The essentials
ETOCHATBOT operates in the Russian Federation in strict compliance with Federal Law No. 152-FZ of July 27, 2006 "On Personal Data" (the "152-FZ"). The Operator is listed in the Register of Operators Processing Personal Data under registration number 16-25-027399 (entry in the Roskomnadzor Register).
We collect the minimum amount of data needed to deliver the service. We don't share it with ad networks, don't sell it to third parties, and don't use it for anything unrelated to running the service.
1. Terms and definitions
- Operator — sole proprietor Dmitry Yuryevich Kiselev, taxpayer ID 165720128759, state registration number OGRNIP 323169000141965 (full details on the Operator details page).
- Service — the ETOCHATBOT software and hardware platform, accessible at https://etochat.bot and through the dashboard at /panel.
- User — an individual, legal entity, or sole proprietor who has registered for the service.
- End customer — a third party who contacted a chat bot connected by the User.
- Personal data (PD) — any information relating to a directly or indirectly identified or identifiable individual (Article 3, clause 1 of 152-FZ).
- Personal data processing — any action or set of actions on personal data, as listed in clause 3 of Article 3 of 152-FZ.
2. Legal grounds for processing
The Operator processes personal data on the following legal grounds under Part 1, Article 6 of 152-FZ:
- Data subject's consent (clause 1) — given on registration (see the Personal data processing consent).
- Contract performance (clause 5) — delivery of the service under the Public offer.
- Legitimate interests (clause 7) — keeping the service running and secure (access logs, anti-fraud).
- Performance of statutory duties (clause 2) — accounting and tax records (Tax Code of the Russian Federation), responses to lawful requests from government authorities.
3. Categories of data subjects and the data processed
3.1. Service Users
- Full name (if provided on registration or in profile settings).
- Email address, mobile phone number (optional).
- A password hash (the original password can't be recovered).
- Legal entity or sole proprietor details — when signing a contract.
- Service usage data: action timestamps, IP address, browser type, session ID.
- Limited payment data: card type, last 4 digits. The Operator does not receive or store the full card details.
- Keys and tokens of connected bots — stored in the service database; access to it is restricted and tokens are never handed out. When a channel is deleted, its token goes with it.
3.2. End customers of Users
When an end customer writes to a User's bot, their data flows into the Service. The Operator processes the following data of end customers:
- User identifier on the corresponding chat channel.
- Username, display name, profile photo — if provided by the channel.
- Message contents and media sent to the bot.
- Message metadata: time, delivery status, identifiers.
In this part of the processing, the Operator acts as a data processor on the User's instructions (Part 3, Article 6 of 152-FZ). The conditions of those instructions are spelled out in the Data processing agreement (DPA). The User is solely responsible for the lawfulness of collecting end-customer data and for having legal grounds to process it.
3.3. Support requests
When you contact support, the Operator processes the User's email or contact, the request text, and any attached files — solely to resolve the issue.
4. Purposes of processing
- Registration and identification of the User in the service; providing access to the features.
- Delivery of services under the Terms of service and the Public offer.
- Exchanging messages between the User and their end customers.
- Settlements, invoicing, generating closing documents, tax accounting.
- Notifying the User about service status, plan changes, scheduled maintenance.
- Supporting the User on service-related questions.
- Ensuring information security (logs, abuse protection).
- Analyzing service operation in anonymized form to improve the product.
- Meeting the requirements of Russian law.
5. Processing principles (Article 5 of 152-FZ)
- Lawfulness and fairness: processing is carried out only on lawful grounds.
- Purpose limitation: personal data is processed only for the purposes stated in this Policy.
- Minimization: the scope of personal data processed matches the purpose.
- Accuracy: the Operator keeps the data accurate and updates it on a subject's request.
- Storage no longer than needed: retention periods are listed in section 9.
- Security: technical and organizational protection measures are applied (section 8 and Security measures).
6. Processing methods and localization
Personal data is processed both with automated tools (on server infrastructure located in data centers in the Russian Federation, in line with Part 5, Article 18 of 152-FZ) and without them — when data is entered manually into the interface or printed out.
Localization: initial collection and subsequent storage of personal data of Russian Federation citizens take place exclusively in databases located in Russia.
7. Sharing data with third parties
The Operator shares personal data with third parties only in the following cases:
- Acquiring bank / payment aggregator — for processing payments. The data shared includes: payer's name (for legal entity payments), email, amount, order number.
- Hosting provider (Russian Federation) — for hosting the server infrastructure. The hosting provider is bound by a confidentiality agreement and does not have access to the database contents.
- Russian government authorities — on a lawful request (Roskomnadzor, Federal Tax Service, Ministry of Internal Affairs, courts).
- Auditors and consultants — under a non-disclosure agreement (NDA), when a compliance review is needed.
- Web analytics — Yandex.Metrica (Yandex LLC) — traffic statistics for the public site. Yandex processes visitor data (page URLs, referrer, IP address, click maps, session recordings) on servers located in the Russian Federation; session recording (Webvisor) is disabled on pages that display personal data or payment details. Details in the Cookie policy.
The Operator does not share personal data with ad networks or marketing agencies, does not sell it to third parties, and does not use it to build advertising profiles.
8. Data security
In accordance with Article 19 of 152-FZ and the requirements of Government Decree No. 1119 of November 1, 2012 (which defines the personal data protection levels), the Operator applies the following measures:
- Technical measures: TLS 1.2+ for all connections; cryptographic hashing of user passwords; restricted database access; network segmentation; firewalls; antivirus protection; regular OS and application updates.
- Organizational measures: a limited set of people with access to personal data; individual accounts; access logging; employee training; a removable-media policy.
- Backups: database copies are taken several times a day and transferred to external storage over an encrypted channel (see section 9).
- Incident response: a procedure for notifying Roskomnadzor within 24 hours and data subjects within 72 hours in case of a personal data breach (Part 3.1, Article 21 of 152-FZ).
Note: within the meaning of the Operator's entry in the Roskomnadzor register, certified cryptographic (encryption) means (SKZI) are not used. The measures above rely on standard transport-layer security (TLS), one-way password hashing, and access controls.
Read more on the Security measures page.
9. Retention periods
The service does not erase data on a schedule: it is kept for as long as the channel or the account exists, and it goes when someone deletes it — you or us. The one exception is named below.
- User account — for the entire period the service is used. Deleted on your request (see Data deletion); there is no automatic deletion by time.
- Messages and media in conversations — for as long as the channel they belong to exists. When you delete a channel in the dashboard, the conversations are deleted immediately and irreversibly. Disconnecting a channel on its own (revoked access, an inactive bot) deletes nothing: in that case a person deletes the data within 3 calendar days. If you would rather not wait, write to us (see Data deletion).
- Photos sent by website chat visitors — 90 days, then deleted automatically. This is the only time-based cleanup in the service.
- Payment documents and primary accounting records — 5 years (Article 29 of the Federal Law "On Accounting", clause 317 of the Standard Archival Records List approved by Rosarkhiv Order No. 236).
- Security logs — server-side technical logs rotate daily and are kept for about two weeks. Service records in the database (the rule trigger log, API calls) have no separate term and are deleted together with the channel or the account. One exception: the partner event delivery log is not reached by channel deletion today — details in Data deletion.
- Personal data processing consents and their withdrawals — 5 years from receipt / withdrawal.
- Database backups — taken several times a day and living out their own term on the storage side. Backups are not restored to satisfy a deletion request, and deleted data does not come back into the service from them.
10. Data subject rights
Under Article 14 of 152-FZ, a data subject has the right to:
- Receive confirmation that their personal data is being processed, along with information about the operator, the purposes, methods, and timelines of processing, the list of personal data being processed, and the source.
- Receive a copy of the personal data being processed (subject to the limits of Part 8, Article 14 of 152-FZ).
- Request the clarification, blocking, or destruction of personal data if it is incomplete, outdated, inaccurate, unlawfully obtained, or no longer necessary for the stated purpose of processing.
- Withdraw consent to personal data processing (Part 2, Article 9 of 152-FZ). After withdrawal, the Operator stops processing the data or destroys it, except in the cases set out in Part 5, Article 21 of 152-FZ (for example, tax documents).
- Appeal the Operator's actions or inaction to Roskomnadzor or through the courts.
Send requests to info@etochat.bot with "Personal data request" in the subject line. Response time: 10 business days for clarifying information and 30 calendar days to provide a copy of the personal data (Parts 1 and 2 of Article 20 of 152-FZ). The Operator may request identification documents to verify the subject's identity.
Some of this you do yourself: a channel, together with all of its conversations, is deleted from the dashboard — immediately and irreversibly. The whole account is deleted on a written request. The procedure and the timelines are in Data deletion.
11. Cookies and similar technologies
The service uses cookies and similar technologies (localStorage) for technical operation (sessions, sign-in, interface preferences) and for traffic analytics via Yandex.Metrica (Yandex LLC; servers in the Russian Federation, no cross-border transfer; session recording is disabled on pages with personal data). Read more in the Cookie policy.
12. Minors
The service is not intended for use by anyone under 18. Read more on the Age policy page.
13. Changes to the policy
The Operator may amend this Policy. Material changes are published 14 calendar days before they take effect, with notice to Users by email and in their dashboards. The current version is always available at /privacy; the date of the current version is shown at the top of the document.
14. Contact information
For any questions about personal data processing, contact the Operator:
- Email: info@etochat.bot (subject: "Personal data request").
- Postal address: 25 Chetaev St., Kazan, 420126, Russia.
- Full details on the /requisites page.
The supervisory authority: Federal Service for Supervision of Communications, Information Technology and Mass Media (Roskomnadzor), https://rkn.gov.ru.