Privacy Policy

Effective May 13, 2026

1.General provisions

This personal data processing policy is drafted in accordance with the requirements of Federal Law No. 152-FZ of the Russian Federation "On Personal Data" (27 July 2006), the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"), and the California Consumer Privacy Act (CCPA). It defines how personal data is processed and the security measures applied by the self-employed specialist Alexandra Alekhina, taxpayer identification number (TIN/INN) 771565308502 (the "Operator").

1. The Operator considers compliance with the rights and freedoms of every individual in connection with personal-data processing — including the right to privacy, personal and family secrecy — to be a paramount goal.
2. This policy applies to all information that the Operator may obtain about visitors to the website at https://alexa-a.ru and users of the Telegram bot at @Aleksa_A_bot.

2.Definitions

• Website — the collection of graphic and informational materials available at https://alexa-a.ru.
• Telegram bot — the program on the Telegram platform, accessible at @Aleksa_A_bot, through which the Operator accepts inquiries, payments, and ongoing client correspondence.
• User — any visitor to the Website or user of the Telegram bot.
• Personal data — any information relating directly or indirectly to an identified or identifiable User.
• Processing of personal data — any operation or set of operations performed on personal data, whether by automated means or not: collection, recording, organisation, accumulation, storage, adaptation or alteration, retrieval, use, disclosure, alignment or combination, restriction, erasure or destruction.
• Anonymisation — operations after which it is no longer possible to determine, without additional information, the personal data's connection to a specific User.
• Cross-border data transfer — transfer of personal data into the territory of a foreign state to a foreign natural or legal person.

3.What data the Operator processes

The Operator collects only the minimum data necessary to deliver the services and fulfil contractual obligations:

• Telegram identifiers: Telegram user ID, first/last name (if present in the user's Telegram profile), username, interface language.
• Conversation content with the Telegram bot: text messages, photos, videos, and documents voluntarily submitted by the client.
• Payment metadata: Stripe and Wata.pro transaction identifiers, amount, currency, payment status. The Operator does not receive or store bank-card details — card data is processed entirely on the side of the payment providers.
• Booking data: appointment date and time, the package selected, the Zoom meeting identifier, and the Google Calendar event identifier.

The Operator may also collect anonymised data about Website visits (IP address, browser type, pages viewed, visit time) via cookies and web-statistics services.

The Operator does not request or process biometric or special-category personal data (health information, medical diagnoses, lab results) except where the User voluntarily shares such information during a consultation. Any such information is treated as part of the consultation conversation and is protected by the confidentiality measures described in section 7.

4.Purposes of processing

• Identifying the User when they reach out and during service delivery;
• Booking sessions and provisioning Zoom access;
• Accepting payments and processing refunds;
• Client support and correspondence about the services;
• Performing contractual obligations to the client;
• Complying with Russian tax law and other applicable regulations (as a self-employed specialist);
• Improving service quality and user interfaces based on anonymised analytics.

The Operator does not send marketing communications to Users and does not share data with third parties for advertising purposes.

5.Lawful basis for processing

• The User's consent, expressed by initiating correspondence with the Telegram bot, completing the support form on the Website, or taking other affirmative actions that clearly indicate an intent to obtain the Operator's services.
• Performance of a contract to which the User is a party (the offer agreement published at https://alexa-a.ru/terms.html).
• Compliance with legal obligations as a self-employed specialist and taxpayer of the Russian "Tax on Professional Income" regime.
• The Operator's legitimate interests — for example, to prevent abuse and to improve service quality.

6.User rights

Under GDPR, CCPA, and Russian Federal Law No. 152-FZ, Users have the right to:

• Receive information about the categories and purposes of processing of their personal data;
• Request rectification of inaccurate data;
• Request erasure of their data ("right to be forgotten");
• Restrict processing;
• Receive a copy of their data in a machine-readable format (data portability);
• Withdraw previously given consent;
• Lodge a complaint with the supervisory authority (Roskomnadzor in the Russian Federation; the relevant Data Protection Authority in the EU).

All requests should be sent to help@alexa-a.ru. The Operator commits to respond within 30 (thirty) calendar days.

7.Storage and security

• Data is collected via the Telegram bot, the support form on the Website, and at booking time.
• Storage: data is held in the Operator's database (managed via Supabase) with encryption at rest (AES-256) and in transit (TLS 1.2+).
• Card data is never stored in the Operator's systems — card details are handled on the side of Stripe (PCI DSS Level 1) and Wata.pro within their own secured environments.
• Access to personal data is limited to the Operator only.
• Retention period: up to 3 (three) years from the User's last interaction with the Operator's services, or until consent is withdrawn — whichever happens first. After the retention period expires, data is erased or anonymised, except where retention is required by law (e.g. tax records for the self-employed specialist).

8.Cookies

The Website uses only strictly necessary cookies (for serving pages and remembering the interface language). Analytics cookies are not used at the time of publication. If the Operator adds analytics in the future, a notice with an opt-out mechanism will be added to the Website.

The Telegram bot uses the standard session-storage mechanisms provided by the Telegram platform itself. These are outside the Operator's control and are governed by the Telegram Messenger Inc. policy.

9.Sharing with third parties

The Operator shares the minimum personal data necessary with the following processors solely to perform contractual obligations to the User:

• Telegram FZ-LLC (Dubai, UAE) — message delivery and bot identification. Governed by the Telegram Privacy Policy.
• Stripe, Inc. (San Francisco, USA) — accepting USD payments from Users outside the Russian Federation. Stripe is PCI DSS Level 1 compliant and operates under EU Standard Contractual Clauses.
• Wata.pro / OOO "VATA" (Russian Federation) — accepting RUB payments from Users in the Russian Federation.
• Zoom Video Communications, Inc. (San Jose, USA) — running online consultations. The shared data is limited to: meeting identifier, session start/end, and the join link.
• Google LLC (Mountain View, USA) — Google Calendar for managing the consultation schedule. The shared data is limited to: appointment date, time, and event title.

The Operator does not share personal data with any third party for advertising or marketing purposes.

10.Cross-border transfers

Some of the processors listed in section 9 (Stripe, Zoom, Google, Telegram) operate outside the Russian Federation. Transfers to those jurisdictions take place with the User's affirmative consent, expressed by initiating use of the relevant service (for example, paying via Stripe implies consent to transferring payment metadata to the United States).

The Operator works only with processors that have signed Standard Contractual Clauses or otherwise provide an adequate level of data protection consistent with GDPR and Federal Law No. 152-FZ.

11.Contact

12.Closing

The Operator reserves the right to update this Policy. The new version takes effect from the moment of its publication at https://alexa-a.ru/privacy-en.html. Material changes will additionally be communicated to the User through the Telegram bot.

By taking the actions described in section 5, the User confirms that they have read this Policy and agree to its terms.