Jump to document

Privacy policy

Updated June 14, 2026 Updated today Effective from June 6, 2026 Version 1.1

1. General provisions

1.1. This Privacy Policy (hereinafter — the «Policy») has been developed in accordance with Federal Law No. 152-FZ of 27 July 2006 «On Personal Data» (hereinafter — «152-FZ») and sets out the procedure for processing personal data (hereinafter — «Personal Data» or «PD») and the measures taken to ensure their security by the Operator of the Resalt Service (hereinafter — the «Operator», the «Service»).

1.2. The Operator is the limited-liability company «Резалт» (OGRN 1267700190086, INN 9715527313, KPP 771501001, registered address: Moscow, Novodmitrovskaya St., bldg. 2, structure 7, Russian Federation). Contact email for personal-data requests: support@resalt.app.

1.3. By using the Service, the User confirms they have read this Policy and agree to its terms. Consent to PD processing that requires separate expression (including cross-border transfer) is requested through separate checkboxes at registration.

1.4. The current version of the Policy is available at /privacy. The dates of last update and entry into force are stated at the top of the document.

2. Definitions

Personal Data (PD) — any information relating to a directly or indirectly identified or identifiable natural person (the PD subject).

Processing of PD — any action or set of actions performed with PD (collection, recording, systematization, accumulation, storage, refinement, retrieval, use, transfer, depersonalization, blocking, deletion, destruction).

Operator — the person organizing and/or carrying out the processing of PD, and determining the purposes and composition of the PD to be processed.

User — a natural or legal person registered in the Service and using its functionality.

Meeting Participant — a third party whose voice and/or image may be captured when the User uses the Service’s meeting-recording feature.

Service / Resalt — the software and hardware system at resalt.app and related subdomains, including the web application, mobile applications, and bots for videoconferencing platforms.

VCS Platform — a third-party videoconferencing platform (for example, Zoom, Google Meet, Microsoft Teams, Yandex Telemost) to which the User connects the Resalt Bot.

3. Categories of PD processed

The Operator processes the following categories of PD:

Registration data: email address, name (if provided), password (stored as a hash);
Payment data: transaction status, amount; bank-card details are not processed by the Operator — they are processed by the payment provider as a separate operator;
User Content: meeting audio recordings, transcripts, summaries, notes, comments, AI-chat messages;
Meeting metadata: meeting name, date, duration; names of meeting participants where provided by the User;
Technical data: IP address, browser identifier (user-agent), Service-interface actions, cookie identifiers;
Support correspondence: the content of User requests to the support team.

The Operator does not process special categories of PD (national origin, political views, health condition, etc.) nor biometric PD within the meaning of Article 11 of 152-FZ — voice and meeting audio recordings are processed solely for speech-recognition purposes and are not used to identify a natural person.

4. Purposes of PD processing

The Operator processes PD for the following purposes:

User registration and authentication in the Service;
Provision of meeting audio-recording transcription services;
AI-driven generation of meeting summaries;
Provision of the AI-chat functionality over meeting content;
Storage and provision of User access to their materials (audio, transcripts, notes);
Acceptance and processing of payments for paid Service features;
Informing the User about the Service’s operation, technical notices, and material changes to the documents governing use of the Service;
Replying to User requests to the support team;
Service-use analytics for improvement purposes (using Yandex Metrica);
Ensuring Service security, preventing fraud and unauthorized access;
Compliance with the requirements of Russian Federation legislation.

5. Legal grounds for processing

PD processing is carried out on the following grounds:

consent of the PD subject (Article 6(1)(1) of 152-FZ) — expressed by ticking a checkbox at registration;
a contract to which the PD subject is a party (Article 6(1)(5)) — the Terms of Service and the Public Offer;
performance of obligations imposed on the Operator by Russian Federation legislation (Article 6(1)(2));
exercise of the Operator’s rights and legitimate interests with respect to ensuring Service security (Article 6(1)(7)).

6. Specifics of processing meeting recordings

6.1. The Service allows the User to record audio by connecting the Bot to a VCS Platform, by uploading a pre-existing audio file, or via the built-in «Voice Recorder» application.

6.2. Responsibility for obtaining consent from Meeting Participants to record and further process their voice rests entirely with the User who initiates the recording (the meeting organizer). By using the recording feature, the User confirms and warrants to the Operator that they have:

obtained the consent of all Participants to the recording and processing of their voice using the Service;
informed the Participants that the recording will be transmitted for automatic transcription and summary generation;
informed the Participants of the possibility of cross-border transfer of their data (see section 9 of this Policy).

6.3. When the Bot joins a meeting, it appears in the participant list under a name that clearly indicates the recording (for example, «Resalt Bot — recording for summary»). This notice is a supplementary measure and does not relieve the User of the obligations under clause 6.2.

6.4. The User is responsible for compliance with Articles 152.1 and 152.2 of the Russian Civil Code (protection of a citizen’s image and private life) and other requirements of Russian Federation legislation when using the recording feature.

6.5. If a Meeting Participant objects to recording and to the processing of their data, the User must stop the recording or delete the recording at the Participant’s request.

7. Procedure and retention periods

7.1. PD processing is carried out both with and without the use of automation.

7.2. PD are stored on servers physically located in the Russian Federation.

7.3. Retention periods:

Data category	Retention period
User registration data	Until the User deletes the Account
Meeting audio recordings	Until deleted by the User; the User may configure auto-deletion in the personal account
Transcripts, summaries, meeting metadata	Until deleted by the User
User notes and comments	Until deleted by the User
Payment data (transaction status)	3 years from the transaction date (accounting requirement)
Access logs and technical logs	12 months
Cookies and web-analytics data	Up to 14 months (the Yandex Metrica standard)
Support correspondence	12 months after the case is closed

7.4. Upon achievement of processing purposes or revocation of User consent, PD is destroyed within no more than 30 days, unless another period is established by Russian Federation legislation or by contract.

7.5. The User may delete their Account at any time through the personal account or by sending a request to the Operator’s email address.

8. Transfer of PD to third parties

The Operator transfers PD to third parties solely to the extent necessary to provide services and on the basis of legal grounds.

8.1. Persons receiving access to PD

For service-delivery purposes, the Operator engages the following persons that process PD on the Operator’s behalf in accordance with Article 6(3) of 152-FZ:

Recipient category	Jurisdiction	Purpose of transfer	Data categories
Infrastructure provider	Russian Federation	Hosting, storage of databases and files, ensuring the Service’s technical operability	All PD categories (for storage purposes)
KlaudPayments LLC (CloudPayments)	Russian Federation	Acceptance of bank-card payments	Email address, name, transaction amount; bank-card details are processed by CloudPayments independently as a PD operator
YANDEX LLC (Yandex Metrica)	Russian Federation	Web analytics	IP address, browser identifier (user-agent), on-site actions, cookie identifiers
Artificial-intelligence service provider	Republic of Kazakhstan	Generation of meeting summaries and AI-chat over meeting content, under cross-border transfer (see section 9)	Meeting transcript text with masked direct identifiers of participants, meeting name and date, User messages in the AI-chat

Information about specific persons engaged by the Operator to process PD may be provided to the PD subject upon written request, in the manner set out in Article 14 of 152-FZ.

8.2. Transfer to state authorities

The Operator transfers PD to authorized state bodies of the Russian Federation in cases expressly provided for by Russian Federation legislation (court orders, law-enforcement requests, etc.).

8.3. Transfer for marketing purposes

The Operator does not sell PD to third parties and does not transfer it to third-party companies for advertising purposes.

9. Cross-border transfer of PD

9.1. Recipient and jurisdiction

Cross-border transfer recipient: «Timeweb (Таймвэб)» LLP (BIN 221140016700, Republic of Kazakhstan) — the artificial-intelligence service provider.

The Republic of Kazakhstan is on the list of foreign states providing adequate protection of the rights of personal-data subjects, approved by order of Roskomnadzor. Under Article 12(3) of 152-FZ, cross-border transfer to such states is performed under a notification procedure.

The Operator has filed a notice with Roskomnadzor of the intent to carry out cross-border transfer of PD.

9.2. Purposes of cross-border transfer

Cross-border transfer is performed to enable the Service’s AI-driven functions:

automatic generation of meeting summaries;
interactive AI chat over meeting content;
other Service functions that rely on artificial intelligence.

These functions constitute a material part of the Service’s functionality. Other types of processing (acceptance and storage of audio recordings, automatic transcription, storage of transcripts and metadata, User notes and comments) are carried out by the Operator within the Russian Federation and do not involve cross-border transfer.

9.3. Masking and composition of data transferred

Before the cross-border transfer, the Operator automatically masks direct identifiers of meeting participants in the transcript text: names, phone numbers, email addresses, and other direct contact and payment details. The mapping between masked values and the source data is stored exclusively on the Operator’s servers within the Russian Federation and is not transferred outside the Russian Federation.

The Operator transfers to the recipient:

the text of the meeting transcript with masked direct identifiers of participants (or its relevant part);
meeting name and date;
the User’s messages and questions addressed to the AI within the AI-chat.

Audio recordings, as well as participant names and contact details in their original form, are not transferred to the recipient — they remain within the Russian Federation.

The recipient may, on the basis of contracts it has entered into, engage third parties to deliver artificial-intelligence services on terms that ensure personal-data protection in accordance with applicable law.

Consent to cross-border transfer is requested from the User through a separate checkbox on the registration form, distinct from general consent to this Policy and the Terms of Service.

Because the functions listed in clause 9.2 form a material part of the Service’s functionality, use of the Service is not possible without this consent. A User who does not wish to grant this consent may decline to use the Service.

The User may revoke consent to cross-border transfer at any time through the «Settings» → «Security» section of the personal account, or by sending a request to the Operator’s email address.

Because full delivery of the Service is impossible without the cross-border transfer, revoking consent triggers cessation of services and deletion of the User’s Account. Previously generated transcripts, summaries, notes, and other materials are deleted together with the Account in the manner set out in section 12 of this Policy.

10. Measures to ensure PD security

The Operator takes the legal, organizational, and technical measures necessary to protect PD from unlawful or accidental access, destruction, modification, blocking, copying, distribution, and other unlawful actions, including:

appointing a person responsible for organizing PD processing;
adopting internal regulations governing PD processing and protection;
training employees who process PD on the legislation and internal regulations;
segregating access rights to information systems;
encrypting PD in transit over open communication channels (TLS);
encrypting sensitive PD categories (the content of transcripts, summaries, notes, comments) at rest in the database;
storing password hashes instead of plain-text passwords;
regularly backing up data;
maintaining PD-access logs;
regular risk assessments and security audits.

11. Incident response

11.1. If unlawful (including accidental) transfer of PD that causes a violation of subjects’ rights is identified, the Operator shall:

within 24 hours, notify Roskomnadzor of the incident, the suspected causes, and the suspected harm (Article 21(3.1) of 152-FZ);
within 72 hours, notify Roskomnadzor of the results of its internal investigation and the measures taken.

11.2. Affected PD subjects are notified by the Operator of the incident within a reasonable time.

12. Rights of PD subjects

The PD subject has the right to:

receive information about the processing of their PD (Article 14 of 152-FZ);
request rectification, blocking, or destruction of their PD where it is incomplete, inaccurate, unlawfully processed, or where the purposes of processing have been achieved;
demand cessation of the processing of their PD; in this case the Operator ceases processing (or ensures its cessation by a person acting on the Operator’s behalf) within no more than 10 working days from receipt of the demand, except where processing is carried out on grounds that do not require the subject’s consent (Article 21(5.1) of 152-FZ); this period may be extended by no more than 5 working days upon sending the subject a reasoned notice;
revoke consent to PD processing at any time (subject to clause 9.5 — revocation of consent to cross-border transfer triggers cessation of services and deletion of the Account);
separately revoke the Marketing Communications Consent;
appeal the Operator’s actions or omissions to Roskomnadzor or through judicial proceedings.

12.1. Procedure for exercising rights

Requests are sent to the Operator’s email address listed in the preamble of this Policy.

The request must contain:

the subject’s full name or other identifier (the email address used at registration);
information confirming that the PD belongs to the subject (for example, access to the email address provided);
the substance of the request.

The Operator’s response window is 10 working days from receipt of the request. This period may be extended by no more than 5 working days upon sending the subject a reasoned notice stating the grounds for the extension (Article 20(1) of 152-FZ). Where the request requires rectification or destruction of PD, the Operator carries this out within no more than 7 working days from the day the subject provides information confirming that the PD are incomplete, inaccurate, outdated, unlawfully obtained, or no longer necessary for the stated purpose (Article 20(3) of 152-FZ).

Withdrawal of consent to PD processing may be made by the subject at any time; absent other legal grounds for processing, the Operator ceases processing and destroys the PD within no more than 30 days from the withdrawal (Article 21(5) of 152-FZ). A demand to cease processing is fulfilled within the period stated in this section (10 working days).

12.2. Account deletion

The User may delete their Account on their own through the personal account («Settings» → «Security» → «Delete account»). After deletion:

registration data, audio recordings, transcripts, summaries, notes, and comments are destroyed within 10 days;
payment data (transaction status) is retained for 3 years in accordance with accounting requirements;
technical logs are retained for 12 months.

13. Use of cookies and similar technologies

13.1. The Operator’s website uses cookies — small text files stored on the User’s device.

13.2. Types of cookies used:

Technical (mandatory) — necessary for the operation of the website (authentication, security). Do not require consent.
Analytics — collected by Yandex Metrica to analyze website use. Require consent.

13.3. On the first visit, the User is shown a banner that allows analytics cookies to be accepted or rejected. Consent can be changed at any time via the website’s settings or the browser.

13.4. Detailed cookie terms are set out in a separate Cookie Policy.

14. Notification of PD processing

The Operator has filed a notice with Roskomnadzor of the intent to carry out the processing of personal data, in the manner provided for by Article 22 of 152-FZ. The registry number in the operators’ registry will be published after Roskomnadzor enters the record.

15. Changes to the Policy

15.1. The Operator may amend this Policy. A new version takes effect upon its publication on the site, unless the new version provides otherwise.

15.2. For material changes affecting the rights of PD subjects (expansion of PD categories, new processing purposes, new recipients, new jurisdictions of cross-border transfer), the Operator notifies Users by email at least 14 days before the changes take effect.

15.3. The current version of the Policy is always available at /privacy.

16. Contacts

For any matters related to PD processing, including to exercise PD-subject rights, please contact:

Email: support@resalt.app
Postal address: Moscow, Novodmitrovskaya St., bldg. 2, structure 7, Russian Federation.