Privacy Policy moolt.site

1. What data do we process?

We may process the following categories of data.

1.1. Account details

• email;
• name, display name or profile name;
• password in a technically secure form, for example a password hash;
• user avatar, including an avatar obtained through Google OAuth if the user uses Google sign-in;
• account identifiers and service characteristics of the account;
• one-time codes, tokens or OTP codes for login, email confirmation, access restoration or other security scenarios.

1.2. Authorization and session data

• an authorization token that can be stored in an httpOnly cookie;
• `user` cookie, which can be used to display user data in the interface;
• data on logins, logouts, email changes, access restoration and other actions related to account security.

1.3. Content that a user creates or uploads

• public pages and their settings;
• cards, blocks, texts, links, images, videos, files and other materials uploaded or added by the user;
• public social links and links to external services;
• page design settings, including colors, themes, covers, icons, block order and similar parameters;
• data that the user himself places on a public page.

The user independently determines what information to post on the public page. A user who publishes personal data of third parties is responsible for ensuring that there are legal grounds for such publication.

1.4. Technical data

• IP address;
• user-agent, information about the browser, device, operating system and language;
• date and time of requests;
• addresses of pages visited and technical parameters of requests;
• server logs, errors, security events and diagnostic records;
• data on file downloads and media accesses;
• technical cookies and similar identifiers.

1.5. External service data

If the user uses the corresponding functions, we may process or receive data through external services:

• Google OAuth and Yandex ID: data required for the sign-in method selected by the user, such as the provider account identifier, email and name, to the extent supplied by the provider and required for authorization;
• Mapbox, OpenStreetMap Nominatim and Carto: search queries, addresses, coordinates or other data entered into the map or geocoder, as well as the IP address and technical request data; an external map on a public page is loaded only after functional external services are allowed;
• Sentry: information about errors, failures, environment, device, browser, URL, actions before the error and other diagnostic events;
• Google Analytics, Yandex Metrica or similar analytical tools, if they are connected to the site or to a public page by the page owner.

1.6. Page analytics data

moolt.site may process statistics of visits and actions on pages, including views, transitions, clicks, traffic sources, device and browser technical parameters.

The owner of a public page can connect the owner's own counters from Google Analytics, Yandex Metrica or other analytics systems. In this case, such systems can independently collect data from visitors to a public page according to the rules of the relevant providers and the settings of the page owner.

2. Why do we process data

We process data for the following purposes:

• registration, authorization and account maintenance;
• providing page builder and link-in-bio page functions;
• creating, editing, publishing and displaying public pages;
• downloading, storing and displaying user files and media;
• work of cards, social links, maps, geocoder and other page blocks;
• sending and checking OTP codes, confirmations and service messages;
• ensuring the security of your account and service;
• prevention of spam, abuse, unauthorized access and technical attacks;
• diagnosing errors, monitoring stability and improving service performance;
• processing support requests;
• analysis of product use and functionality development;
• fulfillment of legal requirements, requests from authorized bodies and protection of the rights of the operator, users and third parties.

3. Legal grounds for processing

Depending on the situation, data processing may be carried out on the following grounds:

• user consent, only for the purposes expressly stated in the relevant separate consent;
• conclusion and performance of the user agreement or another contract to which the user is a party, beneficiary or guarantor;
• fulfillment of obligations imposed on the operator by the laws of the Russian Federation;
• exercise of the rights and legitimate interests of the operator or third parties in the cases and within the limits expressly provided for by Clause 7, Part 1, Article 6 of Federal Law No. 152-FZ, provided that the user's rights and freedoms are not violated;
• processing of data made publicly available by the user only where an applicable legal basis exists and subject to the restrictions and conditions on dissemination set by the user.

If the Federal Law of the Russian Federation of July 27, 2006 N 152-FZ “On Personal Data” is applicable to processing, the operator processes personal data taking into account the general requirements of this law, including the principles of legality, limiting processing to the stated purposes, minimizing data and taking reasonable organizational and technical protection measures.

4. Cookie and local storage

moolt.site uses cookies and similar technologies to operate authorization, save interface state, security, analytics and diagnostics.

In particular, the service can use:

• mandatory cookies for logging in and maintaining a session, including cookies with an authorization token;
• cookies or local data with information about the user necessary for the operation of the interface;
• technical identifiers for protection against abuse and error analysis;
• Analytical cookies, if relevant analytics tools are enabled.

The user can limit cookies in the browser settings. In this case, some functions, including logging into your account and working with your personal account, may not work correctly.

5. Publicity of pages and content

Pages published through moolt.site can be accessed by any Internet user via a link or through search engines, if the page is not limited by the settings of the service or the page owner.

Public content may include name, avatar, description, links to social networks, images, files, cards, texts, contact information and other information that the user himself added to the page.

Before personal data is first published on a publicly accessible page, the operator requests a separate consent to process personal data permitted by the user for dissemination. The user may specify the categories of published data and restrictions or conditions for its processing. Acceptance of the Terms or consent to account-data processing does not replace this consent.

Deleting or modifying content on moolt.site does not guarantee immediate removal of copies that may have been stored by search engines, archives, page visitors, external services or third party browsers.

6. Transfer of data to third parties

We do not sell users' personal data.

Data may be transferred or made available to third parties in the following cases:

• hosting providers, infrastructure services, CDN, storage and other technical contractors who ensure the operation of the site and backend infrastructure;
• authorization services, such as Google OAuth or Yandex ID, if the user selects the relevant sign-in method;
• map and geocoding services, including Mapbox, OpenStreetMap Nominatim and Carto, if the user or visitor has allowed the relevant function to load;
• payment services, including YooKassa, banks, fiscal data operators and other payment participants when the user purchases paid features;
• error monitoring services, for example Sentry;
• web analytics services, such as Google Analytics or Yandex Metrica, if such tools are connected;
• support, development, administration and security contractors, if access is needed to maintain the service;
• government agencies, courts or other authorized persons, if the transfer is required by law;
• to third parties when protecting the rights, safety and legitimate interests of the operator, users or other persons.

Personal data is transferred to a foreign recipient only after the requirements of Russian law governing cross-border transfers have been met, including prior notification of Roskomnadzor, an assessment of the foreign recipient and any necessary restrictions. Merely using the Service is not unconditional consent to any cross-border transfer.

7. Data storage

We retain data for as long as necessary for processing purposes, account operation, fulfillment of obligations, security, dispute resolution, and compliance with legal requirements.

Approximately:

• account data is stored while the account is active;
• public content is stored until it is posted by the user or until the account is deleted;
• OTP codes and temporary tokens are stored for a limited time, required for the corresponding scenario;
• server logs, technical events and security records can be stored for a limited period necessary for diagnostics, security and incident investigation;
• backup copies can be stored longer than the main storage period until the end of the cycle of their overwriting or deletion.

8. Deleting an account and files

When an account is deleted, moolt.site deletes associated records from the database, including pages, cards, media records, and user records.

Physical files associated with the user's media and stored in the service's file storage are deleted when an account is deleted, if they are available to the current server implementation of the deletion. Individual technical copies or traces may be temporarily stored in backups, caches, security logs, logs, analytical and diagnostic systems until the end of the applicable retention periods or rewrite cycles.

If a user needs to verify the removal of a specific file or media, they can send a request to privacy@moolt.site with a description of the file, page and account. We will consider such a request and delete or restrict access to the file if this is technically possible and there are no legal grounds for further storage.

9. Security

We take reasonable organizational and technical measures to protect data from unauthorized access, modification, disclosure or destruction.

Such measures may include:

• restriction of access to systems and data;
• use of secure data transmission where applicable;
• storing passwords in a form that does not require storing the original password;
• httpOnly cookie for the authorization token, if provided by the implementation;
• logging security events;
• monitoring of errors and suspicious activity;
• backup and technical administration of infrastructure.

No Internet service can guarantee absolute data security. The user is also responsible for the security of the user's device, email, password and account access.

10. User rights

The user can contact the operator to:

• obtain information about the processing of your personal data;
• clarify, correct or supplement data;
• delete data or account if there are no legal grounds for further storage;
• withdraw consent to processing if processing is based on consent;
• limit certain processing methods, if applicable;
• ask a question about transferring data to external services;
• send a complaint or request related to personal data.

To contact us, use privacy@moolt.site. In your request, please indicate your account email and the nature of your request. To protect your account, we may request additional proof of identity or authority to manage the relevant account.

11. Children's data

moolt.site is not specifically intended for children. A user who has not reached the age at which the user can independently consent to personal data processing and enter into user agreements under applicable law must use the service only with the consent of a legal representative.

If the operator becomes aware that a child's data is being processed without the necessary consent, it will take reasonable steps to delete such data or restrict access to the account.

12. Policy Changes

We may update this Policy if the product, technical implementation, contractors, legal requirements, or data processing practices change.

The current version is published on moolt.site. If the changes are significant, we may notify users in an accessible way, for example through the website, service interface or email.

13. Contacts

For questions regarding the processing of personal data, deleting an account, deleting files, withdrawing consent or exercising user rights, please contact:

• operator: RARAAVIS GROUP LLC;
• registered office: 8 Barclay Street, Filyovsky Park Municipal District, Moscow, Russian Federation;
• email: privacy@moolt.site.