Privacy Policy

This Privacy Policy (hereinafter — the "Policy") defines the procedures for processing and protecting personal data of users (hereinafter — "Data Subjects" or "Users") of the AI Design Space online platform (hereinafter — the "Platform"), located at https://aidesignspace.pro, including the Telegram bot @aidesignspace_bot (hereinafter — the "Bot").

The personal data controller is IE Panova Elvira Viktorovna (hereinafter — the "Controller").

1. General Provisions

1.1. Legal Framework

1.1.1. This Policy has been developed in accordance with:

• Federal Law No. 152-FZ dated July 27, 2006 "On Personal Data" (hereinafter — 152-FZ);
• Federal Law No. 149-FZ dated July 27, 2006 "On Information, Information Technologies and Information Protection";
• Government Decree No. 1119 dated November 1, 2012;
• Orders and guidelines of Roskomnadzor (Russian Federal Service for Supervision of Communications);
• General Data Protection Regulation (GDPR) of the EU — to the extent applicable to Russian controllers.

1.2. Terms and Definitions

Personal Data — any information relating directly or indirectly to an identified or identifiable individual.

Personal Data Processing — any action (operation) or set of actions performed on personal data.

Controller — a person organizing and/or carrying out the processing of personal data.

Data Subject — an individual to whom personal data relates.

Cookies — small text files placed on the User's device when visiting a website.

Data Anonymization — actions that make it impossible to determine the attribution of data to a specific individual.

1.3. Processing Principles

1.3.1. Processing on a lawful and fair basis.

1.3.2. Processing is limited to specific, predetermined, and legitimate purposes.

1.3.3. Data is not excessive in relation to the stated purposes.

1.3.4. The Controller takes measures to ensure accuracy and currency of data.

1.3.5. Storage — no longer than required by the processing purposes.

2. Data We Collect

2.1. Registration Data

2.2. Automatically Collected Data

• IP Address — security, fraud prevention;
• User-Agent — browser, OS, and device information;
• Cookies and Sessions — authentication and personalization;
• Visit Data — login time, pages visited, referrer;
• Interaction Logs — clicks, generations, downloads, errors.

2.3. Service Usage Data

• Prompts — text queries for AI generations;
• Uploaded Files (Assets) — images, video, audio;
• Generated Content — results of AI generations;
• Project Metadata — names, generation settings;
• Generation History — log of all generations with timestamps.

2.4. Financial Data

• Transaction data (amount, date, plan);
• Anonymized card token, payment status (the Controller does not store full card details);
• Invoices and receipts; for legal entities — organization details.

2.4.2. Bank Card Data

When saving a bank card for automatic payments, data is transmitted directly to the payment provider and processed in accordance with PCI DSS Level 1 standards.

Data stored on the Platform:

• Unique card token (cannot be used to make payments outside the Platform);
• Last 4 digits of the card number;
• Payment system brand (Visa, Mastercard, MIR);
• Card expiration date;
• Binding status (active / unlinked).

Data the Controller does NOT store:

• Full card number;
• CVV/CVC code;
• PIN code;
• Any other data that would allow a payment without the payment provider.

Legal basis: consent of the data subject (Art. 6(1)(a) of Federal Law No. 152-FZ), explicitly given when saving the card.

Retention periods:

• Card token — until the User revokes consent or deletes their account;
• Transaction data — 3 (three) years from the date of the transaction (as required by accounting regulations);
• Consent for card storage (fact, date, IP address) — for the entire subscription period + 1 year.

Security measures:

• Encryption of tokens at rest;
• Card data access restricted to the certified payment provider;
• Regular security audits;
• Immediate token deletion upon consent revocation.

User rights:

• View the list of saved cards in "Account → Payments";
• Delete any saved card;
• Revoke consent for card storage (all tokens are deleted immediately);
• Request information about card data processing.

2.5. Referral/Partner Program Data

• Referral links, referral statistics;
• Payout details (card, wallet, bank account);
• Partner documents (sole proprietor/company details, acceptance certificates).

2.6. Google and YouTube API Services data

Google sign-in and connecting YouTube are separate actions. Google sign-in provides the profile fields listed in section 2.1 to create or authenticate your AI Design Space account. Sign-in alone does not authorize video publication.

If the owner separately connects YouTube in Social Studio, the Platform uses YouTube API Services and processes:

• The authorized channel ID, name, URL/handle and uploads playlist ID to identify the correct publication destination.
• Granted permissions, authorization expiry and OAuth tokens to perform authorized operations, including scheduled jobs while the browser is closed. The stored refresh token is encrypted.
• The video selected by the user, title, description, tags, audience settings, publication time and visibility to send to YouTube under a user-approved publishing job.
• The uploaded video ID, URL, processing and publication status, publication time and sanitized errors to show the result, check its status and support cancellation.

The integration requests https://www.googleapis.com/auth/youtube.force-ssl. Google's description covers more operations than the Platform performs: our integration identifies the channel, uploads videos, checks status and deletes an uploaded video when cancelling a supported scheduled or in-progress job. A separate action to delete already-published videos is not offered in the workspace. AI Design Space does not request or store Google or YouTube passwords.

Use and sharing. Google sign-in and YouTube connection data are used for authentication, connected-channel operation, approved publishing, security and support. Selected videos and metadata are sent to Google/YouTube for publication; hosting and storage processors handle necessary data on the Controller's behalf. Staff access is limited to user-consented support, abuse investigations and legal obligations. These data are not sold, shared with advertising networks, used for targeted advertising or used to train or improve generalized AI/ML models. Other connector features separately selected by the user are governed by their own disclosures and consent.

AI Design Space's use and transfer of information received from Google APIs adhere to the Google API Services User Data Policy, including the Limited Use requirements. General asset, marketing and model-training provisions do not apply to these Google/YouTube API data.

Retention. Connection details and the encrypted refresh token are retained while needed for the authorized connection; job information supports execution and publication history. You may request deletion of stored API data without deleting your entire AI Design Space account. The specific deadline below applies instead of general generation-history, financial-document or account-deletion periods.

Revoke access and delete data. You can revoke AI Design Space's access at any time in Google Account permissions. This invalidates the authorization; further publishing requires reconnection. To delete stored channel and authorization data, email aidesignspace.pro@gmail.com from your account email and identify the channel. Do not send passwords or tokens. After verifying ownership of the request, the Controller stops related jobs and deletes stored authorization and channel data, including related publication API data, without undue delay and within 7 calendar days. Unavoidable backup copies remain isolated from operational use until their scheduled expiry; a deleted connection is not restored from them for publishing. Your original selected media and legally required financial documents follow separate rules and do not authorize continued Google API access.

Revoking permission or deleting stored connection data does not remove videos already published on YouTube. Manage those videos in YouTube Studio. Use of YouTube API Services is also subject to the YouTube Terms of Service and Google Privacy Policy.

2.7. Instagram publishing and the comment-to-DM bot

After the owner connects an Instagram professional account, we process its ID, username, available profile information, granted permissions and encrypted token. Publishing uses owner-selected media, captions, schedule, publication IDs, status and errors. The bot uses owner-configured keywords and reply content, the identifiers and content of qualifying comment/message events, sender identifiers and delivery status to deliver requested material and handle a rule-supported response. These data are not used for advertising or to train generalized models.

Approved publications and replies are sent to Instagram/Meta to perform the requested action. Settings and history are accessible to the owner and authorized workspace members within their permissions. Publishing and bot rules may share a connection: disconnecting only the publication channel does not necessarily disconnect the bot. For full revocation, use Instagram/Meta permission settings and request deletion of stored connection/event data at aidesignspace.pro@gmail.com. After verifying ownership, data are deleted without undue delay and within 7 calendar days. This does not remove content previously published on Instagram.

3. Purposes of Personal Data Processing

3.2. Additional Purposes (with Separate Consent)

• Using generation examples in marketing;
• Training AI models (anonymized data);
• Email promotional mailings (with unsubscribe option).

Google sign-in and Google/YouTube API data described in section 2.6 are excluded from these additional purposes, including model training and marketing.

4. Legal Basis for Processing

4.1. Data Subject Consent

The primary legal basis is data subject consent (Article 6, Part 1 of 152-FZ). Provided upon registration (acceptance of the offer), by consent checkbox, and through continued use.

4.2. Contract Performance

Processing for contract performance (Article 6, Part 1, Clause 5 of 152-FZ).

4.3. Legitimate Interests of the Controller

Fraud prevention, security assurance, intellectual property protection (Article 6, Part 1, Clause 7 of 152-FZ).

4.4. Legal Obligations

Providing data upon government authority requests, retaining data for tax reporting (Article 6, Part 1, Clause 2 of 152-FZ).

5. Storage and Protection of Personal Data

5.1. Retention Periods

Upon expiration of retention periods, data is destroyed or anonymized.

5.2. Security Measures

Organizational: appointment of responsible officer, internal regulatory acts, access rights segregation, data carrier tracking.

Technical:

• HTTPS (TLS 1.2+) for all connections;
• Password encryption (bcrypt), session encryption (JWT), encryption of sensitive fields;
• OAuth 2.0, Telegram Auth, MFA (optional);
• Monitoring and logging of data operations;
• Daily encrypted database backups;
• WAF, Cloudflare DDoS protection, regular software updates;
• SSH keys, VPN, password-based access prohibited.

5.3. Storage Location

• PostgreSQL — Render (Oregon, USA);
• Cloudflare R2 — distributed global infrastructure;
• Logs and Backups — secured servers with restricted access.

All providers comply with ISO 27001, SOC 2.

6. Cross-Border Transfer of Personal Data

Safeguards: data subject consent, contracts with providers, data anonymization for analytics transfers.

The User has the right to withdraw consent for cross-border transfer (aidesignspace.pro@gmail.com), which may limit functionality.

7. Cookies and Tracking Technologies

Cookie management — through browser settings. Blocking may result in Platform malfunction.

Analytics services: Google Analytics, Yandex.Metrica. Opt-out — via browser extensions (GA Opt-out, etc.).

8. Data Subject Rights

8.1. Right of Access

Request to aidesignspace.pro@gmail.com. Response — within 30 calendar days.

8.2. Right to Rectification

Through the interface (Settings → Profile) or via support.

8.3. Right to Erasure (Right to Be Forgotten)

Account deletion through the interface or request to aidesignspace.pro@gmail.com. Data is deleted within 30 days. Assets — immediately. Exception: data required by law.

8.4. Right to Restriction of Processing

Request to aidesignspace.pro@gmail.com stating the reason.

8.5. Right to Data Portability

Data copy in JSON/CSV format. Processing — 14 calendar days.

8.6. Right to Withdraw Consent

Written statement to aidesignspace.pro@gmail.com. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal. May result in inability to use the Platform.

8.7. Right to Object

Unsubscribe from mailings — "Unsubscribe" link in emails or Platform settings.

8.8. Right to Lodge a Complaint

• To the Controller: aidesignspace.pro@gmail.com;
• To Roskomnadzor: rkn.gov.ru;
• To Court: at the place of residence or the Controller's location (Samara, Russia).

9. Disclosure of Data to Third Parties

All third parties are obligated to: maintain confidentiality, not use data beyond agreed purposes, comply with 152-FZ, and notify of incidents.

In case of a change in Platform ownership — 30 days' notice. The new owner must comply with this Policy or obtain new consent.

10. Data Security for Minors

10.1. The Platform is not intended for individuals under 18 years of age (except with parental consent).

10.2. The Controller does not intentionally collect data from minors.

10.3. Data of a minor collected without parental consent is deleted within 3 business days.

10.4. Deletion request — to aidesignspace.pro@gmail.com with a document confirming the parental relationship.

11. Security Incident Notification

11.1. In case of a data breach or unauthorized access, the Controller shall:

• Immediately take remedial measures;
• Notify Roskomnadzor within 24 hours;
• Notify affected Users within 72 hours;
• Publish information about the incident on the Platform.

11.2. The notification shall contain: incident description, categories of affected data, consequences, measures taken, and recommendations.

12. Privacy Policy Amendments

12.1. The Controller reserves the right to make changes at any time.

12.2. Material changes — email notification 14 days in advance, pop-up notification, publication on the homepage.

12.3. Continued use = consent to the new version.

12.4. If you disagree — delete your account before changes take effect.

13. Contact Information

Inquiry Response Times:

• Data access requests — up to 30 calendar days;
• Deletion/rectification — up to 10 business days;
• Complaints and claims — up to 10 business days;
• Technical questions — up to 3 business days.

14. Final Provisions

14.1. This Policy is an integral part of the Service Agreement (Public Offer).

14.2. Disputes are resolved under the laws of the Russian Federation.

14.3. In case of conflict with other Platform documents, this Policy shall prevail.

14.4. Invalidity of individual provisions does not invalidate the Policy as a whole.

This English version is provided for informational purposes only. In case of discrepancies, the Russian version shall prevail.