Personal data processing policy
1. Operator
The operator of personal data within the meaning of Article 3 of Federal Law No. 152-FZ "On Personal Data" (the "Law") is OOO "VCorp" — INN [TBD], OGRN [TBD], registered address: Moscow, Russian Federation. The Operator is registered in the Roskomnadzor register of personal-data operators. The official responsible for the organization of personal-data processing can be reached at dpo@vcorp.co.
2. Categories of subjects and data
We process personal data of: (a) Users of vMira, vMira Studio, vMira API, and Mira Code; (b) representatives of corporate clients; (c) candidates and employees; (d) website visitors. The categories of data processed are: identity data (name, email, phone), authentication data, account preferences, content the User submits to the service, technical session data (IP address, device and browser identifiers), payment metadata (without storing full card numbers), and aggregated usage metrics.
3. Purposes and legal basis
Personal data is processed for the following purposes: (i) provision of the service under the Terms (Article 6 §1.5 of the Law — performance of a contract); (ii) fulfilment of legal obligations of the Operator, including tax, accounting, and Anti-Money-Laundering law (Article 6 §1.2 of the Law); (iii) ensuring the security of the service and preventing abuse (Article 6 §1.7 — legitimate interest); (iv) marketing communications, only with separate explicit consent (Article 6 §1.1); (v) processing of cookies that do not contain personal data, on the legal basis described in the Cookie Policy.
4. Data residency in the Russian Federation
In accordance with Article 18 §5 of the Law, personal data of citizens of the Russian Federation is recorded, systematized, accumulated, stored, clarified, and retrieved in databases physically located within the territory of the Russian Federation. Our primary processing region is Moscow with redundant capacity in Saint Petersburg.
5. Cross-border transfer
Cross-border transfer of personal data is performed only on the basis prescribed by Article 12 of the Law and the Roskomnadzor notification regime: (i) to foreign jurisdictions providing adequate protection (per the Roskomnadzor list) — based on legitimate processing grounds; (ii) to other jurisdictions — only with the User's separate written consent or pursuant to a court order. By default, the User's data does not leave the Russian Federation.
6. Storage period
Account data is retained for the duration of the User's account and for three years after deletion, in accordance with the limitation period of the Civil Code of the Russian Federation. Accounting documents are retained for five years (Federal Law No. 402-FZ "On Accounting"). Tax-related data is retained for the period prescribed by the Tax Code. Conversation logs on Pro, Max, Teams, Enterprise, and API plans are not used to train models and are deleted on User request.
7. Rights of the data subject
Pursuant to Article 14 of the Law, the User has the right to: (a) request confirmation of the fact of processing and information about it; (b) demand clarification, blocking, or erasure of personal data; (c) withdraw consent at any time; (d) appeal the actions of the Operator to Roskomnadzor or in court. Requests are submitted to privacy@vcorp.co and are processed within 30 calendar days.
8. Security measures
The Operator applies technical and organizational measures required by Article 19 of the Law and Order of FSTEC of Russia No. 21 (encryption at rest with AES-256 and in transit with TLS 1.3, role-based access control, mandatory MFA for staff, 24/7 SOC monitoring, annual independent audits). Incidents affecting data subjects are notified to Roskomnadzor and to the affected subjects within 24 and 72 hours respectively, in accordance with Roskomnadzor Order No. 187 of 2022.
9. Withdrawal of consent and contact
Consent can be withdrawn at any time by writing to privacy@vcorp.co or by mail to the Operator's registered address with the marking "Withdrawal of consent for personal-data processing". The withdrawal does not affect the legality of processing carried out before the withdrawal.