Privacy Policy

This Privacy Policy explains how Uniscript Carousel Factory (operated by sole proprietor Mikhail Demyanovich Piptev, Russia; further "we", "our", "Service") collects, uses, and protects your personal data when you use our service at carousel.uniscript.app.

We comply with applicable data-protection laws including the EU General Data Protection Regulation (GDPR), the UK GDPR, and the Russian Federation Federal Law No. 152-FZ "On Personal Data".

1. Data we collect

Account data. When you create an account we collect:

• Email address (used as login)
• Authentication identifier (from Google Sign-in or password hash)
• IP address and approximate location (city level, for fraud prevention and analytics)
• Browser fingerprint (a hash of browser characteristics — used to prevent abuse of free trial)

Content you upload. Photos and any text or metadata you submit to create carousels. We store them in your private user folder; they are visible only to you.

Usage data. Logs of API requests, generation events, payment records.

Cookies. See section 7 below.

2. Legal basis for processing (GDPR Art. 6)

• Contract performance — to provide the Service you signed up for (account, photo storage, generation).
• Legitimate interests — fraud prevention, security, service improvement.
• Consent — for marketing emails and non-essential cookies (you can withdraw at any time).
• Legal obligation — to comply with tax and accounting requirements of the Russian Federation.

3. How we use your data

• Provide and maintain the Service
• Process payments via our payment processors (Robokassa, T-Bank)
• Apply AI generation using Anthropic Claude models (your inputs are sent to Anthropic and processed under their terms; Anthropic does not train on customer API data)
• Send transactional emails (signup confirmation, payment receipts)
• Send marketing emails — only if you opt in
• Detect and prevent abuse
• Comply with legal obligations

4. Data sharing

We share data only with the following processors, each bound by a Data Processing Agreement (DPA) or equivalent terms:

Google Cloud (Firebase)	Hosting, authentication, database, file storage. EU and US data centers.
Anthropic	AI generation. Your prompts are sent to claude-sonnet/haiku models; not used for training.
Robokassa	International payment processing (cards from outside RF).
T-Bank	Payment processing for Russian cards.
Pexels	Source of base photo bank — no personal data shared.
Yandex Metrika	Analytics (only if you consent to non-essential cookies).

We do not sell or rent your personal data to anyone.

5. International transfers

Your data may be processed in the United States (Google Cloud, Anthropic) and Russia (T-Bank, Robokassa, our office). Transfers from the EU/UK to the US are protected by Standard Contractual Clauses. Transfers to Russia are based on your explicit consent (provided at signup).

6. Data retention

• Account data — kept while the account is active.
• After account deletion — most data is erased within 30 days. Financial records of past payments are retained for 5 years as required by tax law.
• Marketing consent records — kept for 3 years after withdrawal of consent.

7. Cookies

We use the following cookies:

• Essential (cannot be disabled): Firebase authentication token, language preference, your theme choice.
• Analytics (only with your consent): Yandex Metrika, VK Ads Pixel — for measuring traffic and ad performance.

You can manage your cookie choice via the banner on first visit, or by clearing the cf_cookie cookie in your browser.

8. Your rights (GDPR Art. 15-22)

You have the right to:

• Access — request a copy of your personal data
• Rectification — correct inaccurate data
• Erasure ("right to be forgotten") — delete your account via Profile → Delete account, or by emailing us
• Restriction — limit our processing
• Portability — receive your data in a machine-readable format
• Objection — object to processing based on legitimate interests
• Withdraw consent — for marketing emails or non-essential cookies

To exercise any right, email uniscript@mail.ru. We will respond within 30 days.

You also have the right to lodge a complaint with a supervisory authority in your country of residence.

9. Security

We use industry-standard security: HTTPS/TLS 1.2+ for all traffic, encrypted storage on Google Cloud, role-based access control, and Firebase Auth for authentication. We regularly audit our infrastructure and address vulnerabilities promptly.

10. Children

The Service is not directed at children under 16. We do not knowingly collect data from children under 16. If you believe a child has provided us data, contact us immediately and we will delete it.

11. Changes to this policy

We may update this policy. Material changes will be announced via email and a notice on the Service at least 30 days before they take effect.

12. Contact

Data controller	Sole Proprietor Mikhail Demyanovich Piptev
Tax ID (INN)	540451328241
Registration number (OGRNIP)	326547600083728
Address	Russia, 630087, Novosibirsk, Titova str., 242/2
Email	uniscript@mail.ru