Privacy Policy

English translation of the Russian original. The Russian original controls.

Version dated 19.10.2026 · Effective from 19.10.2026 · buyora.ai

This document describes what personal data the buyora.ai website collects, why it is needed, how it is processed and protected, and what rights you have as a personal data subject.

Personal data operator

Name: Sole proprietor Tertyshny Mark Vyacheslavovich

OGRNIP: 326253600045296

INN: 253714814872

General provisions

1.1. This Privacy Policy (the Policy) has been developed in accordance with Federal Law No. 152-FZ of 27.07.2006 “On Personal Data” and sets out the procedure for processing personal data and the measures taken to ensure its security by sole proprietor Tertyshny Mark Vyacheslavovich (the Operator).

1.2. The Policy applies to all information that the Operator may obtain about visitors to the buyora.ai website (the Website) and users of the buyora.ai service (the Service).

1.3. This Policy describes data processing when visiting the Website, submitting its contact form, contacting the Operator by email and using the Service under a separate agreement. Reading this Policy does not replace separate consent where consent is required for processing.

1.4. If you disagree with the terms of the Policy, please do not provide your personal data to the Operator and stop using the Website.

Personal data operator

2.1. The personal data operator is sole proprietor Tertyshny Mark Vyacheslavovich, OGRNIP 326253600045296, INN 253714814872.

2.2. The Operator independently determines the purposes and composition of the personal data processed and the operations performed on it, and is responsible for compliance with personal data legislation.

2.3. For questions about personal data processing, use the email address provided in section 12.

Data processed

3.1. The Operator processes only the personal data that you provide voluntarily and the technical data that the Website collects automatically.

3.2. The Operator does not process special categories of personal data (concerning racial or ethnic origin, political views, religious beliefs, health or intimate life) or biometric personal data.

3.3. The Operator does not knowingly collect personal data from persons under 18. The Website and Service are intended for representatives of legal entities and sole proprietors.

Purposes and legal grounds for processing

4.1. Personal data is processed for the following purposes:

processing a request for a demonstration of the Service and contacting you to agree on the demonstration time and format;

conducting business correspondence and responding to questions and enquiries;

entering into, performing and terminating a contract for use of the Service, including creating user accounts;

providing information about the operation of the Service, changes to terms and technical maintenance;

ensuring the operation and security of the Website and Service and preventing fraud;

analysis of anonymized technical logs to maintain and improve the Website;

fulfilling obligations imposed by the legislation of the Russian Federation.

4.2. The legal grounds for processing are: the personal data subject’s consent (Article 6, part 1, clause 1 of Law No. 152-FZ); the need to enter into and perform a contract to which the subject is a party or beneficiary (Article 6, part 1, clause 5); exercising the Operator’s rights and legitimate interests, provided the subject’s rights are not infringed (Article 6, part 1, clause 7); fulfilling obligations imposed on the Operator by law (Article 6, part 1, clause 2).

4.3. Submitting the contact form requires separate consent to personal data processing. Consent is given by selecting an initially unchecked box linked to the consent text. Enquiries are processed to answer questions, arrange demonstrations and conduct business correspondence. Advertising messages require separate consent.

How data is processed

5.1. Personal data processing includes collection, recording, systematisation, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (provision, access), anonymisation, blocking, deletion and destruction.

5.2. Processing is performed both with and without automated means.

5.3. The Website and the contact-form database are hosted on a server in the Russian Federation. Each enquiry is first stored in this database, then notification copies are sent to the Operator through Telegram and to info@buyora.ai through Zoho email hosted in a European data center. Zoho is also used for business correspondence. Section 6 describes data transfers.

5.4. The Operator does not make decisions that produce legal consequences for a subject solely on the basis of automated personal data processing.

Transfer of data to third parties

6.1. The Operator does not sell or transfer personal data to third parties for their own purposes.

6.2. The Operator uses hosting and email providers to operate the Website and conduct correspondence. A copy of a contact-form enquiry (name, company, contact details, message, language, submission time and enquiry identifier) is sent to the Operator’s work chat through a Telegram bot and to info@buyora.ai through Zoho. These third-party services may use infrastructure outside the Russian Federation. These transfers are considered separately from hosting the primary database in Russia; clause 6.4 describes the requirements for cross-border transfers.

6.3. Personal data may be transferred to authorised state authorities on the grounds and in accordance with the procedure established by the legislation of the Russian Federation.

6.4. Cross-border transfers of personal data are carried out only in compliance with Article 12 of Law No. 152-FZ.

Retention periods

7.1. Personal data is retained no longer than required by the processing purposes:

demo request data — until the processing purpose is achieved, but no longer than 1 year from the last contact, if no contract is entered into during that period;

business correspondence data — for 3 years from the last enquiry;

account data and data entered in the Service — for the duration of the contract and 3 years after its termination, unless otherwise provided by the contract or law;

technical access logs — no longer than 1 year.

7.2. When the retention period expires, the processing purpose is achieved or consent is withdrawn (if no other lawful grounds exist), personal data is destroyed or anonymised within 30 days.

Cookies and analytics

8.1. The Website does not use analytics or advertising cookies. Language selection uses links between the Russian and English pages without storing the selection in cookies.

8.2. No web analytics services or advertising pixels are connected to the Website. The server maintains technical access logs to support operation and security.

8.3. The interactive comparison uses fictional data, runs in the browser and does not upload visitors’ documents. The CSV file is generated on the visitor’s device. The contact form sends the contact details and enquiry text entered in it, together with technical information used to record consent and prevent abuse.

Rights of the personal data subject

9.1. You have the right to:

receive information about the processing of your personal data, including confirmation that processing takes place, its purposes, methods and periods, and the composition of the data processed;

request clarification, blocking or destruction of personal data if it is incomplete, outdated, inaccurate, unlawfully obtained or unnecessary for the stated purpose;

withdraw consent to personal data processing;

challenge the Operator’s actions or omissions before the authorised authority for the protection of personal data subjects’ rights (Roskomnadzor) or in court.

9.2. To exercise your rights, send a request to the email address provided in section 12. Include your name, the contact details you used when communicating with the Operator, and the substance of your enquiry. The Operator responds within 10 working days of receiving the request; this period may be extended by no more than 5 working days, with notice to you of the reasons.

9.3. Withdrawal of consent does not affect the lawfulness of processing performed before withdrawal and does not stop processing carried out on other lawful grounds (for example, to perform a contract).

Personal data protection

10.1. The Operator takes the necessary legal, organisational and technical measures to protect personal data against unlawful or accidental access, destruction, modification, blocking, copying, provision and dissemination.

10.2. These measures include: data transmission over secure channels (HTTPS), access controls, storage with providers that protect their infrastructure, backups, appointing a person responsible for organising personal data processing, and informing persons with access to the data of the requirements of legislation and this Policy.

10.3. If an incident resulting in an unlawful transfer of personal data is identified, the Operator notifies the authorised authority and takes measures in accordance with the procedure and deadlines established by Law No. 152-FZ.

Changes to the Policy

11.1. The Operator may amend this Policy. A new version takes effect when published on the Website, unless otherwise provided in that version. The date of the current version is given at the beginning of this document.

11.2. The current Policy is available through a permanent link on the Website. Changes to the Policy do not replace consent to new processing purposes where such consent is required by law.

Contact details

12.1. Direct all questions concerning personal data processing, including the requests provided for in section 9, to the Operator:

Sole proprietor Tertyshny Mark Vyacheslavovich
OGRNIP 326253600045296, INN 253714814872
Email: info@buyora.ai