Legal

Personal Data Processing Policy

Version of October 26, 2026

This is a translation provided for your convenience. The Russian version is the legally binding one.

1. General provisions

This policy sets out how the personal data of users of the website smart-brains.ru (the “website”) is processed and protected in accordance with Russian Federal Law No. 152-FZ “On Personal Data” of July 27, 2006.

The personal data operator is the owner of the website smart-brains.ru, an individual registered under the special tax regime “Professional Income Tax” (self-employed), taxpayer ID (INN) 166017443612 (the “operator”). You can contact the operator about the processing of personal data by email at info@smart-brains.ru.

By using the website and signing up on it, the user confirms that they have read this policy. The user gives consent to the processing of personal data by ticking the corresponding box in the sign-up form.

2. What data is processed

  • email address;
  • password — stored only as an irreversible hash; the operator does not know the password;
  • name or username, if the user has entered them in the profile;
  • age group (child, adult, 60+) and daily practice goal in minutes, if the user has entered them;
  • answers given in the program picker (who will practice, which skills they want to improve, how many minutes a day, what concerns them most), if the user completed the picker and left an email address;
  • training results: which exercises were completed, when, and with what result;
  • the result of a test taken on the website, if the user requested it by email (together with the address and the consents given);
  • data from a company request on the “For companies” page: name, company name, phone number or email address, number of employees, areas of interest and a comment;
  • technical data: IP address, browser and device information, date and time of the visit, cookies.

The website does not ask for or process special categories of personal data, including health information. The website’s exercises are not a medical service.

3. Purposes of processing

  • signing up on the website and signing in to the personal account;
  • running the service: saving results, practice history, progress chart, choosing the daily workout by age group;
  • service emails: email address confirmation, password recovery, replies to the user’s inquiries;
  • sending and showing the result of a test that the user requested by leaving an email address after taking it;
  • sending the selected practice program to the email address given in the program picker and, with the user’s separate consent, informational and promotional emails. The user can opt out of these emails via the “Unsubscribe” link in any email or by writing to the operator’s email address;
  • replying to a company request: contacting the representative, discussing the task and the terms of cooperation. This data is not used for mailings;
  • website security: protection against hacking, automated sign-ups and abuse, including keeping track of trial plays without sign-up.

Promotional mailings are not sent without the user’s separate consent.

4. Legal grounds

Processing is based on the user’s consent (clause 1, part 1, article 6 of 152-FZ).

If the user is under 14, the sign-up is done and the consent to data processing is given by their parent or other legal representative.

5. How the data is processed

The operator performs the following actions with personal data: collection, recording, systematization, accumulation, storage, clarification, use, depersonalization, blocking, deletion and destruction. Processing is carried out using automated means.

The operator does not sell or transfer personal data to third parties, except where this is needed for the website to work (the hosting provider and the email delivery service, to the extent necessary to provide their services) and in cases provided for by the laws of the Russian Federation.

Recording, systematization, accumulation, storage, clarification and retrieval of personal data of citizens of the Russian Federation are carried out using databases located in the Russian Federation.

6. Retention periods

Account data and training results are kept for as long as the account exists. The user can delete the account in the profile of the personal account or withdraw consent by writing to the operator: in that case the data is deleted within 30 days, unless the law requires it to be kept longer. Technical logs are kept no longer than needed to keep the website secure. Data from company requests is kept while cooperation is being discussed and no longer than 3 years after the last contact; on a written request to the operator it is deleted within 30 days.

7. User rights

  • to receive information about the processing of their personal data;
  • to demand that data be corrected, blocked or deleted if it is incomplete, outdated, inaccurate or processed unlawfully;
  • to withdraw consent to the processing of personal data;
  • to appeal the operator’s actions to Roskomnadzor (the Russian data protection authority) or in court.

A request can be sent to the operator’s email address. The reply is sent within the period set by 152-FZ.

8. Cookies

The website uses cookies it cannot work without: for signing in to the personal account, protecting forms against request forgery and keeping track of trial plays without sign-up. The website also uses the web analytics service Google Analytics (Google LLC, USA): it sets the _ga cookie and collects anonymized information about visits — pages, actions on the website, device and browser type, approximate location. This information is transferred to Google servers outside Russia (cross-border transfer) and is used by us only for statistics and improving the website. The website does not use advertising cookies. You can turn off this collection in your browser settings or with an extension that blocks Google Analytics. You can turn off cookies in your browser settings, but then signing in and saving results will not work.

9. Data protection

The operator takes legal, organizational and technical measures to protect personal data from unauthorized access, alteration, disclosure and destruction: the connection to the website is encrypted (HTTPS), passwords are stored as a hash, access to data is restricted, and protection against password guessing is in place.

10. Smart Brains mobile app

This policy also applies to the Smart Brains mobile app for Android (ID kz.smartbrains.app, the “app”). The app and the website use the same account and the same data; the operator is the same as stated in section 1.

What data the app processes:

  • when signing in as a guest without sign-up — only a randomly generated technical ID of the guest account and the age group chosen by the user; name, email and phone number are not requested;
  • when signing up — email address and password (stored only as an irreversible hash), and optionally name, age group and daily practice goal;
  • training results: which exercise, when, how many points and how long the game took;
  • technical data: the device stores the account access key and a copy of the most recently loaded data (exercise list and statistics) so the app opens faster; the server stores only the key’s hash, the date it was last used and the device name reported by the app (“android”). The IP address and request times end up in the server’s technical logs, which are used only for security.

What the app does not do: it does not show ads, does not contain third-party advertising or analytics libraries (unlike the website, which uses Google Analytics, see section 8), does not request access to location, contacts, camera, microphone, photos or files, and does not collect the device’s advertising ID. The app only needs internet access and vibration (for tap feedback).

Who receives the data: the operator does not sell or transfer app data to third parties. The data is stored on the hosting provider’s servers in the Russian Federation; an email delivery service is used to send service emails (address confirmation, password recovery) — it receives only the recipient’s address and the text of the email. The app store (Google Play or another) receives its own installation information under its own rules; the operator does not receive this information.

Data transfer between the app and the server is encrypted (HTTPS).

How to delete your data. In the app: “Profile” → “Delete account and data”. The account and all results are deleted immediately. You can do the same in the personal account on the website or send a request to info@smart-brains.ru. Step-by-step instructions: https://smart-brains.ru/en/delete-account.

Age. The app is intended for users aged 13 and over. If the user is under 14, the sign-up and the consent to data processing are done by a parent or legal representative (section 4).

11. Changes to the policy

The operator may change this policy. A new version takes effect when it is published on this page, unless stated otherwise in it. The current version is always available at smart-brains.ru/en/privacy.