Privacy Policy

This is an English translation for convenience. The Russian original governs.

Revision dated October 19, 2026. Valid with [ДАТА_ВСТУПЛЕНИЯ].

1 General provisions

This Policy defines how Sole proprietor Romashenko Roman Alexandrovich, TIN 236101223048, OGRNIP 315236100011203, address St. Petersburg, Dudergofsky Canal embankment, 4, bldg. 1, apt. 428, processes personal data when operating the https://buyora.ai website and the Buyora.ai service. Applications regarding personal data are accepted at the address info@buyora.ai.

Buyora.ai helps process purchase requests and proposals, compare items and prepare comparisons for human review. At the current stage, third-party large language models and related services are used to process documents. When processing AI, there is a chain: main server in Moscow → owner’s proxy server in Germany → OpenRouter API → OpenAI in the USA. The proxy is used for transmission and, according to the owner's current scheme, does not permanently store documents. Technical processing and access in Germany are also taken into account when assessing cross-border transfers. Recipients, countries, information transferred and processing conditions are disclosed in the document “Use of AI and External Processors” at https://buyora.ai/en/legal/ai-processors.

The policy applies to the data of visitors, applicants, users, clients - individuals, representatives of organizations, individual entrepreneurs and contractors, as well as personal data that may be contained in uploaded documents. Information about a legal entity is not in itself personal data; information about individual entrepreneurs and contact persons may be considered personal data.

2 Roles in data processing

For the site's own purposes, account management, customer communications, settlements and security, the operator is Sole proprietor Romashenko Roman Alexandrovich. When providing a service to a citizen for his personal needs, the owner of the service also determines the purposes of the necessary processing of this citizen’s own data and acts as an operator. The company's order does not replace the grounds for this processing.

When an organization or individual entrepreneur uploads documents with personal data for its purchasing tasks and determines the purposes for their processing, such organization or individual entrepreneur is the operator of this data, and the owner of Buyora.ai processes it on behalf of the client. The terms of the order are posted at https://buyora.ai/en/legal/data-processing. The independent goals of the service owner are not replaced by the client’s order.

The Client ensures the legal basis for processing the data of employees, representatives of suppliers and other persons, as well as obtaining the necessary consent to entrust processing and engage specific processors, if such consent is required by law. The consent of the person who uploaded the file does not constitute the consent of other persons named in that file.

3 Goals, reasons and deadlines

3 1 Response to application and demonstration

Subjects: persons who independently submitted an application and representatives of potential clients. Data: name, work email and phone number, name of the organization, position when indicated, content of the appeal, date and status of the appeal. Required fields are marked on the form; the rest are filled out voluntarily. Grounds: separate consent to the processing of application data; the applicable contractual basis is used only if the conditions of paragraph 5 of part 1 of article 6 of Law No. 152-FZ are met. Duration: until the end of communication, but no more than six months after the last meaningful contact, unless an independent legal basis for further processing has arisen.

3 2 Account and support

Subjects: users - individuals, administrators and invited users of organizations, individual entrepreneurs. Data: name, work email, phone number when used, organization, position when specified, role and account ID, information about logins and support requests. Passwords, if used, are stored as protected derivatives that are not intended to recover the original password. Grounds: contract, when the subject is its party or beneficiary; separate consent of the user in other cases; legitimate interests of ensuring security while respecting the rights of the subject. Term: the period of use of the account and fulfillment of obligations. After the termination of the relationship, the data is deleted in the manner specified below, except for the necessary information, for which a separate basis is retained.

3 3 Processing of purchasing documents on behalf of

Subjects: employees and representatives of the client, suppliers and other contractors, individual entrepreneurs. Data: full name, position, work contact information, name and details of the individual entrepreneur, as well as information about the application and proposal related to these persons, legally included in the documents. The scope is limited to the comparison task. The basis is determined by the client as the operator; Buyora.ai acts on documented instructions and within the limits of legally granted authority. Duration: term of the order; upon termination, unloading and subsequent disposal are provided within the agreed and legal time frame. Storage for independent purposes of the service owner is possible only on a separate basis.

3 4 Conclusion of the contract and settlements

Subjects: clients - individuals, individual entrepreneurs, authorized representatives and contact persons of organizations. Data: full name, work contacts, position, information about authorities, individual entrepreneur details, information about the contract, invoices, payments, returns, cash receipts and closing documents; email or phone for an electronic check. Full card details are entered into the acquirer's secure payment form and should not be retained by the Buyora.ai owner. Payment data recipient: [ЮРЛИЦО_АДРЕС_И_ССЫЛКА_ЭКВАЙРИНГА]. Grounds: fulfillment of the contract and obligations established by law; legitimate interest in conducting business correspondence and protecting rights while respecting the rights of subjects. The deadlines for primary accounting and tax documents are determined by applicable law; for accounting documents, the period established by law is applied, including at least five years after the reporting year in cases of Article 29 of Law No. 402-FZ. Other documents are not automatically stored for the same period without independent reason.

3 5 Safety and performance

Subjects: visitors and users. Data: IP address, date and time of requests, technical information about the device and browser, session identifiers, login events, errors and operations. Reasons: fulfillment of data protection obligations and the legitimate interest of preventing abuse while respecting the rights of subjects. Regular technical logs are retained for up to 90 days; Records related to the investigation of an incident or dispute may be kept separately for as long as necessary for this purpose. The contents of the supplier quote and access secrets are not included in regular technical journals.

3 6 Analytics and advertising

Optional analytics are only applied if the visitor has chosen to do so. The composition of the information, specific service and terms are specified in the Cookie Policy and a separate consent to analytics. If there is no connected analytics, such processing is not performed.

Promotional messages only use the name and email provided for this purpose, subscription confirmation information and preferences. Grounds: separate consent to data processing for promotion and separate consent to receive advertising. Duration: until revocation or no more than two years from the last confirmation of subscription, after which a new confirmation is required. Opting out of advertising does not restrict access to the service.

4 Methods and limitations of processing

Processing is carried out automatically and, if necessary, to review requests and check results, in a mixed way. Depending on the purpose, collection, recording, systematization, accumulation, storage, clarification, retrieval, use, provision or access to specific authorized persons, blocking, deletion and destruction are carried out. Cross-border transfers are only permitted for specifically identified purposes and recipients, subject to compliance with the law.

The service is not intended for uploading passports, payment cards, information about health, political and religious views, intimate life, biometrics for identification, data of minors and other information not necessary for the procurement task. It is recommended to delete unnecessary information, signatures, personal telephone numbers and addresses before downloading. Detected redundant information is blocked for further processing and deleted in the prescribed manner.

Removing a name from a text does not guarantee depersonalization if the person remains identifiable based on other data. Personal data is not published to an unlimited number of persons on the basis of this Policy.

5 Localization and cross-border transmission

When collecting personal data of citizens of the Russian Federation, the requirements of Part 5 of Article 18 of Law No. 152-FZ must be observed: the use of foreign databases for the collection operations listed in this norm is not allowed, except for the exceptions established by law. Main database, files and place of initial collection for the service: Russian Federation, Moscow; the main server, database and downloadable files are located together. Hosting and data center address: [ХОСТИНГ_РФ_И_АДРЕС_ЦОД]. The actual pattern of subsequent processing and foreign recipients is disclosed in the register of processors. The presence of a Russian base does not in itself confirm the legitimacy of any subsequent foreign processing.

Cross-border transfer is carried out on a certain legal basis, after receiving the necessary information about the foreign recipient, assessing the protection and fulfilling the notification procedure of Article 12 of Law No. 152-FZ. If there is a restriction or ban from Roskomnadzor, the corresponding transfer is not carried out. The user's consent does not waive these requirements.

For external processing, text, tabular data, document fragments can be transmitted, and when using the appropriate route, entire files or images can be transmitted. The specific volume, model, legal entity of the recipient, all countries of processing, storage and access, storage periods and mode of use for training are indicated for each active route. Account passwords and payment card details are not sent to LLM.

6 Rights to documents and training models

The download does not transfer ownership or exclusive rights to the client's documents to the service owner. Documents are used within the framework of the agreement and assignment. Publishing cases, using them in a common knowledge base and training your own models on client documents require a separate legal basis and agreed terms.

The use of the transmitted information by the external provider itself for training, abuse control, manual verification or other purposes depends on the specific agreement and settings. The confirmed conditions of each active route are listed in the register; using an API does not in itself imply a lack of storage or learning. Independent use by the provider outside the scope of the order is not covered by the client's general order.

7 Security and access

Access is provided to authorized employees and involved persons to the extent necessary, taking into account their tasks. Organizational and technical measures are applied that comply with the nature of the processing and the requirements of Article 19 of Law No. 152-FZ. Information about the measures actually implemented: [РЕАЛИЗОВАННЫЕ_МЕРЫ_ЗАЩИТЫ]. Information, the disclosure of which poses a security risk, is not publicly posted.

8 Subject rights and appeals

The subject has the right to receive information about processing provided for by law, demand clarification, blocking or destruction of data if there are grounds, withdraw consent, refuse advertising and appeal the actions of the operator. The appeal is sent to info@buyora.ai or to the address St. Petersburg, Dudergofsky Canal embankment, 4, bldg. 1, apt. 428. For identification, only necessary information is requested, taking into account the requirements of the law.

Information upon request is provided within ten working days; an extension of no more than five working days is allowed with reasoned notification in cases provided for by law. For clarification, termination of processing and destruction, special deadlines are applied in Articles 20 and 21 of Law No. 152-FZ. Advertising processing will stop immediately upon request.

If data is processed on behalf of a client, the request is transferred to the relevant client and executed in cooperation with him. This does not limit the possibility of direct appeal of the subject and the rights provided for by law.

9 Termination of processing and destruction

After achieving the purpose or withdrawal of consent, in the absence of another basis, processing is terminated, the data is destroyed within the time frame provided for in Article 21 of Law No. 152-FZ, usually no later than 30 days. Data in backup copies is also included in the termination and destruction procedure; the presence of a copy is not an independent basis for indefinite storage. If it is impossible to destroy it in a timely manner as provided for by law, the data is blocked and destroyed within the period established by Part 6 of Article 21.

Documents confirming consent and compliance with legal requirements may be stored separately to a minimum extent to protect rights and confirm the legality of processing if there is an appropriate basis. Continued storage does not mean continued advertising use.

10 Policy Change

The current version is posted at https://buyora.ai/en/legal/privacy. Significant changes to the purposes, data, recipients and reasons are brought to the attention of affected persons; new consent is obtained where it is needed. The mere publication of a new version does not replace the required consent and does not legalize previously unlawful processing.