Who is the personal data operator?

Individual entrepreneur Yaroslav Andreevich Kononenko, OGRNIP 325774600902629, INN 973302875846. Data is processed under Federal Law No. 152-FZ "On Personal Data"; the terms are in the Privacy Policy.

In which country is my data stored?

Accounts, chats, files, company data and connection keys are stored in databases in Ireland and the Netherlands. Website and app traffic passes through network nodes in Russia, while model requests, task code execution and error logs are processed in the USA. Roskomnadzor has been notified of the cross-border transfer. The exact list of countries and recipients is on the Sub-processors page.

Are models trained on my chats and files?

We don't train our own models on your chats and files, and we don't sell data. For the agent to reply, the request text and the fragments it needs go to the model provider: the provider processes them on our instructions and to produce the agent's reply, not for its own purposes. The list of providers is on the Sub-processors page.

Do you have ISO 27001 or SOC 2 certification?

Not yet. The safeguards are described in the Privacy Policy (section 7) and on this page.

Can Samreshuuu staff see my chats?

A small group of administrators has access to data. To run the service and investigate failures they use error logs and technical data, and they open the content of chats and files only as far as a specific problem requires, or when the law demands it.

What happens to my data if I delete my account?

Settings → Account → Delete Account. An email with a confirmation link arrives; once you confirm, deletion is scheduled 30 days out, the date shows in settings, and until then it can be cancelled. After that the account and its data are deleted for good. Payment documents are kept as long as the law requires, and an organization's shared data stays with it.

Data and security

In short: the personal data operator is in Russia and processes data under 152-FZ, data is stored in databases in Ireland and the Netherlands, connection keys are encrypted, we don't train our own models on your chats, and both a data archive and account deletion are in settings. If anything here differs from the documents below, the documents apply.

Documents

Privacy Policy: what data, why, on what basis, how long it is kept, your rights.
Sub-processors: who carries out part of the processing, which data and in which country.
Consent to Personal Data Processing.
Terms of Service and Offer Agreement.

Who the operator is

The personal data operator is individual entrepreneur Yaroslav Andreevich Kononenko, OGRNIP 325774600902629, INN 973302875846, who is also responsible for organizing personal data processing. Data of partner program participants is processed by SAM RESHU LLC, as stated in section 1 of the policy.

If your files, mail or accounting system hold data about your customers and employees, you are the operator of that data, and we process it on your instructions (Article 6, Part 3 of Law No. 152-FZ). You give those instructions by accepting the Terms of Service. Under section 4 of the policy, an organization can request a separate processing agreement through support.

Where data is stored and transferred

What	Where it is processed
Accounts, chats, files, memory, company data, connection keys	Databases in Ireland and the Netherlands
Website and app traffic, agent emails	Network nodes in Russia
Model requests, task code execution, error logs	USA

Some recipients are outside Russia. We transfer data to them on the grounds of Article 12 of Law No. 152-FZ and have notified Roskomnadzor of the cross-border transfer to these countries. If your data includes other people's data, the list of countries on the Sub-processors page helps you arrange the cross-border transfer on your side.

How data is protected

Encryption. Data is encrypted in transit (TLS) and at rest.
Connection keys. Integration keys and tokens are stored separately, encrypted, and never shown in the clear. Any connection can be revoked.
Passwords and codes. You enter the password, two-factor code and CAPTCHA on a website yourself: the agent never asks you to dictate them in the chat. More: Apps and your computer.
A bank card for agent purchases is stored only on your device, in the system keychain, and is never sent to our servers.
Connection permissions. In a service the agent can do only what the account you connected it with is allowed to do. Connect an account with the minimum rights needed, read-only for example.
Outside instructions. The text of pages, emails and files is data to the agent, not commands. Everything the agent changes or sends goes through auto-review: risky actions come to you as a card, and anything unrelated to your request is blocked. More: Approving actions.

The service does not yet hold ISO 27001 or SOC 2 certification.

Access to the account and organization

Two-factor authentication: Settings → Devices & sessions, with an authenticator app or a security key.
Require a second factor for the organization: Settings → Organization → Organization sign-in security, for the owner and administrators or for every member.
Corporate login via OIDC or SAML: Settings → Corporate login.
Sign-ins and devices: Settings → Devices & sessions; any sign-in and any computer can be ended or revoked.
Roles and visibility: what colleagues and the admin see is on Who sees what.

Who on our side can see your data

Access is limited to a small group of administrators. To run the service and investigate failures they use error logs and technical data. They open the content of chats and files only as far as a specific problem requires, or when the law demands it.

If an incident happens

We notify Roskomnadzor of personal data incidents in the manner and within the time limits set by law. If an incident affects data you entrusted to us, we let you know so you can meet your obligations as operator (section 7 of the policy). The current state of the service is on the status page.

What model providers receive

For the agent to reply, the language model provider receives the request text and the fragments of the chat and documents the reply needs. Like every other sub-processor, the provider processes them on our instructions and to produce the agent's reply, not for its own purposes. Speech recognition, web search, speech synthesis and image generation also go through providers from the list, and only when you use that feature. Which models each plan runs on is in Plans.

Is your data used for training

We don't train our own models on your chats and files, and we don't sell data. Interface analytics with screen recording turns on only with your consent: you can turn it off in Settings → Privacy → Analytics and screen recording.

For a one-off sensitive question, open Incognito mode: such a chat is not saved to history and nothing is written to memory. More: Chats and context. Memory in ordinary chats is turned off in Settings → Memory → Use memory in chats.

Where data from connected services ends up

What the agent gets from an accounting system, CRM, marketplace, bank or mailbox is handled the same way as your request:

what the reply needs goes to the model;
the result stays in the chat or in the task results;
an export or report the agent put together as a file is in the chat where it sent it;
when the agent runs code for a calculation, the data is processed in the task's isolated computing environment.

How long chat attachments are kept is shown in Settings → Privacy, in the What we keep group.

How long data is kept

account data is kept while you have the account or until you delete it;
data of a deleted account is destroyed within the period set in the Privacy Policy, unless the law requires keeping it longer;
payment and accounting documents are kept as long as the law requires, including after the account is deleted;
if the account belongs to an organization, the organization's shared data stays with it.

How to download your data

Request the archive

Settings → Privacy → Export data.

Wait for it

You can close the page: the archive appears in the same place. It holds chats, memory, tasks and settings in one JSON file. Files themselves are not included, so download the ones you need from your chats.

Download it in time

Next to the archive you see its size and the date until which the link works.

How to delete your account

Request deletion

Settings → Account → Delete Account → Delete.

Confirm by email

A link arrives by email. Once you confirm, deletion is scheduled 30 days out, and settings show the line "Deletion scheduled for …".

Changed your mind

Until that date you can cancel the deletion in the same settings. After it, the account and all its data are deleted for good.

Download what you need first

Deleted data can't be restored. If you may still need your chats or memory, download the archive first.

Can it run on our own servers

For companies with special requirements on where data lives, terms are discussed separately: on the Pricing page, click Discuss terms in the Enterprise Solution block, or write to support.

Where to write about your data

Send questions about personal data, a request to see what data we hold about you, or a demand to correct or destroy it, to support@samreshuuu.ru from the email your account uses. All your rights are listed in the Privacy Policy.