Privacy Policy

This Privacy Policy explains how Uniscript Carousel Factory (operated by sole proprietor Mikhail Demyanovich Piptev, Russia; further "we", "our", "Service") collects, uses, and protects your personal data when you use our service at carousel.uniscript.app.

We comply with applicable data-protection laws including the EU General Data Protection Regulation (GDPR), the UK GDPR, and the Russian Federation Federal Law No. 152-FZ "On Personal Data".

1. Data we collect

Account data. When you create an account we collect:

• Email address (used as login)
• Authentication identifier (from Google Sign-in or password hash)
• IP address and approximate location (city level, for fraud prevention and analytics)
• Browser fingerprint (a hash of browser characteristics — used to prevent abuse of free trial)

Content you upload. Photos and any text or metadata you submit to create carousels. We store them in your private user folder; they are visible only to you.

Usage data. Logs of API requests, generation events, payment records.

Cookies. See section 7 below.

2. Legal basis for processing (GDPR Art. 6)

• Contract performance — to provide the Service you signed up for (account, photo storage, generation).
• Legitimate interests — fraud prevention, security, service improvement.
• Consent — for marketing emails and non-essential cookies (you can withdraw at any time).
• Legal obligation — to comply with tax and accounting requirements of the Russian Federation.

3. How we use your data

• Provide and maintain the Service
• Process payments via our payment processors (Robokassa, T-Bank)
• Apply AI generation using Anthropic Claude models (your inputs are sent to Anthropic and processed under their terms; Anthropic does not train on customer API data)
• Send transactional emails (signup confirmation, payment receipts)
• Send marketing emails — only if you opt in
• Detect and prevent abuse
• Comply with legal obligations

4. Data sharing

We share data only with the following processors, each bound by a Data Processing Agreement (DPA) or equivalent terms:

Selectel (Russia)	Account and sign-in: email, password hash, IP addresses, device data, sign-in and consent logs. Servers in Moscow, Russia.
Google Cloud (Firebase)	Hosting, database, file storage for your work in the Service, under a pseudonymous ID without your email. EU and US data centers.
Anthropic	AI generation. Your prompts are sent to claude-sonnet/haiku models; not used for training.
Groq	Speech-to-text for the audio track of a video you upload when creating a carousel from a video. US servers.
Robokassa	International payment processing (cards from outside RF).
T-Bank	Payment processing for Russian cards.
Pexels	Source of base photo bank — no personal data shared.
Yandex Metrika	Analytics (only if you consent to non-essential cookies).
Google Ads	Ad-performance measurement (only with your consent). US servers.

We do not sell or rent your personal data to anyone.

5. International transfers

The Service is operated by a sole proprietor in Russia, who collects your data directly from you. Your account data (email, password hash, IP addresses, device data) is stored in Russia (Selectel, Moscow). Data about your work in the Service is stored under a pseudonymous ID in Google Cloud (EU/US) and processed by Anthropic and Groq (US) to provide the Service; payments are processed in Russia (T-Bank, Robokassa).

6. Data retention

• Account data — kept while the account is active.
• After account deletion — most data is erased within 30 days. Financial records of past payments are retained for 5 years as required by tax law.
• After account deletion we keep, for 12 months, only an irreversible hash of your email together with the count of free carousels and one-time discounts already used, so that signing up again with the same email does not grant a new free allowance (our legitimate interest in preventing abuse). The email address itself is not kept.
• Marketing consent records — kept for 3 years after withdrawal of consent.

7. Cookies

We use the following cookies:

• Essential (cannot be disabled): Firebase authentication token, language preference, your theme choice.
• Analytics (only with your consent): Yandex Metrika, VK Ads Pixel, Google Ads — for measuring traffic and ad performance.

You can manage your cookie choice via the banner on first visit, or by clearing the cf_cookie cookie in your browser.

8. Your rights (GDPR Art. 15-22)

You have the right to:

• Access — request a copy of your personal data
• Rectification — correct inaccurate data
• Erasure ("right to be forgotten") — delete your account via Profile → Delete account, or by emailing us
• Restriction — limit our processing
• Portability — receive your data in a machine-readable format
• Objection — object to processing based on legitimate interests
• Withdraw consent — for marketing emails or non-essential cookies

To exercise any right, email uniscript@mail.ru. We will respond within 30 days.

You also have the right to lodge a complaint with a supervisory authority in your country of residence.

9. Security

We use industry-standard security: HTTPS/TLS 1.2+ for all traffic, encrypted storage on Google Cloud, role-based access control, and Firebase Auth for authentication. We regularly audit our infrastructure and address vulnerabilities promptly.

10. Children

The Service is not directed at children under 16. We do not knowingly collect data from children under 16. If you believe a child has provided us data, contact us immediately and we will delete it.

11. Changes to this policy

We may update this policy. Material changes will be announced via email and a notice on the Service at least 30 days before they take effect.

12. Contact

Data controller	Sole Proprietor Mikhail Demyanovich Piptev
Tax ID (INN)	540451328241
Registration number (OGRNIP)	326547600083728
Roskomnadzor registry of personal data operators	No. 54-26-061823
Address	Russia, 630120, Novosibirsk, Titova str., 242/2
Email	uniscript@mail.ru