Privacy Policy
This is a translation provided for convenience. The Russian version is authoritative and prevails in case of discrepancy.
1. General provisions
1.1.This Privacy Policy (the “Policy”) sets out how and on what terms personal data of users of the Wizle Money service (the “Service”), available at https://moneytracker.wizle.tech, is processed and protected.
1.2.The personal data operator is the individual entrepreneur Олейников Анатолий Петрович (taxpayer number (INN) 232908716862, primary state registration number (OGRNIP) 325237500048912), postal address: 350005, Краснодарский Край, Краснодар Город, им. Героя Пешкова ул., дом 14, корп. 4, кв./офис 159, email for personal data enquiries: privacy@wizle.tech (the “Operator”).
1.3.The Policy is drawn up in accordance with Federal Law No. 152-FZ of 27 July 2006 “On Personal Data” (the “Personal Data Law”) and is published under Article 18.1(2) of that law. For users located in the European Union and the European Economic Area, the Operator also complies with Regulation (EU) 2016/679 (General Data Protection Regulation, “GDPR”) to the extent it applies; in that case the Operator acts as the controller.
1.4.The Policy applies to all personal data the Operator obtains through the Service. Use of the Service is also governed by the Terms of Use.
1.5.The Policy uses the following terms:
- personal data means any information relating directly or indirectly to an identified or identifiable natural person (data subject);
- processing means any operation or set of operations performed on personal data, whether or not by automated means;
- User means a natural person who visits the Service or has registered an account in it;
- AI client means a third-party application with an AI assistant that the User connects to their account over the MCP protocol.
2. Data we process
2.1.The Operator processes personal data of registered Users and of visitors to the public pages of the Service. The data processed includes:
- account data: email address; password hash (the password itself is not stored); when signing in with Telegram, the Telegram user ID and name provided by Telegram;
- settings: interface language, time zone, notification and report settings;
- acceptance of the Terms of Use: the accepted edition and the date of acceptance;
- bookkeeping data entered by the User: accounts and their currencies, balances, transactions and transfers, categories, places, notes, planned and recurring payments, budgets;
- connected AI clients: client name, redirect address, granted permissions and connection validity period; access codes and tokens are stored only as irreversible hashes;
- session data: a hash of the session identifier and its expiry; the IP address is used only within an irreversible keyed hash for rate limiting and is not stored in clear text in the Service database;
- technical error reports: browser and operating system type, application version and error description, without User identifiers, cookies, headers or request contents.
2.2.The Operator does not process special categories of personal data (racial or ethnic origin, political opinions, religious or philosophical beliefs, health, sex life) or biometric data. Users should not enter such information in notes or other free-text fields.
2.3.The Service does not connect to banks and does not receive information about the User’s actual bank accounts or cards.
3. Purposes, legal bases and retention
3.1.The Operator processes only the data necessary for the purposes below. Each purpose has a legal basis and a retention period.
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Registration, sign-in and account management | Email address, password hash, Telegram ID and name, language, time zone, session data, acceptance of the Terms of Use | Entering into and performing the contract with the User (Article 6(1)(5) of the Personal Data Law; Article 6(1)(b) GDPR) | Until the account is deleted; session — 7 days; confirmation code — 10 minutes, Telegram sign-in — 5 minutes |
| Providing bookkeeping, planning and reporting features | Bookkeeping data | Performing the contract with the User | Until the account is deleted. Records deleted by the User are kept marked as deleted so they can be restored until the account is deleted |
| Sending service emails: confirmation codes and payment reminders enabled by the User | Email address, language, payment title, amount and due date | Performing the contract with the User | A message is kept in an encrypted queue until it is sent or no longer relevant; notification event records — 90 days |
| Providing data to a connected AI client on the User’s instruction | Bookkeeping data within the permissions granted by the User; connection details | Performing the contract with the User, on the User’s instruction | A connection lasts no longer than 30 days or until revoked; code and token hashes are deleted once they expire |
| Security and abuse prevention | Keyed hashes of the IP address and email address, request counters; web server logs: IP address, request time and address, browser details | The Operator’s legitimate interest in protecting the Service and its Users (Article 6(1)(7) of the Personal Data Law; Article 6(1)(f) GDPR) | Counters — until the rate-limit window ends, no longer than 1 hour; web server logs — no longer than 30 days |
| Diagnosing and fixing errors | Technical error reports without User identifiers | The Operator’s legitimate interest in keeping the Service working (Article 6(1)(7) of the Personal Data Law; Article 6(1)(f) GDPR) | No longer than 90 days |
| Handling enquiries and data subject requests | Email or postal address, contents of the request and the reply | Compliance with the Operator’s legal obligations (Article 6(1)(2) of the Personal Data Law; Article 6(1)(c) GDPR) | 3 years from the date of the reply |
3.2.The Operator does not use personal data for advertising, does not sell it, does not build marketing profiles and does not make decisions producing legal effects for the User based solely on automated processing.
3.3.An email address and password, or Telegram data, are required to enter into the contract: an account cannot be created without them. Bookkeeping data is entered at the User’s discretion.
3.4.When the purposes are achieved, the account is deleted or the legal basis ceases to apply, the Operator destroys the personal data within the periods set by the Personal Data Law, unless longer retention is required by law.
5. Processing operations and methods
5.1.The Operator processes personal data by automated means and performs the following operations: collection, recording, organisation, accumulation, storage, adaptation (updating, alteration), retrieval, use, transfer (provision, access), blocking, erasure and destruction.
5.2.The Operator does not disseminate personal data, that is, does not disclose it to an indefinite range of persons.
6. Disclosure to third parties
6.1.The Operator discloses personal data only in the following cases:
- to persons operating the Service on the Operator’s behalf — hosting infrastructure providers and the email delivery provider. They process data only to provide services to the Operator and are bound by confidentiality and security obligations under Article 6(3) of the Personal Data Law. Details of such persons are provided at the data subject’s request;
- to an AI client connected by the User — within the permissions the User confirmed on the connection screen and only in response to that client’s requests. The User chooses the AI client; its processing of data is governed by the terms of its provider, not by this Policy. A connection can be revoked in the profile at any time;
- to public authorities — in the cases and manner provided for by the laws of the Russian Federation.
6.2.When signing in with Telegram, the User provides data to Telegram directly, and the Operator receives from Telegram only the user ID and name. Telegram’s processing of data is governed by its own privacy policy.
7. Place of processing and cross-border transfer
7.1.Recording, organisation, accumulation, storage, adaptation and retrieval of personal data of citizens of the Russian Federation are carried out using databases located in the Russian Federation, in accordance with Article 18(5) of the Personal Data Law.
7.2.The Operator does not transfer personal data across borders on its own initiative. If the User connects an AI client whose provider is located outside the Russian Federation, bookkeeping data is provided to that client in response to requests initiated by the User and within the permissions the User granted. Before connecting, the User should review how the AI client’s provider processes data.
7.3.For Users in the European Union and the European Economic Area: data is processed in the Russian Federation, for which the European Commission has not adopted an adequacy decision. The transfer is necessary for the performance of the contract with the User (Article 49(1)(b) GDPR).
8. Security measures
8.1.The Operator takes the legal, organisational and technical measures required by Articles 18.1 and 19 of the Personal Data Law, including:
- passwords are stored only as Argon2id hashes, confirmation codes as HMAC-SHA256, session identifiers and AI client access codes and tokens as SHA-256 hashes;
- data is transmitted only over HTTPS;
- the service email queue is encrypted with AES-256-GCM;
- each User’s data is isolated: a record can be accessed only from its owner’s account or through an AI client the owner connected;
- the rate of sign-in attempts and other requests is limited;
- error reports are stripped of User identifiers, cookies and request contents before they reach the monitoring system, which the Operator hosts on its own infrastructure;
- access to the Service infrastructure is granted only to the Operator and to persons processing data on its behalf.
8.2.The Operator notifies Roskomnadzor of any incident resulting in unlawful or accidental transfer of personal data within the time limits set by Article 21(3.1) of the Personal Data Law and informs the affected Users.
9. User rights
9.1.The User has the right to:
- obtain information about the processing of their personal data (Article 14 of the Personal Data Law; Article 15 GDPR);
- require that personal data be rectified, blocked or destroyed if it is incomplete, inaccurate, outdated, unlawfully obtained or not necessary for the stated purpose; Users in the EU may also request restriction of processing (Articles 16–18 GDPR);
- require deletion of their account and all related data;
- receive their bookkeeping data in a structured, machine-readable format (Article 20 GDPR);
- object to processing based on the Operator’s legitimate interests (Article 21 GDPR);
- lodge a complaint about the Operator’s actions or omissions with the Federal Service for Supervision of Communications, Information Technology and Mass Media (Roskomnadzor) or with a court; Users in the EU may also complain to the data protection supervisory authority of their country.
9.2.Some actions are available to the User directly in the Service: changing the language, time zone and notification settings, unlinking sign-in methods, revoking AI client connections, and editing and deleting bookkeeping records.
9.3.To exercise other rights, the User sends a request to privacy@wizle.tech from the email address registered in the account or in another way that confirms ownership of the account, or by post to 350005, Краснодарский Край, Краснодар Город, им. Героя Пешкова ул., дом 14, корп. 4, кв./офис 159. The Operator replies within 10 business days of receiving the request. This period may be extended by no more than 5 business days, in which case the User is informed of the reasons.
9.4.An account is deleted at the User’s request. The Operator destroys the related personal data within 10 business days of receiving the request, except for data that must be retained by law.
10. Age restriction
10.1.The Service is intended for persons aged 16 or over. The Operator does not knowingly process personal data of younger persons. If the Operator learns that such a person has created an account, the account and related data will be deleted.
11. Changes to this Policy
11.1.The Operator may amend the Policy. A new edition is published on this page with its date and takes effect from that date unless it states otherwise. The Operator notifies Users of material changes by email or in the Service interface no later than 10 days before they take effect.
11.2.The Policy is published in Russian; translations into other languages are provided for convenience. In case of discrepancy, the Russian version prevails.
12. Operator contact details
12.1.Individual entrepreneur Олейников Анатолий Петрович, INN 232908716862, OGRNIP 325237500048912. Postal address: 350005, Краснодарский Край, Краснодар Город, им. Героя Пешкова ул., дом 14, корп. 4, кв./офис 159. Email for personal data enquiries: privacy@wizle.tech.