The Russian version of this document is legally binding. Read the Russian version

Personal Data Processing Policy

Version 2.0.0 · In effect since October 24, 2026

This Policy (the “Policy”) sets out what personal data Individual Entrepreneur Nikulin Artem Andreevich (the “Operator”) processes in operating the Polyzon Studio service at https://studio.polyzon.org (the “Service”), for what purposes, on what legal basis, and for how long, to whom the Operator transfers it, and how the Operator protects it. The Policy is issued pursuant to Article 18.1(2) of Federal Law No. 152-FZ of July 27, 2006 “On Personal Data” (the “Personal Data Law”).

1. General provisions

1.1. The Policy applies to all personal data that the Operator processes in connection with the Service, with or without the use of automation.

1.2. Signing in to the Service is done with a polyzon.org account. The Service and polyzon.org belong to the same operator; the processing of account data on polyzon.org is described in the polyzon.org documents.

1.3. Personal data is processed on the legal bases listed in Section 4. No separate consent to processing is required for the Service to work: the processing is necessary to perform the User Agreement and the offer to which the user is a party. If the Operator begins processing that requires consent (for example, marketing emails or analytics), the Operator will request that consent separately from other documents.

2. Operator information

Individual Entrepreneur Nikulin Artem Andreevich
INN (taxpayer identification number): 434547133957, OGRNIP (primary state registration number of an individual entrepreneur): 326430000048653
State registration: July 30, 2026, Federal Tax Service Directorate for the Kirov Region
Mailing address for inquiries: office 1022, 109 Lenina St., Kirov, Russia
Email for inquiries from personal data subjects: support@polyzon.org
The person responsible for organizing the processing of personal data is the Operator personally.

3. Processing principles

The Operator processes personal data:

lawfully and fairly, only for the specific, predefined purposes listed in Section 4;
only to the extent necessary for these purposes, without combining databases whose purposes are incompatible;
ensuring the accuracy of the data and taking measures to delete or correct inaccurate data;
for no longer than the purposes of processing, a contract, or the law require, after which the data is destroyed or de-identified.

4. Purposes, data, legal bases, and retention periods

Purpose	Data	Legal basis	Retention period
Signing in and maintaining the account	Pseudonymous polyzon.org account identifier; email address, name, and profile picture URL, if the user has allowed them to be shared; referral code; creation dates; version and time of acceptance of documents and the IP address at acceptance	Performance of a contract (Article 6(1)(5) of the Personal Data Law)	Until the account is deleted. Records of acceptance of documents: 3 years after deletion (the limitation period), to protect the Operator's rights (Article 6(1)(7))
Providing the Service	Descriptions and messages, uploaded images, photos, and 3D models, created results, history of generations and assistant chats, public links, favorite tools, settings	Performance of a contract (Article 6(1)(5))	Until the user deletes the relevant material or the account
Payments and token accounting	Pack, payment amount, date, and status, YooKassa payment ID, email address for the receipt, token balance transactions	Performance of a contract (Article 6(1)(5)); obligations under the laws on cash register equipment, tax accounting, and bookkeeping (Article 6(1)(2))	5 years after the end of the year in which the transaction took place
Referral program	Referral code, the “inviter–invitee” link, credited tokens; the `studio_ref` cookie	Performance of a contract (Article 6(1)(5))	Until the account is deleted; rewards are kept as part of balance transactions
Support, claims, and feedback	Messages in the “Help” chat and by email, ratings and feedback on assistant replies, information from notices and claims	Performance of a contract (Article 6(1)(5)); the Operator's legitimate interest in improving the Service and protecting its rights (Article 6(1)(7))	Until the account is deleted, but no longer than 3 years after the last message
Security and abuse prevention	IP address, browser data (User-Agent), session key hash, time of sign-ins and requests, rate-limit counters, technical logs	The Operator's legitimate interest in protecting the Service and its users (Article 6(1)(7))	Sessions: until sign-out or expiry (30 days); technical logs: no more than 12 months
Compliance with legal requirements	Information needed to respond to requests from personal data subjects, courts, and authorized bodies	Legal obligation (Article 6(1)(2))	For the period established by law

4.1. Data subjects whose data is processed: users of the Service, visitors to the website, and persons who have sent the Operator an inquiry or a notice.

4.2. The Operator does not process special categories of personal data or biometric personal data: uploaded photos are used only to create images and 3D models on request and are not used to establish anyone's identity.

4.3. The Operator does not purposefully collect information about third parties. If a user uploads a photo of another person, the user must obtain that person's consent (User Agreement, Section 8). Such materials are deleted at the request of the person depicted.

4.4. The Service is not directed at persons under the age of 14. The account of such a person is deleted together with its data at the request of their legal representative or when this fact is discovered.

4.5. The Operator does not make decisions that produce legal consequences for the user based solely on automated processing. The AI providers' automatic filters may refuse a generation; the tokens for such a generation are refunded, and the user may contact support.

5. Processing procedure and conditions

5.1. Processing includes collection, recording, systematization, accumulation, storage, updating, retrieval, use, transfer (provision, access), de-identification, blocking, deletion, and destruction. Processing is carried out mainly by automated means.

5.2. Data is obtained from the user and from polyzon.org at sign-in. Recording, systematization, accumulation, storage, updating, and retrieval of personal data of citizens of the Russian Federation are carried out in databases on servers located in the Russian Federation (Article 18(5) of the Personal Data Law).

5.3. The tools in the “Tools” section run in the user's browser: files uploaded to them are not transferred to the Operator until the user sends a result to the studio, the library, or the assistant.

6. Data transfers

6.1. The Operator transfers personal data only to the extent necessary for the purpose:

to NBCO YooMoney LLC (the YooKassa service, Russia), to accept payments and send cash register receipts: the amount, purchase description, order and user IDs in the Service, and the email address for the receipt. The user enters card details on the YooKassa side; the Operator does not receive them;
to a hosting provider (a data center in Russia), to host the Service and store data on the Operator's instructions;
to AI providers, to fulfill the user's request: OpenRouter, Inc. (USA) and the artificial intelligence models to which it routes the request, as well as Meshy (USA) for 3D models. Only the content of the request is transferred (the description, messages to the assistant, uploaded images and models), without the name, email address, or account identifiers;
to government authorities and courts, in the cases and in the manner established by law.

6.2. The transfer to AI providers is cross-border, to countries that are not on the list of countries ensuring adequate protection of the rights of personal data subjects. It is carried out in accordance with Article 12 of the Personal Data Law and only to perform the contract with the user, at the user's request. Personal data reaches AI providers only if the user includes it in the request. Do not include personal data in descriptions and messages, and upload photos of people only with their consent.

6.3. AI providers process what they receive under their own rules published on their websites. The Operator does not use users' materials to train artificial intelligence models and does not sell personal data.

7. Termination of processing and destruction

7.1. The Operator stops processing and destroys personal data when the purpose has been achieved, when the period set out in Section 4 expires, when consent is withdrawn (if processing was based on consent), when the data subject demands that processing based on legitimate interest be stopped, or when unlawful processing is detected, within the time limits set by Article 21 of the Personal Data Law, as a general rule no later than 30 days.

7.2. Users delete their materials in the Service themselves, in the Library and in the “Account” section; the Operator deletes the entire account on request. Data that the Operator is required by law to keep (Section 4, “Payments and token accounting”) is stored separately until the period expires and is not used for other purposes. Data is deleted from backups when they are overwritten on schedule.

7.3. Destruction is confirmed by a certificate and a log extract in the manner established by Roskomnadzor (the Russian data protection authority).

8. Personal data protection

8.1. The Operator takes legal, organizational, and technical protection measures, including:

sign-in via polyzon.org using the OpenID Connect protocol (authorization code + PKCE): the Service does not receive or store passwords;
storing session keys only as SHA-256 hashes;
encrypting connections with the TLS protocol;
restricting access to data and administrative functions;
protection against brute-force attacks and abuse: rate limiting, CSRF protection, input validation;
regular software updates and remediation of vulnerabilities;
backups and monitoring of compliance with this Policy.

8.2. The Operator notifies Roskomnadzor of any unlawful transfer of personal data that has violated data subjects' rights within 24 hours, and of the results of the investigation within 72 hours (Article 21(3.1) of the Personal Data Law).

9. Rights of the personal data subject

9.1. The personal data subject has the right to:

obtain information about the processing of their personal data;
demand that the data be corrected, blocked, or destroyed if it is incomplete, outdated, inaccurate, unlawfully obtained, or not necessary for the stated purpose;
demand that processing based on the Operator's legitimate interest be stopped, and withdraw consent if processing was based on it;
appeal the Operator's actions to Roskomnadzor or in court, and claim compensation for losses and non-pecuniary damage.

9.2. A request is sent to support@polyzon.org from the account's email address or by letter to: office 1022, 109 Lenina St., Kirov, Russia. The request must include information confirming the relationship with the Operator (for example, the account's email address) and the substance of the demand.

9.3. The Operator responds within 10 business days of receiving the request. This period may be extended by no more than 5 business days by sending a reasoned notice.

10. Cookies

The Service uses only necessary and functional cookies; there are no analytics or advertising cookies. Learn more in the Cookie Policy.

11. Changes to the Policy

11.1. The Operator may change the Policy. A new version takes effect upon publication unless it states otherwise; the Operator announces material changes in the Service.

11.2. The current version is always available at https://studio.polyzon.org/en/legal/data-processing.