Privacy policy

Version dated July 26, 2026

1. Controller

Personal data controller: Kiuru Sviatoslav Sergeevich, taxpayer identification number 100502601135. Contact for data requests: support@nextalk.chat.

2. Data processed

• name supplied in a request;
• email used for access, instructions, receipts, and support replies;
• network type, provider or operator, and selected devices;
• access status, expiry date, payment status, and aggregate technical traffic volume;
• for auto-renewal: selected plan, consent date and technical consent information, type and masked name of the saved payment method, and its YooKassa identifier;
• support conversations, notification settings, and technical security events;
• a shortened irreversible network-address hash used to protect forms from abuse; the original address is not retained in the request or support record.

3. Data not collected

• browsing history;
• the contents of transmitted traffic;
• full page URLs;
• personal files or messages;
• full bank card number, expiry date, or security code.

4. Purposes and legal bases

Data is used to review requests, enter into and perform the agreement, issue access, operate the account, send instructions, provide support, record payments, issue receipts, operate voluntarily enabled auto-renewal, send expiry notifications, and protect the service.

Legal bases include consent, entering into and performing a contract, tax and accounting obligations, and the controller's legitimate interest in protecting the service from abuse.

5. Processing operations

The controller collects, records, organises, accumulates, stores, corrects, retrieves, uses, transfers to processors as necessary, restricts, deletes, and destroys data using automated means.

6. Storage and retention

• The primary request, account, payment metadata, and support database is stored on a server in the Russian Federation.
• Unused one-time codes are deleted after expiry; active sessions expire no later than 30 days after creation.
• Rejected requests are retained for up to 30 days and closed support conversations for up to 180 days.
• Active account data is retained while the service is supplied and for up to 30 days after a verified deletion request unless a longer period is required by law.
• Payment, receipt, and refund information is retained as required for tax records and protection of the parties' rights, but no longer than five years unless the law requires otherwise.
• Technical aggregate traffic history is retained for up to 75 days.

When a purpose is achieved, data is deleted or anonymised. Backups are encrypted and removed according to the retention cycle.

7. Processors and transfers

• YooKassa — payments, refunds, and saving a payment method with separate consent;
• the Russian Federal Tax Service and “My Tax” — issuing and recording receipts;
• Resend — service email delivery;
• Telegram — only when the user communicates with the bot or enables Telegram notifications;
• hosting providers — protected infrastructure and network nodes.

Resend, Telegram, and some technical nodes may be located outside the Russian Federation. Transfers are limited to what is necessary for the selected function, use protected channels, and follow applicable cross-border transfer requirements. Primary recording and storage of the user data listed in section 6 takes place in the Russian Federation.

8. Security

Measures include access controls, encrypted connections, separate secret storage, restricted file permissions, backups, service-health monitoring, and security-event logging. Full payment credentials are not provided to the controller. Personal links are not published and can be reissued if compromised.

9. Cookies

The account uses strictly necessary secure cookies for sign-in sessions lasting up to 30 days and referral attribution. Advertising and analytics cookies are not used.

10. User rights

A user may request information about processing, access, correction, restriction, or deletion, and may withdraw consent by emailing support@nextalk.chat. Identity may be verified before a request is fulfilled. Data required by law is deleted after the mandatory retention period.

11. Changes

The current version is published at this address. For material changes, the controller updates the version date and requests new consent where required.