Personal data policy

1.1. This Policy sets out how personal data of signalfort users (the signalfort.ru website, dashboard and API, the “Service”) is processed and protected. It follows Federal Law No. 152-FZ “On Personal Data” of 27.07.2006.

1.2. The personal data operator is Yulia Alekseevna Ladeyshchikova, taxpayer ID 231221603606 (the “Operator”). Personal data requests are accepted at hello@signalfort.ru.

1.3. The Policy is publicly available at signalfort.ru/privacy.

2.1. When you sign up and use the Service:

• email address;
• password — only as a cryptographic hash, the password itself is not stored;
• organization name, if you provided it;
• interface language and notification settings;
• IP address, date and time of sign-ins.

2.2. When you contact us — your email address, name if you provided it, and the correspondence.

2.3. Information about the resources you add to the Service (domains, IP addresses, check results) is generally not personal data. If it identifies an individual, we process it under this Policy.

2.4. We do not process special categories of data or biometric data, do not store bank card data, and do not use web analytics or advertising trackers.

3.1. Signing up, signing in, running your account and providing services under the Offer — on the basis of the agreement and your consent (Article 6(1)(5) and 6(1)(1) of Law No. 152-FZ).

3.2. Email notifications about new findings and digests — on the basis of consent. You can turn them off in account settings.

3.3. Protecting accounts from password guessing and unauthorized access (a log of sign-in attempts with IP addresses) — for the legitimate interests of the Operator and the user (Article 6(1)(7) of Law No. 152-FZ).

3.4. Answering your requests — on the basis of consent.

3.5. Meeting legal obligations, including tax obligations when services are paid.

3.6. We do not use personal data for advertising and do not make decisions with legal effect based solely on automated processing.

4.1. Processing is automated and includes collection, recording, systematization, accumulation, storage, updating, retrieval, use, blocking, deletion and destruction.

4.2. Personal data is stored in databases on servers located in the Russian Federation (Article 18(5) of Law No. 152-FZ).

4.3. We do not sell or share your data with third parties, except:

• the hosting provider whose servers run the Service and the email provider that delivers our emails — on the Operator’s instruction and under a confidentiality obligation;
• government authorities — where expressly required by law.

4.4. Personal data is not transferred across borders.

5.1. Account data is kept while the account exists. After the account is deleted or consent is withdrawn, it is destroyed within 30 (thirty) days unless the law requires longer storage.

5.2. Records of failed sign-in attempts are deleted automatically after one day.

5.3. Correspondence is kept until the request is resolved, but no longer than 3 (three) years after the last message.

6.1. The Service uses only technical cookies needed to sign in: session tokens (not readable by page scripts) and a signed-in flag that lets the website show a link to your dashboard. They are kept for up to 30 days.

6.2. Your interface language is stored in your browser’s local storage.

6.3. We do not use analytics or advertising cookies.

7.1. You may obtain information about the processing of your personal data, require it to be updated, blocked or destroyed if it is incomplete, outdated, inaccurate, unlawfully obtained or not needed for the stated purpose, and withdraw your consent.

7.2. Send your request to hello@signalfort.ru from the address in your account. We respond within 10 (ten) business days; this may be extended by up to 5 (five) business days with a notice explaining why.

7.3. Withdrawing consent does not affect the lawfulness of processing before it. The Service cannot work without account data, so withdrawing consent means deleting the account.

7.4. You may appeal the Operator’s actions to Roskomnadzor or in court.

8.1. The Operator takes legal, organizational and technical measures to protect personal data (Articles 18.1 and 19 of Law No. 152-FZ), including:

• encrypted connections to the Service (TLS);
• passwords stored only as hashes;
• isolation of different organizations’ data at the database level;
• limits on sign-in attempts;
• separation of the modules that run checks from the Service database;
• server and database access limited to the Operator.

9.1. The Operator may change this Policy. A new version takes effect once published on the website unless stated otherwise. We notify you of material changes by email.