54-FZ (fiscal receipts), 115-FZ (AML), 149-FZ (information and data protection).

6. Disclosure to third parties

• YooKassa (ЮMoney LLC) — to process payments and issue fiscal receipts.
• Google, Yandex — upon OAuth login initiated by the User (the Controller receives data from them, not the other way around).
• Data may be disclosed to Russian state authorities upon a duly formed lawful request.
• The Controller does not sell, rent or otherwise transfer personal data for advertising or marketing purposes.

7. Use of user content

The Controller does not use uploaded audio files or processing results to train AI models, nor for analytics, resale, transfer to third parties or any purpose other than directly providing the service to the User.

8. Retention periods

• Audio files (source and processed) — 24 hours after processing, then auto-deleted.
• Generation history — 24 hours, then cleared.
• Account data (email, OAuth ID, avatar) — until the User deletes their account or requests erasure.
• Payment records and fiscal documents — 5 years, as required by the Russian Tax Code.
• Security logs (IP, user-agent) — 12 months.

9. User rights

Under Art. 14 of 152-FZ the User has the right to:

• Obtain information about the processing of their personal data.
• Request correction, blocking or deletion of data that is incomplete, inaccurate or unlawfully processed.
• Withdraw consent (Art. 9 of 152-FZ). Withdrawal terminates Subscription service delivery.
• Exercise the "right to be forgotten" — request deletion of the account and all associated data (except data the Controller must retain by law, e.g. payment records).
• Lodge a complaint with Roskomnadzor or in court.

All requests must be sent to hello@vocaloff.ru from the account email. Responses are provided within 30 calendar days.

10. Security measures

• All traffic between User and Service is encrypted via HTTPS (TLS).
• Passwords and API secrets are kept outside the public web root.
• Server access is restricted by SSH keys and IP allow-lists.
• The database is backed up regularly (user audio files are not backed up).
• The Controller does not process biometric or special categories of personal data.

11. Cookies

The site uses technical cookies strictly necessary for operation (session ID, language preference). Third-party advertising or analytics cookies are not set without additional notice to the User.

12. Cross-border transfers

Personal data is processed and stored on servers located in the Russian Federation. Cross-border transfers are not performed.

13. Changes to this Policy

The Controller may unilaterally amend this Policy. The updated version is published on this page; the effective date is shown at the top.