Personal Data and Information Processing Policy

1.1. This Policy describes the organizational and technical approaches of individual entrepreneur Pavel Nikolaevich Strukov (the “Operator”) to processing and protecting personal data and other information in ReplayBox.

1.2. This document supplements, but does not replace, the Privacy Policy. Purposes, data categories, legal grounds, retention periods and data subject rights are defined in the Privacy Policy: https://replaybox.ru/legal/privacy.

1.3. The Policy covers the website, account, backend, ReplayBox software, databases, object storage, email and administrative tools.

1.4. The published version does not disclose passwords, keys, internal system addresses, security architecture or other information that could reduce security.

1.5. Measures are based on Russian legal requirements and assessments of potential harm and current threats.

2.1. The Operator organizes processing, approves documents, assigns access and oversees compliance.

2.2. Persons authorized to process data receive only necessary privileges and must maintain confidentiality.

2.3. Administrative access is granted individually and may be revoked following changes in duties or identified risks.

2.4. The Operator keeps track of information systems, data categories, providers and storage locations.

2.5. Material processing changes are assessed before the relevant feature enters operation.

3.1. The Operator protects:

• account data;
• authentication, session and access recovery data;
• application installation identifiers and anti-fraud information;
• user videos, audio, previews, notes and metadata;
• complaints and moderation results;
• support enquiries;
• technical logs and security event information;
• contractual, payment and accounting records where paid features are enabled;
• the Operator's keys, configurations and other internal information.

3.2. Information is classified by access level as:

• public: lawfully published information and content;
• restricted user information: account data and content accessed through non-public links;
• confidential information: personal data, access secrets and internal records;
• critical internal information: keys, passwords, recovery codes and security configurations.

3.3. Making content public does not make passwords, emails, tokens or related data public unless expressly provided and lawfully justified.

4.1. The Operator applies:

• lawfulness and purpose limitation;
• minimization of collected data;
• separation of user and administrative access;
• least-privilege access;
• protection throughout the data lifecycle;
• timely updates and vulnerability remediation;
• controlled engagement of providers;
• logging significant events;
• retention limits;
• readiness to respond to incidents.

4.2. Measures take account of data volume and nature, available technology, implementation costs and likely harm to data subjects.

5.1. Data is collected through website forms, the account, software, file uploads, enquiries and technical requests.

5.2. Initial online recording and storage of Russian citizens' data use databases in the Russian Federation.

5.3. Transmission between the User and Service uses a secure connection where supported by the relevant technology.

5.4. Analytics technologies are activated only after separate consent, apart from essential technical tools.

5.5. Verification and recovery tokens must not be sent to analytics systems. Sensitive link parameters are excluded from addresses sent to analytics.

5.6. The Operator does not request passwords by email or require full card numbers or security codes.

6.1. Passwords are stored as cryptographic hashes using an algorithm designed for password protection.

6.2. Session, verification and recovery tokens are stored as hashes where plaintext storage is not required for delivery.

6.3. Sessions have limited lifetimes and may be revoked.

6.4. Application connection uses time-limited one-time codes and cryptographic installation verification.

6.5. The Operator rate-limits sensitive requests and uses protection against automated registrations.

6.6. The User must use a unique password, protect their device and promptly report compromise.

7.1. Video files and previews are stored in private object storage.

7.2. Published content is accessed using a unique, unpredictable link token and subject to its visibility setting.

7.3. Public link recipients may share links with third parties, so the User must control link distribution.

7.4. The Operator limits administrative viewing to support, security, moderation, requests and legal requirements.

7.5. Incomplete uploads have a separate lifetime. Completed content is deleted on plan expiration or User instruction.

7.6. The Operator does not use user video content for advertising profiling or training its own models.

8.1. Application and infrastructure secrets are not included in public code or legal documents.

8.2. Temporary service email queue content is encrypted until delivery and deleted when processing ends.

8.3. The application's private installation key is created and stored on the User's device; the Operator receives the public key and its fingerprint.

8.4. Provider keys and passwords are stored separately from public content and are accessible only to a limited group.

8.5. Suspected compromised secrets are revoked or replaced within a reasonable period.

9.1. Access is granted by role and task.

9.2. Administrators may access user, content and complaint information to the extent necessary for support and moderation.

9.3. Privileged actions are logged and reviewed where possible.

9.4. Shared administrative accounts are not used where individual identification is technically available.

9.5. Access is revoked when authority ends.

10.1. The Operator may log dates, times, request addresses, User-Agent values, operation results, technical errors and event identifiers.

10.2. Logs are used for diagnostics, security and incident investigation rather than covert profiling.

10.3. Access to logs is restricted. Retention is determined by the Privacy Policy and investigation needs.

10.4. Logs are minimized and must not include passwords, full payment details or plaintext tokens.

10.5. Detected anomalies may temporarily restrict a session or installation, with the option to contact support.

11.1. Software changes are verified to an extent proportionate to risk.

11.2. Dependencies and core components are updated with regard to known vulnerabilities and compatibility.

11.3. Production access is separate from ordinary user activity.

11.4. Configurations are checked before release to prevent accidental disclosure of keys and internal data.

11.5. Errors must not disclose internal secrets or another person's data to the User.

11.6. The Operator maintains procedures for restoring availability and integrity to the extent supported by the Service architecture.

12.1. Providers are engaged under contracts and only to the necessary extent.

12.2. Main provider categories are:

• Timeweb Cloud: server infrastructure and object storage;
• Yandex.Cloud LLC: service email delivery;
• Cloudflare: form protection through Turnstile;
• YANDEX LLC: analytics after consent is obtained.

12.3. Current provider documents: https://replaybox.ru/legal/personal-data#section-12.

12.4. Providers are subject to applicable confidentiality, security, deletion and incident assistance requirements.

12.5. Before engaging a provider, the Operator assesses the processing location, purpose, data access and necessary contractual terms.

13.1. Retention periods for each purpose are defined in the Privacy Policy: https://replaybox.ru/legal/privacy.

13.2. When retention expires, active access ends and data is deleted, destroyed or de-identified.

13.3. Automatic deletion is used where technically possible; other operations follow established procedures.

13.4. If immediate destruction is impossible, data is blocked until deletion is complete.

13.5. Destruction is confirmed in the cases and form required by legislation.

13.6. Data required for accounting, legal compliance or disputes is separated from active profiles and retained only to the necessary extent.

14.1. Incident indicators may include unauthorized access, disclosure, alteration, destruction, loss of availability or compromised secrets.

14.2. During an incident, the Operator:

• records the report;
• limits further impact;
• preserves necessary technical information;
• identifies affected systems and data;
• eliminates the cause and consequences;
• assesses potential harm;
• notifies the competent authority and data subjects in the cases and periods required by law;
• documents investigation results.

14.3. Incident reports should be sent to support@replaybox.ru with the subject “Security”.

14.4. Users must not publicly disclose active keys, tokens or personal data when reporting a vulnerability.

15.1. Users may obtain processing information and request correction, blocking, cessation or deletion where provided by law.

15.2. Requests should be sent to support@replaybox.ru or the Operator's postal address.

15.3. Before disclosing data, the Operator may verify the applicant's identity in a reasonable, proportionate manner.

15.4. Users may manage content and sessions through available account features.

15.5. Detailed rights procedures are provided in the Privacy Policy: https://replaybox.ru/legal/privacy.

16.1. The Operator periodically checks actual processing against documentation and legal requirements.

16.2. Feature changes are assessed for additional data, retention and consent needs.

16.3. Persons with access are informed of confidentiality and secure processing requirements.

16.4. Identified violations are remedied and documents and technical measures are updated.

16.5. The Operator may engage specialists to conduct checks subject to confidentiality.

17.1. The Policy applies from 20 September 2026.

17.2. The current version is available at https://replaybox.ru/legal/personal-data.

17.3. Previous versions are archived at https://replaybox.ru/legal/personal-data#versions.

17.4. Privacy Policy: https://replaybox.ru/legal/privacy.

17.5. Personal Data Processing Instructions: https://replaybox.ru/legal/data-processing.

17.6. Information security questions should be sent to support@replaybox.ru.