Privacy Policy
Saint Petersburg, Russia. Revision 1.0 of 30 September 2026, effective from the moment of publication at ota.aistastudio.ru
This English text is a translation. In case of discrepancy the Russian version at https://ota.aistastudio.ru/ru/privacy prevails.
1. Operator and scope
1.1. The personal data operator is Общество с ограниченной ответственностью «СТУДИЯ АИСТА», OGRN 1267800056260, INN 7814865711, KPP 781401001, address: 197706, г. Санкт-Петербург, вн.тер.г. город Сестрорецк, ул. Всеволода Боброва, д. 30, литера А, помещ. 1-Н, офис 13, hereinafter the "Operator". In the Terms of Use and the public offer this person is named the Contractor.
1.2. This Policy has been prepared in accordance with Federal Law No. 152-FZ of 27 July 2006 "On Personal Data" and sets out the procedure for processing, and the measures for ensuring the security of, personal data for which the Operator is the operator, in the operation of the Otapush service at https://ota.aistastudio.ru, including the website, the developer portal and the update API.
1.3. Address for enquiries on personal data processing: privacy@aistastudio.ru.
2. Data subjects
2.1. The Operator processes the personal data of the following subjects:
- clients — persons who have registered an account in the Otapush portal, and their representatives;
- website visitors — with respect to cookies, browser storage and web analytics (Section 7).
2.2. The operator of the personal data of end users of the clients' mobile applications is the client (Section 5).
3. What data is processed
| Category | Contents |
|---|---|
| Client account data | Email address, name, password hash (bcrypt; the password is not stored in clear text), plan, registration date, revisions of accepted documents, date and IP address of their acceptance. |
| Portal data | Applications (name, slug, runtime version, code-signing certificates), distribution channels, published updates (JavaScript builds and assets, publish messages, commit identifier), API keys. For each API key only its SHA-256 hash and a prefix of the first 12 characters are stored. |
| Payment data | Payment amount, date and status, the payment provider's order and payment identifiers, payment method (bank card or invoice), payer type (individual or legal entity). The Operator does not receive or store full bank card details. |
| Enquiries | The content of enquiries sent to the Operator and the correspondence about them. |
| Server technical logs | Request date and time, HTTP method, request path, response code, processing time; for errors, the error message. The IP address and User-Agent are not written to the log. |
| Cookies and browser storage | The portal session token, the selected interface language, the recorded cookie choice (Section 7). |
3.1. The Operator does not collect special categories of personal data or biometric personal data.
4. Purposes and legal grounds
| Purpose | Legal ground |
|---|---|
| Registration, identification and provision of access to the portal | Performance of a contract to which the subject is a party (clause 5, Part 1, Article 6 of 152-FZ) |
| Determining the applicable plan and billing the client | Performance of a contract (clause 5, Part 1, Article 6 of 152-FZ) |
| Payments, issuance of fiscal receipts, accounting and tax records | Compliance with statutory obligations (clause 2, Part 1, Article 6 of 152-FZ); 54-FZ, 402-FZ, Tax Code |
| Proof of acceptance of documents at registration | Compliance with the obligation under Part 3 of Article 9 of 152-FZ (clause 2, Part 1, Article 6 of 152-FZ) |
| Security, failure diagnostics, abuse prevention | Legitimate interests of the Operator (clause 7, Part 1, Article 6 of 152-FZ) |
| Support and responses to enquiries | Performance of a contract; the data subject's consent |
| Website analytics (Yandex Metrika) | The data subject's consent (clause 1, Part 1, Article 6 of 152-FZ) |
4.1. Processing includes collection, recording, systematisation, accumulation, storage, updating, retrieval, use, transfer (provision, access), depersonalisation, blocking, deletion and destruction. Processing is automated.
4.2. The Operator does not take decisions producing legal effects concerning the subject solely on the basis of automated processing (Article 16 of 152-FZ).
5. Data of end users of the clients' applications
5.1. Client applications request updates from the Otapush server and send the device identifier deviceId, the platform and the channel. The client determines the data sent: deviceId is set by the client's application itself. The Operator does not generate or verify this identifier and does not link it to the identity of an end user.
5.2. The operator of the end users' personal data is the client. The Operator does not accept instructions to process this data and is not a person processing personal data on behalf of an operator (Part 3 of Article 6 of 152-FZ). This Policy does not apply to end user data.
5.3. The Service stores records of the form "application, deviceId, calendar month, platform, channel, time of last request" to account for the volume of services (MAU), and check, download and install events with the update identifier and time for the client's statistics. Device records are deleted automatically 13 months after the device's last request, events after 30 days.
5.4. The client undertakes not to send in deviceId or other request parameters any information that identifies an end user. The lawfulness of processing, informing end users and responding to their requests are the client's responsibility. Requests from end users received by the Operator are forwarded to the client.
6. Who data is shared with
| Recipient | What is shared and why |
|---|---|
| TBank JSC (Russia) — payment provider (internet acquiring) | Payment amount and description, order identifier, email address for the fiscal receipt. Purpose — accepting payment and issuing the receipt. |
| Yandex LLC (Russia) — Yandex Metrika | Website visit information — only after consent via "Accept all" (Section 7). |
| "Oblachnye Tekhnologii" LLC (INN 7736279160, Russia) — hosting, Moscow | The Service's servers and the file storage for published updates are located with this party under a lease agreement. |
| "VK Digital Technologies" LLC (Russia) — mail provider for the aistastudio.ru domain | Correspondence sent to privacy@aistastudio.ru and otapush@aistastudio.ru. |
| Government authorities | Upon a reasoned request, in the cases and to the extent provided by the legislation of the Russian Federation. |
6.1. Personal data is not sold and is not shared with advertising networks or data brokers.
7. Cookies and analytics
7.1. Identifiers in cookies and browser storage are processed as personal data.
7.2. Necessary data is processed without separate consent because the Service cannot work without it (clause 5, Part 1, Article 6 of 152-FZ):
ota_token(localStorage) — the portal session token (JWT, valid for 30 days);otapush-lang(localStorage) — the selected interface language;otapush_cookie_consent(localStorage) — the record of the visitor's choice in the cookie banner.
7.3. Optional data — Yandex Metrika web analytics. The counter is loaded only after the "Accept all" button in the banner is pressed; closing the banner is not consent. Click map, outbound link tracking and accurate bounce rate are enabled in the counter; Session Replay (Webvisor) is disabled.
7.4. The choice is stored in localStorage under the key otapush_cookie_consent as {"choice":"all"|"necessary","version":1,"decidedAt":"<ISO date and time>"} without an expiry date.
7.5. The "Necessary only" choice keeps the Service fully functional. The choice may be changed or withdrawn via the "Cookie settings" link in the website footer, by clearing site data in the browser or by writing to privacy@aistastudio.ru.
8. Retention periods
| Data | Period |
|---|---|
| Account data and portal content | For the life of the account; deletion on request (Section 10) |
| Payment records | Periods required by accounting and tax legislation (no less than 5 years, Part 1 of Article 29 of 402-FZ) |
| Server technical logs | Not written to the Service database; process log rotation is performed by the hosting infrastructure |
| Cookie choice record | On the visitor's device until the choice is changed or site data is cleared |
8.1. Data is destroyed or depersonalised when the purposes of processing are achieved, when consent is withdrawn (if there is no other ground for processing) or when the above periods expire.
9. Data protection
9.1. The Operator takes the legal, organisational and technical measures under Articles 18.1 and 19 of 152-FZ, including:
- passwords are stored only as irreversible hashes (bcrypt);
- API keys are stored as a SHA-256 hash and a short prefix;
- portal sessions are signed JWT tokens valid for 30 days;
- private code-signing keys for updates are not issued outside the server;
- external connections are encrypted (TLS);
- access to each client's data is isolated: requests to applications, keys and statistics are executed only on behalf of their owner.
10. Rights of the data subject
10.1. The data subject may obtain information about the processing of their data (Article 14 of 152-FZ), demand its correction, blocking or destruction if it is incomplete, outdated, inaccurate or unlawfully obtained, withdraw consent to processing (Part 2 of Article 9 of 152-FZ) and appeal against the Operator's actions to Roskomnadzor or in court (Article 17 of 152-FZ).
10.2. Requests are sent to privacy@aistastudio.ru from the email address of the account and must contain information identifying the subject and the substance of the request. Requests are handled manually. A response is given within 10 business days; the period may be extended by no more than 5 business days with a reasoned notice.
10.3. An end user of a client's application sends requests to the developer of that application as the operator of their data.
10.4. Supervisory authority: the Federal Service for Supervision of Communications, Information Technology and Mass Media (Roskomnadzor), rkn.gov.ru.
11. Changes to the Policy
11.1. The Operator may unilaterally change this Policy. A new revision is published on this page with its number and date and takes effect upon publication.
12. Operator details
- Operator: Общество с ограниченной ответственностью «СТУДИЯ АИСТА» (ООО «СТУДИЯ АИСТА»)
- OGRN: 1267800056260
- INN: 7814865711, KPP: 781401001
- Registered address: 197706, г. Санкт-Петербург, вн.тер.г. город Сестрорецк, ул. Всеволода Боброва, д. 30, литера А, помещ. 1-Н, офис 13
- Service website: https://ota.aistastudio.ru
- Personal data enquiries: privacy@aistastudio.ru
- Tax regime: НДС не облагается в связи с применением упрощённой системы налогообложения (п. 2 ст. 346.11 НК РФ)