Privacy Policy

DraftEffective date will be set at launch

How AISTETIKA handles your personal data: what we collect, why, on what legal basis, where it is stored, who receives it, how long we keep it and what rights you have.

1. Controller and contacts

1.1. The controller is company name, registered in country, address: registered address. Contact for privacy questions: privacy email.

1.2. We have not appointed a Data Protection Officer because the law does not require it for our processing. Please write to the email above.

2. What we collect, why and on what basis

We collect only what we need. Most data comes from you; some is created when you use the Service.

Account: Name, email, password (stored only as a one-way hash), language, avatar if you upload one, the time and text of your acceptance of the Terms. Basis: contract (Art. 6(1)(b) GDPR).
Sign-in and security: Session token, salted hash of your IP address, browser type, sign-in time, sign-in attempts, one-time codes. Basis: legitimate interest in keeping accounts and the Service secure (Art. 6(1)(f)). When you move between aistetika.ru and aistetika.online, a one-time pass valid for 2 minutes (your user number and the time) is created and deleted after a day.
Learning: Course enrolments and lesson progress: when a lesson was opened, your answers to self-check questions, whether it was completed. Deleted together with your account. Basis: contract. Work you send for an Iris review (images reduced and stripped of EXIF metadata; from videos only frames are kept) and the reviews are stored on our server until you delete the review or your account.
Studio: Prompts, uploaded files, generation results. Basis: contract.
Credits and payments: Credit transactions, orders, amount and payment method (no full card details). Basis: contract; legal obligation for accounting records (Art. 6(1)(c)).
Course gifts: The recipient’s name and email given by the giver, card language, message and delivery day; only a fingerprint of the gift code is stored. The recipient’s email is used only to deliver the gift and is deleted once the gift is accepted or expires. Basis: the contract made for the recipient’s benefit; legitimate interest in delivering the gift.
Emails and support: Address and subject of emails we send; your questions to the AI assistant and requests to a human in Support, our replies and any attached screenshots (stored on our server, not publicly); your email if you write as a guest. Basis: contract; legitimate interest in answering you.
One-time gift: A salted hash of your email address (not the address itself) and a note of the gift given (sign-up and free-course credits). Kept after account deletion, for as long as the gift programme runs, only so the gift is not given twice to the same email. The address cannot be recovered from the hash. Basis: legitimate interest in preventing abuse (Art. 6(1)(f)).
Marketing: We do not send marketing emails now. If we start, we will ask for your consent first (Art. 6(1)(a)).

3. Do you have to give us data

3.1. Your name, email and password are needed to create an account and perform the contract. Without them we cannot provide the Service. Everything else is optional.

3.2. We do not make decisions with legal or similarly significant effects about you based solely on automated processing. Iris reviews and self-check questions have no such effects.

3.3. Please do not put sensitive data (health, beliefs, biometrics) into prompts or support messages.

4. Where your data is stored

4.1. We are established in country, and our database runs on servers in the Russian Federation (Moscow). Your data is therefore processed outside the EU, the EEA and the UK, in a country without an adequacy decision of the European Commission or the UK. Information you send us is collected directly by us there.

4.2. We protect it with the measures in section 8 and limit onward transfers as described below.

5. Who receives your data

5.1. We share data only as needed for the purposes above, with service providers bound by contract to protect it:

hosting providers in the Russian Federation that run the website;
our email provider for service emails (email address and message): currently Gmail, Google LLC, USA;
payment providers, once payments launch (amount, email for the receipt);
developers of the school’s AI models, only when you write in the Studio, start a generation or ask the AI assistant Iris in Support or send work for an Iris review in a lesson, without your name or email: X.AI Corp (USA, Grok model) for the AI director’s replies, prompt improvement, images and short videos, which receives your Studio chat messages, prompts and uploaded files, and the frames (videos as frames) and prompts you send for an Iris review; Kuaishou Technology (China, Kling) and Google LLC (USA, Gemini and Veo) for videos and images, currently for Studio administrators only. Questions to the AI assistant in Support (your question, the conversation and any attached screenshot) are handled by the same X.AI Corp model. Voice input is transcribed on our own server and the audio is not sent anywhere.

5.2. Where data is sent to a country without adequate protection, we rely on safeguards such as the European Commission’s standard contractual clauses or, where they are not available, on the transfer being necessary to perform our contract with you (Art. 46 and 49(1)(b) GDPR).

5.3. We disclose data to authorities only when the law requires it. We do not sell your personal data and do not share it for targeted advertising.

6. How long we keep data

6.1. Account, learning and Studio data: until you delete your account. Unconfirmed accounts: 72 hours. Sessions: until you sign out, at most 30 days; one-time codes: 15 minutes; sign-in attempt logs and email logs: up to 12 months.

6.2. Payment records: as long as accounting and tax laws require (up to 5 years in our country of establishment). Conversations with the AI assistant only: 12 months. Conversations with a human: up to 3 years to handle possible claims; after account deletion they are kept without a link to the account.

7. Your rights

7.1. Under the GDPR and the UK GDPR you have the right to:

access your data and get a copy;
correct inaccurate data;
erase your data (you can also delete your account in Settings);
restrict processing;
receive your data in a portable format;
object to processing based on legitimate interests;
withdraw consent at any time, without affecting earlier processing.

7.2. Write to privacy email from your account email. We answer within one month (Art. 12(3) GDPR).

7.3. You can complain to the data protection authority of the country where you live or work (in the UK, the Information Commissioner’s Office), and we would appreciate the chance to resolve your concern first.

8. How we protect data

8.1. Passwords are stored only as one-way hashes and IP addresses in our database as salted hashes. Server logs with your IP address and browser are kept for up to 14 days to protect against attacks and failures, then deleted. Connections are encrypted (HTTPS). Access to the database is limited to people who need it. Backups are made regularly. If a breach is likely to put you at high risk, we will tell you without undue delay.

9. Cookies

9.1. We use only strictly necessary cookies for sign-in, language and moving your sign-in between our domains. We count visits and clicks ourselves on our own server, without cookies or third-party counters, and we respect Do Not Track and Global Privacy Control signals. No third-party analytics or advertising. Details: Cookie Policy.

10. California and other US states

10.1. Categories of personal information we collect are listed in section 2; we collect them from you and from your use of the Service, for the purposes listed there. We do not sell or share personal information for cross-context behavioural advertising.

10.2. Do Not Track: we do not track you across websites, and the Service works the same whether or not your browser sends a Do Not Track signal.

10.3. You can ask what information we hold about you and ask us to delete or correct it at privacy email. We will not treat you differently for using your rights.

11. Children

11.1. The Service is for adults: accounts require age 18 or older. If we learn that a person under 18 has created an account, we will delete it and its data.

12. Changes

12.1. We publish the new version of this Policy on this page with its effective date. We tell registered users by email about material changes.

Version: draft of 8 November 2026. This document is not yet in force. Questions: contact email.