Privacy Policy

1. What Data We Collect

At registration and during use of the Service, we collect the following categories of data:

• Parent registration data: email address, username (login), password hash.
• Child profile data: the child's first name (no surname), age group (grades 1–4, 5–8, or 9–11). Surname, date of birth, address, and other identifiers are not requested.
• Interaction history: the User's requests to the AI assistant, AI responses, and message timestamps.
• Technical data: IP address, browser type and version (User-Agent), session identifier, and device type.
• Payment data: when a subscription is purchased, bank card details are processed exclusively by the payment providers (Stripe, Robokassa). We do not store the card number, CVV, or expiry date.

2. How We Use the Data

The collected data is used for the following purposes:

• authentication and operation of the user account;
• issuing invoices and confirming payments;
• anonymized analysis of requests to improve the quality of AI responses and safety filters;
• protecting the Service from spam, bots, unauthorized access attempts, and abuse;
• sending transactional emails (registration confirmation, password recovery, notifications of changes to documents).

Marketing newsletters are not sent by default. Any informational emails on behalf of the Service are sent only with the User's explicit consent.

3. Disclosure to Third Parties

The following infrastructure providers' services are used to operate the Service:

• Google LLC — processing requests through the Gemini API to generate AI responses. The request text and conversation context are transmitted without identifying the User.
• Stripe Payments Europe Ltd. / Robokassa — accepting subscription payments. The data necessary to complete the transaction is transmitted.
• Yandex SMTP — delivery of transactional emails. The recipient's email address and the message body are transmitted.

Users' personal data is not disclosed to any other third parties. We do not sell data, do not share it with advertising networks, and do not use it to build advertising profiles.

Data is disclosed at the request of government authorities only in cases expressly provided for by the law of the Russian Federation.

4. Data Storage

The servers on which Users' data is stored are physically located within the Russian Federation, in compliance with the requirements of Article 18 of Federal Law No. 152-FZ.

• Active account data is stored for as long as the account has not been deleted by the User or the administration.
• After an account is deleted, the data is retained for a further 30 (thirty) calendar days — in case the deletion was a mistake or recovery is needed at the User's initiative.
• After 30 days, the data is subject to irreversible deletion or anonymization.
• Records of pending registrations are automatically deleted 30 minutes after creation if the User has not confirmed their email address.
• Financial documents (invoices, receipts) are retained for the periods established by the accounting and tax law of the Russian Federation.

5. User Rights (152-FZ)

In accordance with personal data law, the User has the following rights:

• the right to receive information about the categories of data being processed;
• the right to correct inaccurate or incomplete data;
• the right to erasure of data (the right to be forgotten);
• the right to restrict processing and withdraw consent;
• the right to receive a copy of one's data in a machine-readable format (the right to portability).

To exercise any of the rights listed above, send a written request to support@lomonosov.kids from the inbox provided at registration. The request is reviewed within 30 calendar days.

6. Cookies

The Service uses strictly necessary cookies — authentication cannot function without them:

• Authentication session cookie — set after signing in, with a 7-day lifetime, the HttpOnly and Secure flags, and inaccessible to JavaScript code on the page.
• Technical cookies — for protection against CSRF attacks and for storing interface settings (font size, selected theme).

Third-party advertising or analytics tracking cookies are not used. The Service does not include Google Analytics, Yandex.Metrica, Facebook Pixel, or any similar systems for tracking Users' actions.

7. Data Protection

The following technical and organizational measures are applied to ensure data security:

• passwords are stored solely as hashes using the bcrypt algorithm with a unique salt; recovery of the original password is impossible;
• all traffic between the User and the Service is encrypted with the HTTPS protocol (TLS 1.2 and above);
• access to production databases is limited to a narrow circle of administrators and is carried out over secure channels;
• system access logs are maintained and regularly reviewed for anomalies;
• in the event of a confirmed data breach, Users are notified by email within 72 hours.

8. Children

The Service is aimed at a children's audience, so special attention is paid to protecting the interests of minors:

• A child's account is created exclusively by a parent or legal guardian under their primary account and on the basis of the parent's consent.
• The AI assistant is equipped with a two-tier filtering system: a check of the request before it reaches the language model, and a check of the response before it is shown to the child.
• The collection of biometric data, precise geolocation, and other sensitive information is prohibited in child profiles.
• There are no ads or third-party affiliate integrations in the child interface.
• The parent has full access to their child's message history and can delete any data through their account.

9. Changes to the Policy

The administration reserves the right to make changes to this Policy. The User will be notified of material changes at the email address provided at registration no less than 30 (thirty) calendar days before the changes take effect.

The current version of the Policy is always available at /privacy.html. The effective date is stated at the beginning of the document.

10. DPO Contacts

For questions related to the processing of personal data, contact the person responsible for data processing at: support@lomonosov.kids.

The User has the right to file complaints about the operator's actions with the authorized body for the protection of the rights of personal data subjects — Roskomnadzor (rkn.gov.ru).