Privacy Policy

This document is a courtesy translation provided for information purposes only. The legally binding version is the Russian original: Читать на русском / Read in Russian.

Document summary (provided for convenience, has no independent legal force)

Operator – Sole Proprietor M. A. Gindinson (ИП Гиндинсон М. А.). Operates the Cutor platform and is responsible for your data.
What is collected. Name, e-mail, role, lesson results, chat correspondence, technical data (IP, cookies). Bank card details are not stored.
Why. So that the Platform works: registration, lessons, notifications, payment, security.
To whom it is transferred. Only to those needed to operate the service: hosting, mail, payment provider. All servers are located in Russia. Data is neither sold nor disclosed.
AI. Creates exercises. Receives only educational content – your personal data is not sent to it. Data is not used to train AI models.
Analytics and advertising. Yandex.Metrica and VK Pixel – only with your consent.
Security. Encryption, password hashing, protection against attacks, backups.
How long it is stored. As long as you have an account. After deletion – the data is deleted, backup copies – up to 30 days.
Children. Registered by a parent. We do not send marketing to children.
Your rights. Find out what is stored; obtain a copy; demand deletion; file a complaint with Roskomnadzor.
Contact information. legal@cutor.ru – we will respond within 30 days.

The full text of the document is provided below.

---

Revision dated [DATE]

This Privacy Policy (hereinafter – the "Policy") establishes the procedure for processing and protecting personal data that the Operator receives from Users of the Platform, and is published in accordance with Art. 18.1 of Federal Law No. 152-FZ "On Personal Data" dated 27.07.2006 (hereinafter – "152-FZ").

Terms used with an initial capital letter are applied in the meanings defined by the Terms of Use (cutor.ru/legal/terms).

1. Operator

1.1. The operator of personal data is:

Sole Proprietor Gindinson Mikhail Aleksandrovich OGRNIP: 326527500104423 · INN: 183511073463 Address: 603155, Nizhny Novgorod, ul. Maksima Gorkogo, d. 232, kv. 5 Number in the register of operators of Roskomnadzor: 52-26-260092 Contact address: legal@cutor.ru Platform website: cutor.ru

1.2. The Operator determines the purposes and methods of processing personal data, ensures their protection, and is responsible for compliance with the requirements of 152-FZ.

2. Scope of application

2.1. The Policy applies to all personal data that the Operator receives from Users when they use the Platform, including data provided during registration, in the course of using the functions of the Platform, as well as data obtained automatically (technical data, cookies).

2.2. The Policy does not apply to third-party sites to which the Platform may contain links. The Operator is not responsible for the processing of personal data by third parties.

2.3. Additional documents governing individual aspects of processing:

Consent to the processing of personal data (cutor.ru/legal/consent) – grounds and scope of processing, procedure for granting and withdrawing consent;
Cookie Policy (cutor.ru/legal/cookies) – list and classification of cookies, consent management;
Terms of Use (cutor.ru/legal/terms) – conditions for using the Platform;
Referral Program Terms (cutor.ru/legal/referral) – conditions for participating in the referral program.
Session Bank Terms of Use (cutor.ru/legal/session-bank) – conditions for using the Session Bank

3. Principles of personal data processing

The Operator is guided by the following principles (Art. 5 of 152-FZ):

3.1. Processing is carried out on a lawful and fair basis.

3.2. Processing is limited to the achievement of predetermined, specific, and lawful purposes (Section 5).

3.3. The merging of databases containing personal data whose processing is carried out for purposes that are incompatible with each other is not permitted.

3.4. Only those personal data that correspond to the purposes of their processing are processed; the processed data are not excessive.

3.5. The content and scope of personal data correspond to the stated purposes of processing.

3.6. During processing, the accuracy, sufficiency, and relevance of personal data are ensured.

3.7. Storage is carried out no longer than required by the purposes of processing (Section 9).

3.8. Personal data are subject to destruction or anonymization upon achievement of the purposes of processing or in the event of loss of the need to achieve those purposes (Section 9).

4. Legal grounds for processing

The Operator processes personal data on the following grounds (Art. 6 of 152-FZ):

4.1. Consent of the data subject (Art. 6 part 1 clause 1) – provided as a separate document (cutor.ru/legal/consent) in accordance with the requirements of Federal Law No. 156-FZ dated 24.06.2025. Mandatory consent is required to use the Platform; optional consents (marketing mailings, extended analytics) are given separately and do not affect access.

4.2. Performance of a contract (Art. 6 part 1 clause 5) – processing necessary for the performance of the Terms of Use (provision of Platform functions, payment processing, service notifications, mandatory and functional cookies).

4.3. Fulfillment of obligations established by law (Art. 6 part 1 clause 2) – processing necessary to comply with the requirements of the legislation of the Russian Federation (the Tax Code of the Russian Federation, Federal Law No. 402-FZ "On Accounting" dated 06.12.2011).

4.4. Legitimate interests of the Operator (Art. 6 part 1 clause 7) – ensuring the security and stable operation of the Platform, preventing abuse, improving the quality of service, as well as other legitimate interests of the Operator, provided that such processing does not violate the rights and freedoms of the personal data subject.

5. Purposes of processing

5.1. The Operator processes personal data for the following purposes:

a) registration, creation, and management of an account, authentication (including via VK ID, Yandex ID);

b) provision of Platform functions: creation and conduct of educational lessons, assignment and completion of tasks, tracking of results and learning activity, as well as other existing and future functions of the Platform;

c) sending service (transactional) notifications related to the operation of the account and learning activity;

d) ensuring the security of accounts and preventing abuse;

e) processing subscription payments (for Users in the role of Tutor);

f) sending informational and advertising messages (only with a separate consent);

g) analysis of User behavior on the Platform to improve the service, going beyond anonymized statistics (only with a separate consent);

h) analysis of traffic and improvement of the Platform using the Yandex.Metrica service (only with a separate consent);

i) measuring the effectiveness of advertising campaigns using the VK Pixel service (only with a separate consent);

j) fulfillment of the requirements of the legislation of the Russian Federation.

6. Categories of personal data

6.1. The Operator processes the following categories of data (to the extent actually provided by the User or generated when using the Platform):

identification: surname, first name, patronymic (and/or display name), information about being of/under the age of majority, profile photo (when uploaded by the User), as well as other identification data voluntarily provided by the User;
contact: email address, as well as other contact data voluntarily provided by the User;
account: login, protected (hashed) password, role (Tutor / Student), tariff plan; identifiers and profile data obtained when logging in via VK ID or Yandex ID (to the extent provided by the respective service);
educational and communication: assigned lessons, task completion results, learning activity, chat correspondence, etc.;
referral: identifier of the referring User, registration date of the invited person, reward status (when participating in the referral program);
technical: IP address, characteristics of the device and browser (including digital identifiers), cookies, event logs;
payment (for Tutors): information necessary for payment processing; bank card details are not stored by the Operator and are processed by the payment provider;
cookie data: list and classification – in the Cookie Policy (cutor.ru/legal/cookies).

6.2. Special categories of personal data and biometric personal data are not processed by the Operator.

7. Persons to whom personal data are transferred

7.1. The Operator entrusts the processing of personal data to the following persons, acting on its instructions and on the terms of confidentiality and compliance with the requirements of 152-FZ:

Processor	Purpose	Territory
TIMEWEB.CLOUD LLC (ООО «ТАЙМВЭБ.КЛАУД») (INN 7810945525, OGRN 1227800052215)	Hosting and data storage	RF
RSIC JSC (АО «РСИЦ») (INN 7733573894, OGRN 1067746823099)	Sending emails	RF
DDOS-GUARD LLC (ООО «ДДОС-ГВАРД») (INN 9204005780, OGRN 1149204010988)	Traffic filtering, protection of Platform availability	RF
T-Bank (JSC "TBank", АО «ТБанк») (TIN 7710140679, BIC 044525974)	Payment processing (for Tutors); bank card details are not stored by the Operator	RF

7.2. Authentication services. When the User chooses to log in via VK ID or Yandex ID, profile data are transferred by the respective service to the extent permitted by the User. VK and Yandex are independent operators of personal data and act on the basis of their own privacy policies.

7.3. Use of AI services. The AI functions of the Platform use third-party models via API to generate exercises and check educational materials. Only educational content is transmitted in requests to AI services (exercise texts, task parameters, language proficiency level, and other data necessary for generating and checking educational materials); identification and contact data of Users are not included in the requests. User data are not used to train, fine-tune, or improve AI models.

7.4. Analytics and marketing services. With a separate consent of the User, data may be transferred to:

YANDEX LLC (ООО «ЯНДЕКС») (INN 7736207543, OGRN 1027700229193) – Yandex.Metrica web analytics; servers on the territory of the RF;
VK LLC (ООО «ВК») (INN 7743001840) – VK Pixel; servers on the territory of the RF.

Details – in the Cookie Policy (cutor.ru/legal/cookies).

7.5. No dissemination is carried out. The Operator does not disseminate personal data (does not disclose them to an indefinite range of persons) and does not transfer them to third parties for their own purposes.

7.6. Cross-border transfer. The Operator does not carry out cross-border transfer of personal data. All processors specified in clauses 7.1 and 7.4 store data on servers located on the territory of the Russian Federation.

8. Protection of personal data

8.1. The Operator takes the necessary legal, organizational, and technical measures to protect personal data from unlawful or accidental access, destruction, alteration, blocking, copying, provision, dissemination, as well as from other unlawful actions (Art. 19 of 152-FZ).

8.2. Protection measures include:

storage of data on servers located on the territory of the Russian Federation;
encryption of data transmission (TLS/HTTPS);
password hashing;
restriction of access to personal data (only the Operator has access);
regular backups;
protection against DDoS attacks;
security monitoring and event logging;
conducting regular checks of the integrity and availability of data.

8.3. The Operator assesses the sufficiency of protection measures and updates them as necessary.

8.4. In the event that an incident resulting in a leak of personal data is identified, the Operator notifies Roskomnadzor within 24 hours and Users – within 72 hours from the moment the incident is discovered (Art. 21.1 of 152-FZ).

9. Terms of processing and storage

9.1. Personal data are processed for as long as the purpose of processing exists, and are destroyed upon its achievement or the loss of necessity.

9.2. Specific terms:

Category of data	Storage period	Grounds
Account data (identification, contact, account)	Until the account is deleted by the User or the Operator	Performance of a contract
Educational and communication data (results, activity, chat correspondence, etc.)	Until the account is deleted	Performance of a contract
Referral program data	Until the account of the referring User is deleted or the reward is paid out (whichever occurs later)	Performance of a contract (Referral Program Terms)
Payment data	In accordance with the requirements of the Tax Code of the Russian Federation and the Federal Law "On Accounting" (at least 5 years)	Art. 6 part 1 clause 2 of 152-FZ
Consent data (consent_records)	For the entire period of validity of the consent and at least 3 years after its withdrawal	General limitation period (Art. 196 of the Russian Civil Code (ГК РФ)) – for the purposes of proving compliance with 152-FZ
Event logs (technical)	12 months	Ensuring security
Backup copies	30 calendar days	Data recovery

9.3. After the account is deleted, the data are deleted or anonymized in the main database; backup copies are stored for no more than 30 calendar days (Consent, clause 9.1).

10. Rights of the personal data subject

10.1. The User (and, in respect of a minor – their legal representative) has the right (Art. 14–16 of 152-FZ):

a) to obtain information about the processing of their personal data, including: confirmation of the fact of processing, the legal grounds and purposes of processing, the methods applied, the name and address of the Operator, the list of processed data, the terms of their processing and storage, the procedure for exercising rights;

b) to demand clarification, blocking, or destruction of their personal data if they are incomplete, outdated, inaccurate, unlawfully obtained, or not necessary for the stated purpose of processing;

c) to withdraw consent to the processing of personal data (the procedure – in the Consent, clause 9.2);

d) to obtain a copy of their personal data within 30 calendar days from the date of the request;

e) to demand that the Operator explain the procedure for making decisions based solely on automated processing (Art. 16 of 152-FZ);

f) to appeal the actions or inaction of the Operator to the authorized body for the protection of the rights of personal data subjects (Roskomnadzor) or to a court.

10.2. Requests are sent to legal@cutor.ru. Upon receiving a request, the Operator sends a confirmation to the email address specified in the User's account. If the User has not received a confirmation within 3 business days, it is recommended to resend the request. The Operator considers requests within up to 30 calendar days from the moment of confirmation of receipt.

11. Processing of personal data of minors

11.1. Registration of the account of a minor Student (a person under the age of 18) is performed by a parent (legal representative) (clauses 3.7–3.8 of the Terms of Use). Consent to the processing of a minor's personal data is provided by the parent (legal representative) (Consent, clause 2.2).

11.2. Personal data of minors are processed with enhanced protection measures, are not used for marketing purposes, and are not transferred to third parties, except in cases expressly provided for by law.

11.3. The parent (legal representative) has access to the educational data of the minor. Upon reaching the age of 18, the account may be re-registered by the Student in their own name in accordance with clause 3.13 of the Terms of Use.

12. Automated processing

12.1. The Platform uses automated tools to ensure security and prevent abuse. Decisions affecting the User's access to the Platform are not made solely on the basis of automated processing: the results of automated assessment are checked manually before measures are applied (Art. 16 of 152-FZ). The User has the right to send a reasoned request to review a decision made to legal@cutor.ru.

13. Localization

The collection, recording, systematization, accumulation, storage, clarification, and extraction of personal data of citizens of the Russian Federation are carried out using databases located on the territory of the Russian Federation (part 5 of Art. 18 of 152-FZ).

14. Cookies

The Platform uses cookies. Types, list, storage periods, consent management, and deletion instructions are described in the Cookie Policy (cutor.ru/legal/cookies).

15. Changes to the Policy

The Operator has the right to update this Policy at any time at its own discretion. The current revision is posted at cutor.ru/legal/privacy. In the event of significant changes, Users are notified in the manner provided for by the Terms of Use (Section 13).

16. Contacts

Questions regarding the processing of personal data should be sent to legal@cutor.ru.

---

Operator: Sole Proprietor Gindinson Mikhail Aleksandrovich OGRNIP: 326527500104423 · INN: 183511073463

---