Privacy policy

1. General provisions

1.1. The policy applies to all personal data processed by the operator (section 2) when operating the Layero service: sites layero.ru, app.layero.ru, docs.layero.ru, API api.layero.ru, console utility layero, MCP servers and platforms for publishing sites on subdomains layero.app (hereinafter collectively referred to as the “Service”).

1.2. The policy describes what data is processed, why, on what basis and for how long, to whom it is transferred and how the subject can exercise his rights. Consent to processing is documented in a separate document - Consent to the processing of personal data.

1.3. Sites and applications that clients of the Service publish on the platform are called client sites in the Policy. The operator of the data of their visitors is the owner of the site; The service processes such data on its behalf (section 5).

2. Operator

Individual entrepreneur Murzak Mikhail Mikhailovich, TIN 772029626711, OGRNIP 315774600406786, address: 111621, Moscow, st. Orenburgskaya, 8, bldg. 1, apt. 3 (hereinafter referred to as the “Operator”). Responsible for organizing the processing of personal data is Mikhail Mikhailovich Murzak. Questions and requests regarding personal data: support@layero.ru.

3. Processing principles

The operator processes data lawfully and fairly, only for predetermined purposes, to the extent necessary for these purposes, does not merge databases processed for incompatible purposes, ensures the accuracy of the data and stores them no longer than required by the purposes or the law.

4. Objectives, data, reasons and timing

4.1. Subjects whose data is processed: users of the Service (registered and trying the Service without registration); visitors of the Service websites; persons who made a complaint or request.

4.2. Backup copies of the Service database are stored for up to 25 months and are used only for recovery after failures. Data deleted from the Service is not restored from copies to production systems and is deleted after the copy storage period expires.

5. Data we process on behalf of clients

5.1. In databases, projects, forms on websites, magazines and through the Data API, Service clients post the personal data of their visitors and users. The operator of this data is the client. The service processes them on behalf of the client on the terms Instructions for processing personal data and only to provide services to him.

5.2. When accessing client sites, the platform processes the technical data of the request. The IP address is used to deliver the response, protect against attacks, and identify the country and city. The IP address is not recorded in request logs and statistics. It may end up in the web server's error log along with a description of the error; This log is stored for no longer than 3 days.

5.3. A visitor to a client’s website who wants to know about the processing of their data contacts the website owner. The request received by the Operator is forwarded to the site owner.

6. Actions with data

Collection, recording, systematization, accumulation, storage, clarification (updating, changing), retrieving, using, transferring (providing, accessing), blocking, deleting, destroying - with or without the use of automation tools.

7. Who is the data transferred to?

7.1. Recipients processing data on behalf of the Operator are instructed to maintain confidentiality and take protective measures in accordance with Article 19 152-FZ.

7.2. At the client’s direction, the Service transfers data to the services connected by it - for example, form data to its Google Sheets table (Google LLC, USA) or site statistics to its Yandex Metrica counter. The client as an operator is responsible for such transfer.

8. Cross-border transfer

8.1. The operator transfers personal data outside Russia to the recipients listed in section 7 (UAE, USA), to the extent and for the purposes specified there, based on the consent of the subject and after notifying Roskomnadzor in accordance with Article 12 152-FZ.

8.2. These countries may not provide protection of the rights of personal data subjects at a level equal to the Russian one.

9. Where is the data stored?

Recording, systematization, accumulation, storage, clarification and retrieval of personal data of citizens of the Russian Federation is carried out using databases on the territory of Russia - in the Yandex Cloud data processing centers (ru-central1 region) and Timeweb Cloud (Moscow), as required by Part 5 of Article 18 152-FZ.

10. Cookies and web analytics

Necessary cookies are always used. The site informs about analytical cookies (Yandex Metrica) with a banner; By continuing to use the site, the visitor agrees to their use. You can unsubscribe at any time: on the page "Cookie Policy" or by disabling cookies in your browser settings; after failure, Metrica does not load. More details in Cookie Policy.

11. Removal and destruction

11.1. The data is destroyed upon achievement of the purposes of processing, upon expiration of the deadlines in section 4, upon withdrawal of consent or at the request of the subject, unless there is another legal basis for processing.

11.2. You can delete your account in your account settings in the control panel or by requesting support@layero.ru. After the request, access is terminated immediately and the data is deleted within 30 days. Payment information is saved during accounting periods without connection to the account.

11.3. Destruction is performed automatically, removing records and files from production systems. The fact of destruction is confirmed by downloading from the event log in accordance with the requirements of Roskomnadzor.

12. Data subject rights

12.1. The subject has the right:

• obtain information about the processing of your data, including a list of data, purposes, deadlines and recipients;
• request clarification, blocking or destruction of data if it is incomplete, outdated, inaccurate, obtained illegally or not needed for the stated purpose;
• revoke consent to processing, newsletters and cookies;
• appeal the Operator’s actions to Roskomnadzor or in court.

12.2. The request is sent to support@layero.ru from the address associated with the account or with personally identifiable information. The response period is 10 working days from the date of receipt of the request; it can be extended by 5 working days with an explanation of the reasons.

13. Protective measures

• appointment of a person responsible for organizing the processing of personal data, approval of internal documents on processing and protection;
• connection encryption (HTTPS/TLS);
• encryption of secrets (environment variables, tokens, database passwords) with AES-256-GCM and Fernet algorithms, backup copies with keys in the Yandex Cloud key management service;
• differentiation of access rights based on the principle of least privilege;
• logging of activities and connections, monitoring;
• the procedure for responding to incidents, including notifying Roskomnadzor within 24 hours and reporting within 72 hours (Part 3.1 of Article 21 152-FZ).

14. Minors

The service is intended for legally capable persons. If the Operator becomes aware that the data of a minor has been obtained without the consent of the legal representative, he will delete it.

15. Change of policy

15.1. The current version is published at layero.ru/privacy, previous ones are in the archive via the links at the beginning of the document.

15.2. The Operator notifies about significant changes in the control panel at least 14 calendar days before they come into force.