This Privacy Policy (the “Policy”) describes what data the BuzzAI application (ZhuzhzhimII; the “Service”) collects, for what purposes and to whom it is transferred. The Policy applies to all Users of the Service.
1.1. The operator of personal data processing is Egor Andreevich Severinov, self-employed, payer of professional income tax, taxpayer ID (INN) 230813750501 (the “Operator”).
1.2. This Policy is available online at https://buzzai.ru/en/privacy.html. The current revision is available at this address at all times.
1.3. Relations connected with the collection, storage and protection of Users’ personal data are governed by this Policy, the Licence Agreement and Russian Federal Law No. 152-FZ of 27.07.2006 “On Personal Data”.
1.4. By registering and using the Service, the User confirms that they have read this Policy and accept its terms.
1.5. If the User does not agree with this Policy, they must stop using the Service immediately.
1.6. The Operator may amend the Policy. The current revision is always available at the address above.
2.1. The Operator collects only the data necessary to provide the User with the functionality of the Service and to comply with the law.
2.2. Dictation. Dictation audio is sent for recognition and is not stored on the Operator’s servers. The recognised text is returned to the User and kept only in the local history on their device.
2.3. Meetings. A Meeting recording is stored on the User’s device. For cloud recognition the recording is sent to the Operator’s servers and then for recognition; once processing is complete it is deleted from the Operator’s servers. The recognition result (text and Meeting summary) is returned to the User’s device. If the application has not confirmed receipt of the result (for example, because of a lost connection or a failure), the result may be kept on the Operator’s server in encrypted form for no more than 48 (forty-eight) hours — so that the User can retrieve it again — and is then deleted. With local recognition the recording never leaves the User’s device.
2.4. Voices of third parties. A Meeting recording may contain the voices and statements of other participants. The User is responsible for notifying participants that a recording is being made and for obtaining their consent where required by law. The Operator processes such recordings solely on the User’s instructions and only to recognise them; voices are not used to identify participants. Speaker separation is performed without matching against any databases.
| Data category | Purpose of processing | Legal basis |
|---|---|---|
| Email address, mobile phone number, one-time confirmation codes; Telegram and Max messenger account identifiers when signing in via the bot; identifiers from external sign-in providers (Yandex ID, VK ID), as well as the email, name and phone number received from the provider with the User’s consent | Identifying the User at registration and sign-in; delivering the confirmation code by email, call or messenger message. | Performance of the contract between the Operator and the User (Licence Agreement). |
| User identifier in the Service, session token, registration date | Authorising the User when using the Service. | Performance of the contract. |
| Subscription information (plan, status, dates, auto-renewal flag), Gift Balance, payment history (amount, date, status, YooKassa payment identifier), saved payment method identifier, information on payments for meeting recognition | Providing paid features, automatic renewal, accounting for payments and issuing receipts. | Performance of the contract; compliance with payment and tax law. |
| Dictation audio and meeting recordings (for the duration of processing), meeting recognition results (encrypted, for no more than 48 hours if delivery fails) | Speech recognition and producing the meeting summary. | Performance of the contract. |
| Service usage metadata: number and duration of recognitions, processing volume used, model identifier, timestamps, errors | Billing, abuse prevention, monitoring of Service health, product analytics. Audio content and recognised texts are not part of this metadata. | The Operator’s legitimate interests in improving the Service; performance of the contract. |
| Technical data: application version, operating system and its version, device identifier (generated by the application), connection IP address, push notification token and status of system permissions | Diagnosing problems, delivering push notifications, usage statistics, protection against automated attacks and repeat registrations. | The Operator’s legitimate interests; performance of the contract. |
| Information provided by the User when contacting support (including email address and message text), survey answers | Handling and responding to enquiries; assessing the quality of the Service. | Performance of the contract; legitimate interests. |
| Web analytics and advertising attribution data: Yandex Metrica visitor identifier (ClientID), ad click identifiers (yclid, rb_clickid), pages viewed, referral source, on-site actions (including Webvisor recordings), cookies; mobile app installation identifier (AppMetrica); facts of registration, start of use and payment in the Service linked to an advertising visit; SHA-256 hashes of the email address and phone number | Web analytics, traffic measurement, measuring advertising effectiveness (including reporting to advertising systems the target actions completed after a visit and uploading contact hashes for audience matching). The content of dictations, meetings, texts and audio is not used. | The Operator’s legitimate interests; the User’s consent (cookie notice on first visit). |
3.1. Messages and mailings. In order to perform the agreement with the User, provide access to the Service and its features, and develop and improve the Service, the Operator may send the User service and informational messages (emails, push notifications, messages in linked messengers), including to obtain feedback (surveys, quality ratings). To deliver emails the Operator uses a third-party provider — VK WorkSpace (“Mail.ru for Business”). For these purposes the Operator processes the User’s contact details — email address and/or phone number — as well as a technical flag of the User’s consent to or refusal of promotional mailings. The User may opt out of promotional mailings at any time (the “Unsubscribe” link in the email); service messages necessary for the Service to work are sent regardless of such opt-out.
5.1. To operate the Service, the Operator uses the following contractors:
buzzai.ru (including the Webvisor tool), attribution of mobile app installations, reporting target actions after an advertising visit (registration, start of use, payment), and uploading SHA-256 hashes of email addresses and phone numbers for audience matching in advertising campaigns. The addresses and numbers themselves are not transferred. Processing is governed by the Yandex privacy policy.5.2. The Operator does not transfer Users’ personal data to third parties for purposes other than those listed above without the User’s prior consent, except as expressly provided by the laws of the Russian Federation (including at the request of authorised state bodies).
5.3. Cookies and web analytics. The website buzzai.ru uses cookies — small text files stored in the User’s browser. Cookies are used for the correct operation of the website and for web analytics (Yandex Metrica, including the Webvisor tool, which records anonymised visitor actions on pages), including measuring the effectiveness of advertising campaigns. On the first visit the User is shown a notice about the use of cookies. The User may restrict or disable cookies in their browser settings, although this may affect certain website functions. Website analytics does not involve the content of dictations, meetings, texts or audio recordings of the User.
6.1. Users’ personal data is stored on the Operator’s servers located in the Russian Federation.
6.2. Account data is kept for as long as the User uses the Service — until the account is deleted (section 7). Service usage event logs are kept for no more than 12 (twelve) months. Information that the Operator is required by law to keep (including on payment transactions) is kept for the periods set by law.
7.1. The User may delete their account and related personal data at any time:
The detailed procedure and the list of data deleted are available at buzzai.ru/delete-account.html.
7.2. When the account is deleted, personal data is deleted or anonymised. Financial transactions are kept in anonymised form as part of tax and accounting records for the periods set by law.
7.3. Local data on the User’s device (dictation history, meeting recordings, settings) is deleted when the application is removed from the device or by means of the application itself.
8.1. The Operator takes technical and organisational measures to protect Users’ personal data from unlawful or accidental access, destruction, alteration, blocking, copying and dissemination.
8.2. Data between the User’s application and the Operator’s server is transferred over the secure HTTPS protocol using modern encryption algorithms. Meeting recognition results temporarily kept on the server (clause 2.3) are encrypted.
8.3. Access to the server infrastructure is limited to the persons who operate it.
9.1. Under the Federal Law “On Personal Data”, the User has the right to:
10.1. The iOS application consists of two parts: the main application and a keyboard extension available in any application on the device through the system keyboard switcher.
10.2. iOS does not allow a keyboard extension to access the microphone. Therefore voice recording and recognition are performed by the main application, while the keyboard only starts dictation and inserts the finished text into the input field.
10.3. The keyboard requires the system “Full Access” permission. It is needed for exactly two purposes: network access (to send audio for recognition) and access to the storage shared by the application and the keyboard (to receive the recognised text and account data). No other capabilities of this permission are used by the Operator.
10.4. The Operator does not collect or transmit what the User types on the keyboard manually. No keystroke log is kept, and the content of the input field in another application is neither read nor transmitted. Only the audio that the User recorded by pressing the dictation button, and the text obtained from it, leave the device.
10.5. Spelling correction and word suggestions work locally on the device using iOS (UITextChecker); typed words are not sent anywhere for this.
10.6. Dictation audio is processed under the general rules of section 2: it is sent for recognition and is not stored on the Operator’s servers. A local copy remains only on the User’s device and only if recognition fails — for the “Recognise again” function; it is deleted automatically within 7 (seven) calendar days.
10.7. Dictation history (texts and metadata — time, duration, status) is stored locally on the device. The User can delete any entry or the entire history using the application.
10.8. Payment in the Service’s applications is made through YooKassa (on Android, for Google Play accounts outside the Russian Federation, through Google Play). The User’s payment details are not transferred to the Operator.
10.9. The device advertising identifier (IDFA on iOS) is neither requested nor used by the Operator; the User is not tracked across other companies’ applications and websites. The mobile applications include the AppMetrica service (Yandex LLC) for installation attribution, which works without the advertising identifier.
10.10. The applications ask the operating system for permission to access the microphone. The permission can be revoked in the device’s system settings; if revoked, dictation and meeting recording become unavailable, while other features remain.
10.11. Android. The Android application uses a service window on top of other applications (the dictation button) and an accessibility service — solely to insert the recognised text into the input field chosen by the User. The content of the screen and other applications is not read, stored or transmitted by this service.
10.12. macOS and Windows. To insert recognised text into the active field, the application requires the system accessibility permission (macOS) or simulates the paste keystroke (Windows); the content of other programs is not read. To record online meetings, the application, with the User’s permission, records system sound (on macOS via the screen and audio recording permission) only during a recording started by the User; the screen image is neither recorded nor transmitted.
11.1. This Policy does not apply to the actions and websites of third parties, including resources linked from the Service.
11.2. The Operator is not responsible for the actions of third parties who gained access to the Service on behalf of the User as a result of the User compromising their credentials.
12.1. Users may send the Operator requests concerning the processing of personal data and other enquiries to the email address: severinovea@ya.ru.
12.2. The Operator considers the enquiry and sends a reply within 10 (ten) working days of its receipt. This period may be extended by no more than 5 (five) working days, with a reasoned notice of the reasons for the extension sent to the User.
12.3. The request must contain information allowing the User to be unambiguously identified (for example, the phone number or email address used at registration) and the substance of the enquiry.