Privacy Policy
This Privacy Policy (the “Policy”) describes how personal data of users of the Storello service, available at https://storello.ru (the “Service”), is processed. The Policy is drafted in accordance with the Constitution of the Russian Federation, Federal Law No. 152-FZ of 27 July 2006 “On Personal Data” (“FZ-152”), other regulations of the Russian Federation, and with regard to the requirements of the General Data Protection Regulation of the European Union (GDPR) for users located in the European Economic Area.
By using the Service the user confirms that they have read this Policy and accept its terms. If the user does not agree with any provision of the Policy, they should stop using the Service and delete their account.
1. Personal Data Operator
The operator processing personal data within the meaning of Article 3 of FZ-152 is Individual Entrepreneur (Sole Proprietor) Zakharov Nikita Yurievich, INN 100130477573, OGRNIP 322100000019548, registered address: Russia, Petrozavodsk, Sortavalskaya str. 9a, apt. 48 (the “Operator”).
The person responsible for organising personal data processing (under Article 22.1 of FZ-152): Zakharov Nikita Yurievich. Email address for data subject inquiries: support@storello.ru.
For EU users, the role of the contact point for personal data matters (Data Protection Contact) is performed via the email address above. Appointment of a separate DPO within the meaning of Article 37 GDPR is not required given the scale and nature of processing.
2. Definitions
Personal data — any information relating directly or indirectly to an identified or identifiable natural person (the data subject).
Processing of personal data — any operation or set of operations performed on personal data, including collection, recording, organisation, accumulation, storage, adaptation, retrieval, use, transfer, anonymisation, blocking, erasure and destruction.
User — a natural person who has registered with the Service and created an account.
Content — any text, headings, covers, comments and other materials created or uploaded by the user while using the Service.
3. Categories of data processed
The Operator processes the following categories of personal data, depending on which features of the Service the user uses.
3.1. Account data
Email address, name or pseudonym, avatar (if provided by the user), hashed password (bcrypt algorithm with salt; the original password is never stored on the Operator’s servers). When a passkey is used — the public key and the credential identifier; the private key never leaves the user’s device and is not transmitted to the Operator.
3.2. User content
Document text, headings, covers, comments, version history, edit metadata (timestamps, author of the change). Content refers to material voluntarily created by the user and is not a special category of personal data within the meaning of Article 10 of FZ-152, unless the user themselves chooses to place such information in it.
3.3. Technical data
The user’s device IP address, browser type and version, operating system, session identifier, request timestamps, in-Service page transitions. This data is collected automatically and used to operate, secure and diagnose the Service, as well as for anonymous visitor analytics (visit and page-view counts, approximate country derived from the IP address). Such analytics are processed on the Operator’s own infrastructure, are not transferred to any third party, and use no cookies or third-party counters: visits are counted on the server by an anonymised code that changes every day; the IP address is not stored.
3.4. Payment metadata
When paid plans are introduced, information about the fact, date and amount of payment will be processed, along with a transaction identifier from the payment provider. Full bank card details and other payment instruments are not collected or stored by the Operator — they are processed by a certified payment provider in accordance with the PCI DSS standard.
3.5. Support correspondence
The content of correspondence with the user sent via support@storello.ru or the in-app feedback form, together with related technical metadata of the inquiry.
4. Purposes of processing
The Operator processes personal data solely for the following purposes:
— registering and identifying the user in the Service;
— providing the Service’s functionality: editing, storing, synchronising and exporting documents, collaborative editing;
— securing the account (protection from unauthorised access, incident investigation);
— handling user inquiries to customer support;
— fulfilling obligations related to paid features (if activated);
— improving the quality of the Service based on anonymised usage statistics;
— complying with the requirements of the legislation of the Russian Federation, including tax and accounting duties.
5. Lawful basis
The lawful basis for processing personal data is:
— consent of the data subject to the processing of their personal data (Article 6(1)(1) of FZ-152; Article 6(1)(a) GDPR), expressed through deliberate actions of the user when registering with the Service;
— necessity of processing for the performance of a contract to which the data subject is a party (Article 6(1)(5) of FZ-152; Article 6(1)(b) GDPR);
— necessity for compliance with a legal obligation to which the Operator is subject under federal law (Article 6(1)(2) of FZ-152; Article 6(1)(c) GDPR);
— processing for the legitimate interests of the Operator in securing the Service (Article 6(1)(7) of FZ-152; Article 6(1)(f) GDPR), except where such processing infringes the rights and freedoms of the data subject.
6. Methods and retention
Personal data is processed both with and without the use of automation. Operations include collection, recording, organisation, accumulation, storage, adaptation, retrieval, use, transfer (in cases provided for by this Policy), anonymisation, blocking, erasure and destruction.
Personal data is retained for the duration of the user’s account. After the account is deleted, personal data is removed from the Service’s primary database immediately. Encrypted backups are kept for no more than 90 (ninety) days from the date of their creation, after which they are automatically deleted by the storage rotation policy.
Audit log records (sign-in events, security setting changes, administrator actions) are retained for 90 days. After this period the records are automatically deleted.
Data whose processing is required to comply with tax, accounting and other legislation of the Russian Federation is retained for the periods set by the respective regulations (as a rule — 5 years).
7. Transfers and cross-border transfers
The Operator does not sell personal data and does not disclose it to third parties, except in cases expressly provided by law or by this Policy.
Parties engaged by the Operator for the purpose of storing and processing data:
— Hosting provider — a Russian company providing a virtual server located within the Russian Federation on which the Service’s application and database are hosted;
— Object storage for backups — a Russian S3-compatible storage provider; only encrypted backups are uploaded to it (age algorithm, XChaCha20-Poly1305); the decryption key is held exclusively by the Operator;
— Sentry (Functional Software, Inc.; data stored in the EU, Germany) — software error telemetry service; only technical crash data is transmitted (error type, call stack, client version); document content and user email addresses are not transmitted to Sentry;
— YooKassa (YooMoney NBCO LLC) — accepting and processing payments for paid plans and AI credit packs; full bank-card numbers are neither transmitted to nor stored by the Operator — they are handled by the PCI DSS-certified payment agent; for subscription auto-renewal the Operator stores only a payment token, not card data;
— AI feature providers: DeepInfra, Inc.(USA) — the primary provider: assistant replies, text editing and speech transcription for dictation; under its terms DeepInfra does not train models on the data it receives and does not keep it after the response, except to investigate an issue at the Operator’s written request and where the law requires; GPTunnel (Russia; requests are executed by OpenAI, L.L.C. models, USA) — building the search index over project texts and a fallback channel. Fragments of document text, and for dictation a voice recording, are transmitted to the providers to the extent needed for the AI features; email addresses, names and payment data are not transmitted, and requests are sent by the Operator’s server. This occurs (1) on the user’s initiative, when using the AI assistant or dictation, and (2) automatically, when the “project memory” (a short summary of the project’s content) and the search index are periodically built in the background on the paid “Author” plan and above. If the user does not use AI features and is on a plan below “Author”, document content is not transmitted to the providers;
— DuckDuckGo, Inc. (USA) — web search when the assistant looks up information for a reply; the search phrases composed by the assistant are transmitted (they may contain words from the user’s question);
— Resend (Plus Five Five, Inc., USA) — sending service emails (sign-in codes, password recovery, co-author invitations, payment notices); the email address, name and message text are transmitted;
— Telegram (Telegram FZ-LLC, UAE) — only if the user has linked Telegram: the Telegram ID and the notification text;
— Push notification services of the browser or operating system (Google, Apple, Mozilla, Microsoft) — only if the user has enabled notifications: the technical delivery address and the notification text;
— Government authorities — upon a substantiated lawful request, to the extent required by law.
The Service’s primary database and backups are located within the Russian Federation, which complies with the localisation requirement for personal data of Russian citizens set out in Article 18(5) of FZ-152. Some data is transferred outside the Russian Federation (Article 12 of FZ-152), only to the extent needed for the respective feature: to Germany (Sentry — technical crash reports), to the USA (DeepInfra and OpenAI — text fragments and voice recordings for AI features; Resend — service emails; DuckDuckGo — the assistant’s search phrases; push notification services) and to the UAE (Telegram — if the user has linked it). The USA and the UAE are not on the list of states providing adequate protection of data subject rights. By using AI features, and by enabling a paid plan with background AI features, the User consents to such transfer and processing of fragments of their Content.
8. Data subject rights
In accordance with FZ-152 and GDPR (for EU users), the data subject has the right to:
— obtain information about the processing of their personal data, including the purposes, scope, methods, retention periods and recipients to whom the data may be disclosed;
— obtain a copy of their personal data in a structured, machine-readable format (“Settings → Download my data”);
— request rectification, modification or completion of their personal data;
— request erasure of their personal data, including by deleting the account (“Settings → Delete account”);
— withdraw consent to the processing of personal data at any time by deleting the account or by sending a request to support@storello.ru; withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal;
— lodge a complaint with the supervisory authority competent for the protection of data subject rights — the Federal Service for Supervision of Communications, Information Technology and Mass Media (Roskomnadzor), and, for EU users, the national supervisory authority of their country of residence.
Requests to exercise these rights should be sent to support@storello.ru. Inquiries are reviewed within 30 (thirty) days from the date of receipt, unless a different period is set by law.
9. Security measures
The Operator takes legal, organisational and technical measures to protect personal data against unlawful or accidental access, destruction, modification, blocking, copying, distribution, and other unlawful actions, in accordance with Article 19 of FZ-152.
In particular, the following measures are applied: transport encryption (TLS version 1.2 or higher on all connections); hosting the database (PostgreSQL) on a server within the Russian Federation with network access restricted by a firewall and access rights segregated; encryption of backups before upload to external storage (age, XChaCha20-Poly1305; the decryption key is held exclusively by the Operator); protection against credential brute-forcing (rate limiting and automatic temporary lockout on suspicious activity); security event logging; regular software updates; segregation of staff access rights on a least-privilege basis.
The Operator draws the user’s attention to the fact that no system for transmitting data over the Internet and no data storage system can be guaranteed 100% secure. The user is responsible for the safekeeping of their password and for actions performed under their account.
10. Cookies and local storage
The Service uses only strictly necessary cookies and browser local storage without which the Service cannot operate or would be substantially impaired. Analytics and advertising cookies and third-party counters (Yandex Metrica, Google Analytics and the like) are not set by the Operator. Visit statistics are counted on the server without cookies, by an anonymised code that changes every day; the IP address is not stored.
List of technical storage used:
— Session cookie (HttpOnly, Secure, SameSite=Lax flags) — used to maintain an authenticated user session; lifetime — up to 15 minutes with automatic renewal on activity;
— localStorage — used to persist UI preferences (selected theme, language, last open document) and client-side drafts;
— sessionStorage — used for short-lived technical data that lives only for the open browser tab.
The user can delete cookies and the contents of local storage through their browser. After deleting the session cookie the user will be automatically signed out and can sign in again.
11. Minors
The Service is not intended for persons under 16 years of age. The Operator does not request age information from users; however, upon receiving reliable information that an account belongs to a person under that age, the account will be blocked and the related personal data deleted.
12. Changes to this policy
The Operator may amend this Policy. The current edition is always published at https://storello.ru/privacy-en. The Operator will notify users of material changes affecting their rights by email and/or within the Service no less than 14 (fourteen) days before the changes take effect. The date of the latest edition is shown at the top of this document.
13. Contacts and inquiries
For any questions concerning the processing of personal data, the exercise of data subject rights, or other matters relating to interaction with the Operator, please contact: support@storello.ru.
Postal address for official correspondence: Russia, Petrozavodsk, Sortavalskaya str. 9a, apt. 48.