Personal data processing policy

1. Operator

1.1. The personal data operator is Кубарский Александр Вячеславович (Kubarskii Aleksandr Vyacheslavovich), taxpayer ID (INN) 781152376151, self-employed, payer of the professional income tax (the "Operator"). Contact email: info@inquir.org.

1.2. The Policy applies to data the Operator receives through https://inquir.org and its subdomains, the Inquir Compute console, CLI and API, and the Inquir ID account service (together, the "Service").

1.3. By using the Service, you confirm that you have read this Policy. It is publicly available at https://inquir.org/privacy.

2. What data we process

• Account data: email address, name or display name (if you provide one), and your password, stored only as a cryptographic hash; if you sign in through an external identity provider, the identifier and email it passes to us.
• Usage data: the workspaces, projects, applications and functions you create, their settings, event logs and resource consumption metrics (invocations, CPU, memory, storage).
• Technical data: IP address, browser and device type (user agent), date and time of requests, cookies and similar identifiers, request logs.
• Browser error reports: the type and text of an error (tokens, passwords and email addresses in it are masked), the stack trace, the page address and the addresses of recent Service requests without query parameters, the browser type, the Service version, and the IP address, which is stored only in anonymised form. The reports are kept on the Operator's servers; page and form contents are not sent.
• First-touch source: the address of the first public page of the website you opened, without query parameters, the domain name of the site you came from, the values of the utm_source, utm_medium, utm_campaign and utm_content tags, the template parameter of that page's address, and the date and time of that visit. Until you sign in to the Service they are kept only in your browser (Section 6); at the first sign-in they are sent to the Operator once and stored with your account. They never include your email address, device identifiers or IP address.
• Payment data: the plan, amount, currency, date and status of a payment, the payment ID at the payment service, whether a payment method is saved for auto-renewal and, if the payment service passes them, the card type and the last 4 digits of the card number. The Operator never receives or stores the full card number, expiry date or CVC/CVV: the payment service processes them.
• Correspondence: support requests and our replies.

2.1. The Operator does not process special categories of personal data or biometric data.

2.2. Code, files and data that users host on the platform (including personal data of third parties) are processed by the Operator on the user's behalf and only to run them on the platform. The user is the operator of such data.

3. Purposes and legal bases

• Registration and authentication, access to the Service and performance of the contract (the public offer, the terms of use) — Article 6(1)(5) of the Law (performance of a contract to which the data subject is a party).
• Accepting payments, subscription auto-renewal, refunds, issuing receipts in the "Moy Nalog" app — Article 6(1)(5) of the Law and legal obligations (Article 6(1)(2) of the Law, Federal Law No. 422-FZ).
• Service notices: email confirmation, upcoming charge notices, payment confirmations, changes of terms, maintenance — Article 6(1)(5) of the Law.
• Security and abuse prevention, incident investigation, answering requests — the Operator's legitimate interests (Article 6(1)(7) of the Law).
• Diagnosing Service failures: collecting and analysing browser error reports to fix them — the Operator's legitimate interests (Article 6(1)(7) of the Law).
• Evaluating acquisition channels: which website pages, referring sites, campaigns and templates lead to sign-ups and use of the Service, by first-touch source — the Operator's legitimate interests (Article 6(1)(7) of the Law).
• Traffic statistics for the public pages of the website using analytics cookies (Google Analytics) and the Yandex Metrica service, improving the Service — your consent (Article 6(1)(1) of the Law), issued as a separate document, the Consent to personal data processing for web analytics. You give it by clicking "Accept" in the cookie banner and can withdraw it at any time (Section 6).
• Traffic statistics for the public pages of the website without analytics cookies (Google Analytics in Google Consent Mode: before consent, after declining or after withdrawal, Section 6) — the Operator's legitimate interests (Article 6(1)(7) of the Law).

3.1. The Operator makes no decisions with legal effects for users based solely on automated processing and does not send marketing emails without separate consent.

3.2. How data is processed. Data subjects: website visitors, registered users, Customers. Actions: collection, recording, systematisation, accumulation, storage, clarification (update, change), retrieval, use, transfer (provision, access), anonymisation, blocking, deletion, destruction. Method: mixed (automated and manual), with transfer over the Internet.

4. Sharing data with third parties

4.1. The Operator does not sell personal data. Data is shared or entrusted for processing only as needed for the purposes above, with the following categories of recipients:

• hosting and infrastructure providers whose servers run the Service;
• payment services: YooKassa (NCO YooMoney LLC) for payments in roubles; lava.top (LAVALANE LTD, Republic of Cyprus) for payments in foreign currencies, if you use them;
• an email delivery service, for service emails;
• the web analytics services Yandex Metrica and Google Analytics, on the public pages of the website and never with console data: Yandex Metrica only with your consent; Google Analytics for all visitors, without analytics cookies until you consent (Section 6);
• public authorities, where required by law.

4.2. Parties entrusted with processing must keep personal data confidential and secure.

5. Storage location and cross-border transfer

5.1. The Inquir Compute platform servers are located in the Russian Federation and in the Netherlands. The Inquir ID account service is hosted by a cloud provider outside the Russian Federation. For foreign-currency payments, the lava.top payment agent processes data outside the Russian Federation.

5.2. Part of the personal data is therefore transferred outside the Russian Federation, including to the Netherlands, a party to the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, and to other countries where the providers listed in Section 4 are located. Cross-border transfer follows Article 12 of the Law and is limited to what the purposes require.

6. Cookies and analytics

6.1. The website uses necessary cookies: the session and request-forgery protection for signing in and in the console, the chosen language and theme, and a record of your choice in the cookie banner (kept for 12 months). The website cannot work without them, so no consent is asked for them.

6.2. Google Analytics runs on the public pages of the website for all visitors. Until you click "Accept" in the cookie banner, and after you click "Decline", Google Analytics works without analytics cookies (Google Consent Mode) and receives only cookieless signals, and Yandex Metrica is not loaded. Analytics cookies are used only after you click "Accept", on the terms of the Consent to personal data processing for web analytics: Google Analytics then uses analytics cookies and Yandex Metrica is loaded. Declining does not limit access to the website. Analytics receives the page address without personal parameters; analytics does not run in the console or on sign-in pages; session recording (Webvisor) is not used.

6.3. You can change your choice or withdraw consent to analytics at any time with the "Cookie settings" link at the bottom of the website's pages. After withdrawal Google Analytics works without analytics cookies again, Yandex Metrica is no longer loaded, and analytics cookies set on the website's domain and Yandex Metrica data in the browser's local storage are deleted. The banner is shown again 12 months after your choice.

6.4. You can also block or delete cookies in your browser settings. Blocking necessary cookies may break signing in.

6.5. When you open a public page of the website, the first-touch source (Section 2) is saved in the browser's local storage (localStorage, key inquir_first_touch): the page address without parameters, the referring site's domain name, the utm tags, the template parameter and the date and time of the visit. This record holds no identifiers and is not shared with third parties; at your first sign-in to the Service it is sent to the Operator once, after which the browser keeps only a note that it was sent. If you clicked "Decline" in the cookie banner, no record is created and an unsent one is deleted. You can also delete it by clearing the website's data in your browser settings.

7. Retention

• Account and usage data: until the account is deleted and no longer than 30 days after that (backup rotation). Accounts with an unconfirmed email address may be deleted automatically after a period the user is notified of in advance.
• Payment data and receipt records: 5 years after the end of the year of payment, to meet tax law requirements and to protect rights in a dispute.
• Technical logs: no longer than 12 months.
• Browser error reports: no longer than 90 days.
• First-touch source: in the browser until the first sign-in, but no longer than 90 days; with the account, as long as the account data.
• Correspondence: until the request is resolved and no longer than 3 years.

7.1. When the purposes are achieved, consent is withdrawn (where processing is based on consent) or the periods expire, data is destroyed or anonymised unless the law requires otherwise. Data is deleted from the databases; destruction is confirmed by a log record (log export) under the Requirements approved by Roskomnadzor Order No. 179 of 28.10.2022.

8. Your rights

8.1. You may: obtain information about the processing of your personal data; demand that it be corrected, blocked or destroyed if it is incomplete, outdated, inaccurate, unlawfully obtained or not needed for the stated purpose; withdraw consent where processing is based on consent; and appeal the Operator's actions to Roskomnadzor or a court.

8.2. To exercise your rights, email info@inquir.org from your account email address. The Operator replies within 10 business days of receipt; the period may be extended by up to 5 business days with an explanation (Article 20 of the Law).

8.3. You can have your account deleted by emailing info@inquir.org. Data the Operator must keep by law (such as payment records) is kept for the periods in Section 7.

9. Security

9.1. The Operator takes legal, organisational and technical measures to protect personal data from unauthorised access, destruction, alteration, blocking, copying and disclosure: encrypted connections (HTTPS/TLS), passwords stored only as hashes, restricted access to servers and databases, backups and access logging.

9.2. The Operator notifies Roskomnadzor and affected users of incidents involving unlawful disclosure of personal data as and when the Law requires.

10. Children

10.1. The Service is intended for people aged 18 and over. The Operator does not knowingly process children's personal data. If you believe a child has given us their data, email info@inquir.org and we will delete it.

11. Changes to this Policy

11.1. The Operator may change this Policy. A new version is published on this page with its effective date; registered users are notified of material changes by email.

12. Contacts

• Operator: Кубарский Александр Вячеславович (Kubarskii Aleksandr Vyacheslavovich), INN 781152376151, self-employed, payer of the professional income tax
• Email: info@inquir.org

The details are also published on the Seller details page.

13. Version history

• Version 1.5 of October 18, 2026: the first-touch source and the purpose "evaluating acquisition channels" added (Sections 2, 3, 6 and 7).
• Version 1.4 of October 17, 2026: browser error reports and the purpose "diagnosing Service failures" added (Sections 2, 3 and 7).
• Version 1.3 of October 12, 2026: Google Analytics runs on the public pages of the website for all visitors, without analytics cookies before consent (Google Consent Mode); analytics cookies and Yandex Metrica only after consent in the cookie banner (Sections 3, 4 and 6).
• Version 1.2 of October 9, 2026: analytics loads only after consent in the cookie banner, issued as a separate document; the consent can be withdrawn at any time (Sections 3, 4, 5 and 6).
• Version 1.1 of October 8, 2026: the first published version.