Privacy policy

1. General provisions

1.1. This Privacy Policy (hereinafter referred to as the “Policy”) determines the procedure for processing and protecting personal data of individuals (hereinafter referred to as “Users”) using the Layero service located at layero.ru and app.layero.ru (hereinafter referred to as the “Service”).

1.2. The Policy has been prepared in accordance with the requirements of Federal Law No. 152-FZ of July 27, 2006 “On Personal Data” (hereinafter referred to as “152-FZ”) and applies to all processes of processing personal data in the Service.

1.3. By using the Service and/or registering in it, the User confirms familiarity with this Policy and consents to the processing of his personal data under the conditions specified therein.

2. Operator and contacts

The personal data operator (hereinafter referred to as the “Operator”) is the person operating the Service. Details are given at the end of the document.

Contacts regarding the processing of personal data: support@layero.ru.

3. What data do we process?

3.1. Account informationreceived during authorization by email or through an OAuth provider (Yandex ID):

• unique identifier for the provider;
• username (login) and publicly specified name;
• email address;
• link to avatar;
• when connecting GitHub App - a list of repositories to which access is granted by the User (metadata only, no content).

3.2. Service Usage Data:

• identifiers of created organizations, projects, deployments;
• domain names and settings;
• technical operation logs (build/deploy logs);
• statistics of hits to published sites, if built-in web analytics is enabled.

3.3. Technical data, collected automatically:

• IP address;
• browser type and version, operating system, device type;
• Cookie identifiers and similar technologies;
• information about visited pages of the Service, access time, referral source.

3.4. Payment information:

• subscription and payment history information;
• masked card details (type, last 4 digits) - for saved payment methods;
• full payment data (card number, CVV) are processed exclusively by the YooKassa payment service (YooMoney NPO LLC) and are not transferred or stored to the Service.

3.5. Support communication data: contents of requests, correspondence and attached files.

4. Purposes of processing

The operator processes personal data for the following purposes:

• identification of the User and provision of access to the Service;
• fulfillment of obligations under the User Agreement and Public Offer;
• billing and payment transactions;
• providing technical support;
• ensuring the performance and security of the Service, investigating incidents;
• informing about significant changes to the Service, plans and conditions;
• compliance with the requirements of the legislation of the Russian Federation.

5. Legal basis for processing

• User consent - expressed by acceptance of this Policy and User Agreement;
• the need to fulfill the agreement with the User (Article 6 Part 1 Clause 5 152-FZ);
• the need to comply with the requirements of the legislation of the Russian Federation (Article 6, Part 1, Clause 2, 152-FZ);
• legitimate interests of the Operator in terms of ensuring the performance and security of the Service (Article 6, Part 1, Clause 7, 152-FZ).

6. Processing methods and timing

6.1. Processing is carried out using automation tools and without them: collection, recording, systematization, accumulation, storage, clarification, extraction, use, transfer (provision, access), blocking, deletion and destruction.

6.2. Storage of personal data processed in connection with the use of the Service by citizens of the Russian Federation is carried out using databases located on the territory of the Russian Federation (Part 5 of Article 18 152-FZ). The service is hosted on the Yandex Cloud infrastructure (Russia).

6.3. Retention periods:

• account data - before the Account is deleted by the User and the expiration of 30 calendar days after;
• technical operations logs - up to 90 days;
• data on payments - within the periods established by the legislation on accounting and tax accounting (at least 5 years);
• cookie - in accordance with section 9 and Cookie Policy.

7. Transfer to third parties

7.1. The operator transfers personal data to third parties only to the extent necessary to provide services, and in the following cases:

• OAuth provider (Yandex LLC) - to check authorization;
• Payment service - LLC NPO "YooMoney" (UKassa) for accepting payments;
• Hosting provider - Yandex.Cloud LLC (Yandex Cloud) for hosting the Service infrastructure;
• Web analytics service - Yandex LLC (Yandex.Metrica) to analyze traffic to the Service;
• Authorized government agencies - on the basis of motivated requests in the manner prescribed by law.

7.2. Transfer of personal data for other purposes to third parties without the consent of the User is not carried out, except for cases expressly provided for by the legislation of the Russian Federation.

8. Cross-border data transfer

8.1. The operator does not carry out cross-border transfer of personal data. The Service infrastructure and the services involved (authorization, hosting, web analytics, payment acceptance) are located on the territory of the Russian Federation.

9. Cookies and similar technologies

The service uses cookies for authentication, saving user settings and collecting anonymized statistics. Detailed description - in Cookie Policy.

10. Rights of the subject of personal data

The user has the right:

• receive information about the processing of your personal data;
• demand clarification, blocking or destruction of personal data in case of incompleteness, inaccuracy or illegality of processing;
• withdraw consent to processing (this entails deletion of the Account and termination of access to the Service, unless otherwise provided by law);
• appeal the actions or inaction of the Operator to Roskomnadzor or to court.

Requests for the exercise of these rights are sent to the address support@layero.ru. The response period is no more than 10 working days from the date of receipt of the request.

11. Security measures

The operator applies legal, organizational and technical measures necessary to protect personal data from unauthorized or accidental access:

• data transmission over secure channels (HTTPS/TLS);
• encryption of environment variables and other secrets using the AES-256-GCM algorithm;
• differentiation of access rights of employees and systems based on the principle of least privilege;
• logging of critical actions and automatic monitoring;
• regularly update system components.

12. Change of Policy

The current version of the Policy is always available at layero.ru/privacy.html. In case of significant changes, the Operator notifies Users by email or in the control panel at least 14 calendar days before they come into force.