ModuloomThis Privacy Policy explains how Sole Proprietor (Individual Entrepreneur) Denis Valerianovich Kapitonov (“Moduloom”, “we”, “us”) collects, uses, shares and protects personal data when you visit moduloom.online or moduloom.ru, sign up, use the Moduloom service or contact us, and the choices and rights you have.
1. Who we are
The controller of personal data collected through our websites and for running customer accounts is Sole Proprietor (Individual Entrepreneur) Denis Valerianovich Kapitonov, Office 201, 24 Nekrasova St., Kazan, Russian Federation, Taxpayer ID (INN) 211202250896. Contact for all privacy matters: support@moduloom.online, +7 (965) 680-77-87.
When our customers (companies, schools, tutors) add their users, viewers, students or survey participants to their accounts, the customer is the controller of that data and we act as its processor (service provider). If you are such a person, please send requests to the organization that invited you; we will help them respond.
2. Personal data we collect
| Category | Examples | Source |
|---|---|---|
| Identifiers and contact data | Name, work email, phone, company name, account subdomain | You, at sign-up or in contact forms |
| Business and billing data | Russian Taxpayer ID (INN) and other company details, plan, invoices, payment status (we never receive full card numbers) | You; our payment bank |
| Account and usage data | Sign-in events, actions in the account, support requests, settings | Your use of the service |
| Customer content | Presentations, images, fonts, texts, survey questions and answers, viewer profiles (name, email, group), viewing analytics | Customers and their users |
| Device and network data | IP address, browser and device type, time zone, approximate location derived from IP | Automatically, via our servers and cookies |
| Website analytics (with consent) | Pages visited, clicks, scrolls, referrer (Yandex Metrica) | Cookies and similar technologies, only after you accept |
| Communications | Emails and messages you send us, call notes | You |
We do not intentionally collect sensitive personal information (such as health, biometric, racial or religious data, government ID numbers or precise geolocation), and we ask customers not to upload it. AI prompts are automatically checked for emails, phone numbers, passport, social insurance and card numbers, which are filtered out.
3. How we use personal data and our legal bases
| Purpose | Legal basis (GDPR / UK GDPR) |
|---|---|
| Creating and running your account, signing you in with one-time codes, providing the features of your plan | Performance of a contract (Art. 6(1)(b)) |
| Billing, invoices, accounting and tax records | Contract; legal obligation (Art. 6(1)(c)) |
| Customer support and service emails (codes, invitations, invoices, reminders, security notices) | Contract; legitimate interests (Art. 6(1)(f)) |
| Security, fraud and abuse prevention, logging, backups | Legitimate interests; legal obligation |
| Improving the website and service with aggregated analytics | Consent for analytics cookies (Art. 6(1)(a)); legitimate interests for aggregated server statistics |
| Answering requests from contact forms | Steps at your request before a contract; legitimate interests |
| Product news and offers (only if you opt in) | Consent — you can unsubscribe at any time |
| Complying with law and enforcing our Terms | Legal obligation; legitimate interests |
We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing, and we do not use your content to train AI models.
4. How we share personal data
We share personal data only with service providers that process it on our behalf under contracts requiring confidentiality and security, and only as needed:
- Hosting and storage — data centers in Russia (Moscow), where our databases, files and backups are located.
- Payments — JSC “ALFA-BANK” (card acquiring and SBP; PCI DSS certified, 3-D Secure). Card details are entered on the bank's page and never reach us.
- Email delivery — our email service provider in Russia (Yandex 360 for business mail).
- Website analytics — Yandex Metrica (YANDEX LLC), only if you accept analytics cookies.
- AI generation — ProxyAPI (proxyapi.ru) and Cloud.ru (Cloud Technologies LLC) as gateways to neural network models of Russian and foreign providers, some hosted outside Russia. Prompts must not contain personal data and are filtered for it.
- Authorities and legal — when required by law, to protect rights and safety, or in connection with a reorganization or sale of the business (subject to this Policy).
We do not sell personal information and do not share it for cross-context behavioural advertising, as those terms are defined under the California Consumer Privacy Act (CCPA/CPRA) and similar laws, and have not done so in the past 12 months.
5. International data transfers
Moduloom is operated from Russia and our servers are located in the Russian Federation. If you use the service from the European Economic Area, the United Kingdom, Switzerland, the United States or another country, your personal data will be transferred to and stored in Russia, which has not been recognized by the European Commission as providing an adequate level of data protection. We transfer data to Russia because it is necessary to perform the contract you request (GDPR Art. 49(1)(b)) and, where applicable, on the basis of your explicit consent given at sign-up (Art. 49(1)(a)), and we apply the safeguards described in this Policy. Some AI models may be hosted in other countries; prompts sent to them must not contain personal data.
6. How long we keep data
| Data | Retention |
|---|---|
| Contact form requests and leads | 1 year after the last contact |
| Customer account and contract data | For the term of the contract plus 3 years |
| Accounting and tax records (invoices, payments) | 5 years, as required by law |
| IP addresses and device data in logs | 180 days |
| Audit logs and closed support tickets | 3 years |
| Email delivery log and AI prompts | 1 year |
| Account materials after access ends | 30 days, then deleted |
| Viewer profiles and their analytics after access ends | 90 days, then deleted |
| Analytics cookies | See the Cookie Policy |
Backups are overwritten on a rolling schedule. When data is no longer needed we delete or anonymize it.
7. Security
We use encryption in transit (HTTPS/TLS), isolation of data between customer accounts, private storage with temporary signed links, passwordless sign-in with one-time codes, role-based access, CSRF protection, audit logging, regular backups and monitoring. Only authorized staff who need access to do their job can reach personal data. No method of transmission or storage is completely secure; if a breach affects your data, we will notify you and, where required, the competent authorities, within the time limits required by law (we notify customers within 24 hours of becoming aware of an incident affecting their data).
8. Your rights
Depending on where you live, you may have the right to:
- access the personal data we hold about you and receive a copy;
- correct inaccurate data;
- delete your data (subject to legal retention requirements);
- restrict or object to processing, including processing based on legitimate interests and direct marketing;
- data portability — receive your data in a structured, machine-readable format;
- withdraw consent at any time, without affecting earlier processing (for cookies — via “Cookie settings” at the bottom of every page);
- lodge a complaint with a data protection authority in your country of residence or work.
To exercise your rights, write to support@moduloom.online from the email linked to your account. We will verify your identity (usually by confirming control of that email) and respond within one month (GDPR) or 45 days (US state laws), extendable where the law allows. You may use an authorized agent; we may ask the agent for proof of authorization and verify your identity directly. We do not charge a fee unless requests are manifestly unfounded or excessive. If we decline your request, you may appeal by replying to our decision; we will respond to appeals within the period required by law.
9. Notice for California and other US states
This section supplements the Policy for residents of California and other US states with comprehensive privacy laws (such as Colorado, Connecticut, Virginia, Utah, Texas, Oregon and others).
- Categories collected in the last 12 months: identifiers; customer records (name, email, phone, company details); commercial information (plans, invoices); internet or network activity (usage and analytics data); approximate geolocation from IP; professional information (company and role); and inferences are not drawn. Sources, purposes and recipients are described in sections 2–4.
- Sale and sharing: we do not sell personal information and do not share it for cross-context behavioural advertising or targeted advertising; we do not process data for profiling with legal or similarly significant effects.
- Sensitive personal information: we do not use or disclose it for purposes that would give a right to limit its use.
- Your rights: to know/access, delete, correct, opt out of sale/sharing/targeted advertising (not applicable, as we do none of these), and not to be discriminated against for exercising your rights.
- Global Privacy Control (GPC): our websites treat a GPC signal as a valid request to opt out and do not load analytics cookies when it is present. We do not respond differently to “Do Not Track” signals because there is no common standard for them, but we do not track you across third-party websites.
- Shine the Light: we do not disclose personal information to third parties for their direct marketing purposes.
- Retention: see section 6.
10. Children's privacy
Our websites and the account are intended for adults (18+) and are not directed to children. We do not knowingly collect personal information directly from children under 13 (or under 16 in the EEA/UK). Schools, tutors and other customers may add students as viewers; in that case the customer is responsible for obtaining verifiable parental consent or other authorization required by law (including COPPA and, for US schools, FERPA), and we process student data only on the customer's instructions and only to provide the service — never for advertising or profiling. We recommend using only a first name and a parent's email for children. If you believe a child has given us personal data without authorization, contact support@moduloom.online and we will delete it.
11. Cookies
We use strictly necessary cookies to run the website and account and, only with your consent, analytics cookies. Details and controls are in the Cookie Policy.
12. Changes to this Policy
We may update this Policy. The current version is always published on this page with its effective date; for material changes we will notify account owners by email or with a notice on the website before they take effect.
13. Contact us
Questions or requests about privacy: support@moduloom.online. Postal address: Office 201, 24 Nekrasova St., Kazan, Russian Federation. See also the Terms of Service and the AI & Acceptable Use Policy.
- Provider
- Sole Proprietor (Individual Entrepreneur) Denis Valerianovich Kapitonov
- Taxpayer ID (INN)
- 211202250896
- State registration no. (OGRNIP)
- 313213802500040
- Address
- Office 201, 24 Nekrasova St., Kazan, Russian Federation
- support@moduloom.online
- Phone
- +7 (965) 680-77-87
- Business hours
- Mon–Fri, 10:00–19:00 Moscow time (UTC+3)