Personal Data Processing Policy

This Personal Data Processing Policy (the “Policy”) sets out the procedure for processing personal data and the measures to ensure its security taken by the operator of the SmartFin service (the “Operator”) in relation to the users of the service available at smartfinai.app (the “Service”).

The Policy has been prepared in accordance with the Constitution of the Russian Federation, Federal Law No. 152-FZ of 27 July 2006 “On Personal Data” (“152-FZ”) and other regulatory legal acts of the Russian Federation in the field of personal data. The Policy applies to all personal data that the Operator may receive from a user in connection with use of the Service.

1. Operator’s Details

• Operator: Иванов Георгий Александрович
• Status: an individual — a payer of the tax on professional income (self-employed)
• INN (taxpayer identification number): 645392361077
• Telephone: +7 987 359-33-53
• E-mail address for enquiries on the processing of personal data: ivanovgeorgiy000@gmail.com

2. Basic Concepts

The concepts used in the Policy have the meanings defined in Article 3 of 152-FZ: personal data means any information relating to a directly or indirectly identified or identifiable individual (the data subject); processing of personal data means any action or set of actions performed with personal data (collection, recording, systematisation, accumulation, storage, clarification, use, transfer, depersonalisation, blocking, deletion, destruction); data subject means a user of the Service to whom the personal data relates.

3. Legal Grounds for Processing

The Operator processes personal data on the following legal grounds:

• the data subject’s consent to the processing of personal data (clause 1, part 1, Article 6 of 152-FZ), given in the manner described in Section 11;
• performance of a contract (the Public Offer and Terms of Use) to which the data subject is a party (clause 5, part 1, Article 6 of 152-FZ);
• the exercise of the rights and legitimate interests of the Operator, including to ensure the security of the Service, provided the data subject’s rights are not infringed (clause 7, part 1, Article 6 of 152-FZ);
• performance of obligations imposed on the Operator by the legislation of the Russian Federation.

4. Purposes of Personal Data Processing

• registration, identification and authentication of the user, and provision of access to the Service;
• provision of the Service’s features: aggregation and analytics of the investment portfolio and display of data from connected sources;
• confirmation of the e-mail address and sending of service notifications;
• ensuring security, preventing fraud and unauthorised access, and keeping event logs;
• handling the user’s enquiries and providing technical support;
• providing artificial-intelligence-based features at the user’s request;
• concluding and performing a contract for paid services (the Plus Plan): taking out and renewing the subscription, accepting payment and recurring payments, generating and sending receipts, notices of upcoming charges, and refunds;
• analysis of attendance and of the use of the Service’s sections and features in anonymised form — to understand which capabilities are in demand and to improve the operation and usability of the Service;
• improving the quality and functionality of the Service;
• compliance with the requirements of the legislation of the Russian Federation.

5. Categories of Data Subjects and the Data Processed

The Operator processes the personal data of users of the Service. Depending on the features used, the following categories of data are processed:

5.1. Account data

• e-mail address;
• password in protected (hashed) form;
• name / display name (if provided by the user);
• when signing in with Google — the Google account identifier, e-mail address, name and profile picture provided by Google.

5.2. Technical and session data

• IP address, information about the device and browser (User-Agent);
• session identifiers and cookies (see Section 9);
• date, time and history of sign-ins, and logs of actions and security events.

5.3. Financial and portfolio data entered or connected by the user

• information on portfolio composition: assets, quantities, transactions, operations, balances, valuations, base currency;
• access tokens (API keys) to connected sources — brokers and crypto exchanges — provided voluntarily by the user and stored in protected form;
• data entered manually by the user.

This information is confidential financial information. The Operator does not request or process special categories of personal data (concerning health, racial or national origin, political, religious or other beliefs) or biometric personal data. Please do not enter such data in the Service’s free-text fields.

5.4. Enquiry data and requests to AI features

• the content of support enquiries and correspondence;
• the text of requests that the user sends to artificial-intelligence-based features.

5.5. Service usage data (attendance and action analytics)

For the purposes stated in Section 4, the Operator keeps anonymised statistics on the use of the Service by authenticated users. For this purpose the following are recorded:

• the fact that sections and pages of the Service were visited, in aggregated form — without saving query parameters and identifiers from the address bar (for example, a specific asset or portfolio);
• the fact that key actions were performed in the Service, in aggregated form (for example, “company analytics section opened”, “alert created”, “message sent to the AI assistant”, “source connected”) — only the type of action and small technical labels are recorded, without amounts, request text or other personal or financial data;
• a generalised device category (for example, “computer” or “mobile device”) — without saving the full User-Agent string;
• the date and time of the event.

For attendance analytics purposes, the IP address and the full User-Agent string are not stored, and no third-party advertising or tracking services are used. Such statistics are collected only for authenticated users. The raw visit records are kept for a limited period (as a general rule no more than 90 days), after which only anonymised aggregated indicators remain (the number of visits and the number of unique users by section of the Service), which do not allow a specific data subject to be identified. This processing is carried out on the basis of the Operator’s legitimate interest in ensuring that the Service works and in developing it and/or the data subject’s consent (Section 11).

5.6. Payment data (when taking out the Plus Plan)

• the selected plan and billing period, the start and end dates of the subscription, the auto-renewal status, and information on consent to and withdrawal from auto-renewal;
• the amount, date, status and identifiers of payments and refunds, received from the payment service;
• a masked bank card number (no more than the first 6 and last 4 digits) and the payment system — if provided by the payment service.

The full bank card number, its expiry date and the CVC/CVV code are entered on the payment service’s page and are not passed to the Operator and are not stored by the Operator.

6. Procedure and Methods of Processing

Personal data is processed with and without the use of automation tools. The Operator does not make decisions that produce legal consequences for the data subject solely on the basis of automated processing. The Operator does not use personal data for purposes incompatible with those stated in Section 4.

7. Disclosure of Personal Data to Third Parties

The Operator does not sell personal data. Data is disclosed to third parties only to the extent necessary for the Service to function, on the basis of an engagement to process data (Article 6 of 152-FZ) with confidentiality ensured, or in cases expressly provided for by legislation. The categories of persons engaged:

• Hosting (infrastructure): JustHost — a virtual server in Amsterdam (the Netherlands) on which the Service and its database run;
• Cloudflare — delivery and protection of the website (CDN / proxy): all traffic of the website smartfinai.app passes through the Cloudflare network, which processes the requests and responses passing through it, including the IP address and traffic-routing data, in order to deliver pages and protect against attacks. Cloudflare Privacy Policy;
• Cloudflare Turnstile — a check that a person, not a program, is filling in a form: at registration (on the website and in the App) and when the form on the support page is submitted. Cloudflare receives the IP address, the TLS fingerprint, the User-Agent header, the site key and its origin (according to Cloudflare, it cannot directly identify an individual from these signals); the Operator sends Cloudflare the result token and the IP address in order to confirm the check. The purpose is protection against automated registration and spam. According to Cloudflare, for the check itself it acts as a processor on the Operator’s instructions, and to improve bot detection it acts as a controller in its own right. Cloudflare Privacy Policy; Turnstile Privacy Addendum;
• Google authentication service — when signing in with Google is used;
• Sign in with Apple (Apple) — when signing in with Apple in the App: Apple passes the user identifier, the e-mail address (including a private-relay address) and the name, if you allowed it; the Operator exchanges the one-time code received from Apple for a refresh token (stored in encrypted form) and revokes it when the account is deleted;
• Connected sources (brokers, crypto exchanges) — exchange of data at the user’s initiative within the connection;
• TON blockchain data providers (TonAPI, TonCenter) — when a TON wallet is connected, the wallet address is sent to them in order to obtain the balance and transaction history (read-only);
• Bitcoin blockchain data providers (mempool.space, Blockstream — blockstream.info) — when a Bitcoin wallet is connected by its extended public key (xpub), the Operator derives the wallet’s addresses from the key and sends these addresses to the providers in order to obtain the balance and transaction history (read-only). The xpub itself is stored by the Operator in encrypted form and is not sent to the providers; from the set of requested addresses a provider can link them together as one wallet;
• Artificial intelligence technology providers — when AI features are used, to process the user’s requests: the gateway OpenRouter, through which the request is sent to model developers and hosts — OpenAI (including via Microsoft Azure) and, for explanations of portfolio changes that use web search, Perplexity. The text of the request and the portfolio context needed for the answer (positions, transactions, metrics) are sent; the e-mail address, username, full name and telephone number are excluded from that context. On “Smart import (AI)” — Section 15;
• Payment service OOO ROBOKASSA (Robokassa) — to accept payment, carry out recurring payments and refunds, and generate receipts: the user’s e-mail address, and the amount and purpose of the payment; the user provides bank card data to the payment service directly;
• Federal Tax Service of Russia — payment information to the extent necessary to generate a receipt under Federal Law No. 422-FZ of 27 November 2018 (amount, date, name of the service);
• E-mail: Timeweb — sending of service and confirmation messages (the recipient’s address and the text of the message);
• Sentry (servers in the United States) — error reports from the website and the server side: the type of error, the call stack, the page address, and browser and device information. Sending personal data by default (the user’s IP address, cookies, request headers and bodies) is switched off in the Service’s settings;
• TradingView — chart widgets on the website (the App has none): when you open a page with a chart, your browser loads the widget directly from TradingView’s servers, and TradingView receives the IP address, browser information and the instrument symbol.

Disclosure to state authorities is made on the grounds and in the manner established by the legislation of the Russian Federation.

8. Cross-Border Transfer and Localisation of Data

The list of foreign states to whose territory the transfer may be made is disclosed to the data subject on request. Cross-border transfer to states that do not provide adequate protection of data subjects’ rights is carried out only with the data subject’s written consent or on other grounds provided for by part 4, Article 12 of 152-FZ.

9. Cookies

The Service uses cookies and similar technologies that are necessary for it to work, primarily for authentication and maintaining the session (including when the “Remember me” option is selected), and also to ensure security. The Service cannot work without the necessary (technical) cookies. You can manage cookies using your browser; disabling some files may limit functionality.

10. Retention Periods and Conditions; Termination of Processing

• personal data is kept no longer than the purposes of processing require, or for the period established by legislation;
• account data is processed for as long as the account exists;
• if, within 6 (six) months after the end of the trial period or of the last paid subscription, the user has not purchased a subscription, the account and the personal data associated with it are deleted, except for data on payments and refunds, which is kept for the period stated in the next item, and information that the Operator is required by law to keep; no later than 14 (fourteen) calendar days before the deletion, the Operator sends the user a notice by e-mail;
• data on payments and refunds is kept for 3 (three) years from the date of payment — to perform the contract, consider claims and protect the parties’ rights, or for longer if the law so requires;
• when an account is deleted, personal data is to be deleted or anonymised, except for information that the Operator is required by law to keep;
• processing ends when its purposes are achieved, when consent is withdrawn (in the absence of other legal grounds), or at the data subject’s request in the cases established by law.

11. Consent to Processing and Its Withdrawal

By registering in the Service and/or continuing to use it, the data subject confirms consent to the processing of their personal data on the terms of this Policy, including consent to cross-border transfer to the extent described in Section 8. Consent is given freely, of the data subject’s own will and in their own interest.

The data subject may withdraw consent by sending a request to the Operator’s e-mail address (Section 1). After consent is withdrawn, the Operator stops processing unless there are other legal grounds for continuing it; withdrawal of consent may make it impossible to use the Service.

12. Rights of the Data Subject

In accordance with Articles 14–16 of 152-FZ, the data subject has the right to:

• obtain information about the processing of their personal data and access to it;
• demand that the data be clarified, blocked or destroyed if it is incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the purposes of processing;
• withdraw consent to processing;
• object to processing and appeal the Operator’s actions or inaction;
• apply to the authorised body for the protection of the rights of personal data subjects (Roskomnadzor) or to a court.

To exercise these rights, send a request to the Operator’s e-mail address. The Operator considers the request and provides a response within the time limits established by 152-FZ. The Operator may request information to confirm the applicant’s identity.

13. Security Measures

The Operator takes the necessary legal, organisational and technical measures to protect personal data against unlawful or accidental access, destruction, alteration, blocking, copying, dissemination and other unlawful actions, in accordance with Articles 18.1 and 19 of 152-FZ. Such measures include, in particular: access control, storage of passwords in hashed form and protected storage of access tokens, encryption of data in transit, keeping event logs, and regular assessment of the protective measures.

14. Mobile App (iOS)

The Policy also applies to the SmartFin mobile app for iOS (the “App”). The App works with the same account and the same data as the web version of the Service; this Section clarifies the data and permissions that relate specifically to the App.

14.1. What data the App processes

• e-mail address and user (account) identifier; when signing in with Apple or Google — the data passed by the relevant service (identifier, e-mail address, name);
• device identifier (the X-Device-Id header) — a random value that the App creates on installation. It is not an advertising identifier (IDFA), it does not allow you to be tracked in other apps and on other websites, and it is used for the operation and protection of sessions;
• financial data that you enter or connect: positions, transactions, broker reports, API keys and access tokens for connected sources (stored in protected form), TON wallet addresses;
• feedback form data: name, e-mail address and message text; at your option, the App version and the iOS version are added to the text;
• the session IP address — stored in the session log for security purposes; no location is stored from it;
• at registration in the App — the Cloudflare Turnstile check (protection against automated registration): Cloudflare receives the IP address and device and browser information (see Section 7 for details). The Operator receives nothing from Cloudflare except the result of the check.

All of this data is linked to your account and is processed only for the operation of the App and for providing support. It is not used for tracking, is not shared for advertising and is not sold.

14.2. Device permissions

• Camera — only to scan the QR code of a wallet address. The image is processed on the device and is not sent to the Operator; the address can be entered manually.
• Face ID — the check is performed by iOS itself. The App receives only the result (“confirmed” or not); biometric data is not passed to the App or to the Operator and is not stored anywhere.

14.3. Third-party SDKs

The App contains no advertising, tracking, analytics or crash-reporting SDKs. The Cloudflare Turnstile check at registration opens as a web page in an embedded window, not as an SDK.

14.4. Account deletion

In the App: “Settings” → “Delete account”. Deletion starts with a 7-day delay, during which it can be cancelled by signing in to the account; the data is then deleted or anonymised as described in Section 10. For more details, see the support page.

15. Smart Import (AI)

“Smart import (AI)” is a way to upload a broker report whose format has no dedicated parser: artificial intelligence finds the transactions in the report text so that they can be added to your portfolio. It is the only import method in which the contents of your file are sent to an external provider.

• With AI: on the website — “Smart import (AI)” and “My broker isn’t listed”; in the App — “Smart import” and “Another broker”.
• Without AI: broker reports from the list and the CSV template — “Your own spreadsheet (CSV)” on the website and “SmartFin format (CSV)” in the App. They are parsed by the Service itself and are not sent to anyone.

15.1. To whom, what and when data is sent

• To whom. To an intermediary service, OpenRouter (openrouter.ai), which forwards the request to a provider of the language model: its developer OpenAI or Microsoft Azure, which hosts OpenAI’s models. The chain is OpenRouter → OpenAI or Microsoft Azure; at the time of this edition of the Policy the model openai/gpt-5.4-mini is used.
• What. The text extracted from the uploaded file (PDF, Excel, CSV or HTML) — without prior filtering; any part of the report beyond the technical size limit is not sent, and you will receive a warning about this. As a rule this is transactions, tickers, quantities, prices, amounts and the account number, if it is stated in the report. If the report contains other information (for example, the account holder’s full name), that will be sent too. The file itself is not forwarded — only the extracted text and a service instruction for the model; the e-mail address, name and other data of your account are not sent.
• Why. Only to recognise the report’s transactions for import into your portfolio. The Operator uses the model’s response only to produce the list of transactions.
• When. Only if you yourself have chosen one of the methods with AI (see above) and uploaded a file; in the App a consent request is shown every time before you choose a file. Parsing is performed at the preview stage and is repeated when the import is confirmed, so the text is sent to the provider at each of these steps.
• How to opt out. Do not choose the methods with AI. The alternative without AI is “Your own spreadsheet (CSV)” on the website and “SmartFin format (CSV)” in the App: download the template, fill it in and import it; nothing is sent to external providers.

15.2. What the Service stores

• In normal operation the report text is not stored: the file and the text extracted from it are processed in memory for the duration of the request and are not written either to the database or to file storage.
• In normal operation the text of the request to the AI and the model’s response are not stored; the logs contain only the model name and the cost of the request.
• After you confirm, the recognised transactions (date, type, instrument, quantity, price, currency, fee) are written to the selected portfolio — they are stored in the same way as the rest of the portfolio data (Sections 5.3 and 10). Service data is stored with them: a note of the import method and the report row number, a service identifier (hash) that protects against adding the same transactions again, and a source name of the form “Broker report · account …1234” (the last 4 characters of the account number from the report, if it is stated).

15.3. AI providers, data protection and cross-border transfer

The providers named below (OpenRouter, OpenAI and Microsoft Azure) are located outside the Russian Federation, so sending the report text is a cross-border transfer (Section 8). The report text is sent only to recognise transactions (paragraph 15.1); the Operator does not sell this data (Section 7).

What the providers’ official terms say about the handling of data (verified in October 2026; the providers’ terms may change — the current versions are at the links):

• OpenRouter (the gateway): according to its documentation, the content of requests and responses is not stored unless the OpenRouter account holder has itself turned on request logging or the use of requests by OpenRouter itself (both are off by default); only service information about the request (for example, the number of tokens and latency) is stored, without the content. OpenRouter uses a small sample of requests for anonymised categorisation that is not linked to the account. OpenRouter documentation.
• OpenAI (the model developer): under OpenAI’s terms, data sent through the API is not used to train or improve its models (unless the customer has itself opted in); abuse-monitoring logs are created by default and kept for up to 30 days (longer where required by law or reasonably necessary to protect the services or third parties). OpenAI documentation.
• Microsoft Azure (an alternative host of OpenAI models): OpenRouter may send the request to Azure instead of OpenAI. Under Microsoft’s terms, prompts and completions are not used to train foundation models without the customer’s permission; by default, however, abuse monitoring applies, under which a sample of prompts and completions may be stored for review unless the customer has been approved for modified abuse monitoring. OpenRouter classes the Azure endpoints for the model in use (openai/gpt-5.4-mini) as zero-data-retention endpoints; OpenAI’s own endpoints are not on that list. Microsoft documentation; OpenRouter’s list.

An important limitation. The Operator does not tell OpenRouter which provider to use: OpenRouter chooses among those available for the model (for OpenAI models, OpenAI or Microsoft Azure). It is therefore not possible to guarantee in advance which of them will process a request, and the retention period is governed by the terms of the provider that processed it: for OpenAI, up to 30 days (abuse-monitoring logs), and for Azure as described above. The Operator has no access to the providers’ systems and cannot itself verify how they comply with their terms.

If you do not agree with such a transfer, do not use the import methods with AI.

16. Amendments to the Policy

The Operator may amend this Policy. The current version is posted at smartfinai.app/legal/privacy and takes effect from the moment of posting unless otherwise stated. We recommend that you review the current version periodically.