Use of AI and External Processors

This is an English translation for convenience. The Russian original governs.

Revision dated October 19, 2026. Valid with [ДАТА_ВСТУПЛЕНИЯ].

1 Current scheme

Buyora.ai uses the GPT-6 Luna model via OpenRouter with requests routed to the OpenAI provider. Processing chain: owner's server in Moscow → proxy rented by the owner in Germany → OpenRouter API → OpenAI in the USA. The scheme description date is October 19, 2026. The exact model identifier and version in the API: [API_MODEL_ID_И_ВЕРСИЯ].

The main server, database and files uploaded by users are located in Moscow. The German server serves as a proxy and, according to the owner’s current scheme, is not intended for permanent storage of documents. In-memory transfers and processing, technical logs, and administrator access are counted separately; the absence of disk storage does not preclude cross-border transfer.

External recipients are sent [ТОЧНЫЙ_ОБЪЕМ_ТЕКСТ_ТАБЛИЦЫ_ИЗОБРАЖЕНИЯ_ИЛИ_ФАЙЛЫ]. If the material transmitted contains information about an identifiable person, the rules on personal data apply. Commercial terms and prices may require confidentiality regardless of the presence of personal data.

2 Russian infrastructure

Operator: Sole proprietor Romashenko Roman Alexandrovich, TIN 236101223048, OGRNIP 315236100011203, address St. Petersburg, Duderhof Canal embankment, 4, bldg. 1, apt. 428, info@buyora.ai. Location of the main server, database and files: Russian Federation, Moscow. Hosting legal entity, data center address, agreement and access information: [ХОСТИНГ_РФ_И_АДРЕС_ЦОД].

3 German proxy

Purpose: transmission of requests to the OpenRouter API and responses back, without the permanent storage of document contents provided for by the scheme. Country: Germany. The server is rented and administered by the operator Buyora.ai. Hosting, its legal address and contacts: [ХОСТИНГ_ГЕРМАНИЯ_АДРЕС_КОНТАКТЫ]. Conditions for technical logs, backup, swap and access for hosting workers: [ПРОВЕРЕННЫЕ_НАСТРОЙКИ_ПРОКСИ_И_ХОСТЕРА].

4 OpenRouter

Recipient: OpenRouter, Inc., 169 Madison Ave #2404, New York, NY 10016, USA. Role: API gateway and model request routing; the absence of your own model does not exclude participation in processing. Support contact https://openrouter.ai/support; contact and phone number for the recipient's dossier [КОНТАКТЫ_OPENROUTER_ПО_ДОГОВОРУ]. Processing document: https://openrouter.ai/data-processing-agreement .

By published rules, OpenRouter generally does not store the contents of requests and responses without enabling the appropriate options, but does collect metadata. Exceptions for safety and legal reasons may apply as provided in the terms and conditions. Our actual account settings: [НАСТРОЙКИ_OPENROUTER_LOGGING_И_ИСПОЛЬЗОВАНИЯ_ДАННЫХ]. Metadata retention period and applicable exclusions: [СРОКИ_МЕТАДАННЫХ_И_ИСКЛЮЧЕНИЙ].

OpenRouter jurisdiction is USA; the published DPA indicates conventional infrastructure in the US. Actual endpoint [OPENROUTER_ENDPOINT]; full confirmed list of processing countries, access and applicable sub-processors [СТРАНЫ_И_СУБОБРАБОТЧИКИ_OPENROUTER]. A German proxy does not mean selecting the European OpenRouter mode.

5 OpenAI

Model provider: OpenAI, USA; a specific legal entity, its address and contacts according to the agreement [ЮРЛИЦО_OPENAI_АДРЕС_КОНТАКТЫ] applicable to the route. The final processing country confirmed by the owner is the United States. Additional processing countries, access countries and sub-processors, if actually involved: [ДОПОЛНИТЕЛЬНЫЕ_СТРАНЫ_И_СУБОБРАБОТЧИКИ_OPENAI_ИЛИ_НЕТ].

According to the OpenAI API documentation, the passed data is not used for training by default without a special connection. There may be abuse control logs, typically up to 30 days, caching, and other processing status depending on the API and settings. The cached state of requests described in the documentation can persist for up to 24 hours. Our chain mode: [OPENAI_ENDPOINT_STORE_CACHE_ZDR_И_ИСКЛЮЧЕНИЯ]. Link https://developers.openai.com/api/docs/guides/your-data.

The OpenAI terms are applied through the OpenRouter chain used; the owner of Buyora.ai cannot be automatically assumed to have a direct OpenAI contract or a special Zero Data Retention regime. Storage and deletion parameters are confirmed for the actual selected endpoint and account. Confirmation of disabling training, information about manual access and removal procedure [ПОДТВЕРЖДЕНИЕ_РЕЖИМА_И_УДАЛЕНИЯ_OPENAI].

6 Bases and transmission control

For third-party data from supplier quote, the client provides the legal basis and necessary consents for the assignment and transfer to specific recipients. Confirmation of the uploading employee is a company instruction and does not replace the consent of other people. For the citizen's own data, a separate basis and required consent apply. The client gets access to the route card before sending.

The foreign states confirmed in the described chain are Germany and the USA. Additional actual countries cannot be replaced by the wording “any countries” and must be identified, disclosed, and accounted for in the required notifications prior to the applicable transfer. New providers and countries are not automatically connected.

The client retains rights to the documents. Publication and use in a shared knowledge base or self-training of models is not permitted by the general acceptance of the terms and conditions. The service is not intended for passports, cards, special categories, biometrics for identification and data of minors. Before downloading, unnecessary contacts, signatures and other information are deleted. Removing one name does not guarantee anonymity.

The transfer requires compliance with localization during collection and Article 12 of Law No. 152-FZ, including assessment of recipients, notifications and restrictions of the RKN. Consent does not replace these procedures. If you refuse foreign processing, the AI ​​function along this route will not run; There is no promise of a local alternative model.

7 Quality and contacts

Extracted data and matches are subject to human verification; AI can make mistakes. The final purchasing decision is made by the user. This scenario is not intended for purely automated decisions that give rise to legal consequences for personal data subjects.

Policy https://buyora.ai/en/legal/privacy . Order https://buyora.ai/en/legal/data-processing . Requests for processing and its termination: info@buyora.ai. Route changes are reflected in the new version prior to the start of the affected processing, re-checking the necessary grounds and notifications.