Privacy Policy
Version of 29 October 2026
This page explains in plain words what data we receive when you use Samreshuuu, why we need it, who we share it with and how you can control it. A short version first, then the details. If the short version differs from the detailed text, the detailed text prevails.
In short
- The main things we receive: your email, your chats with the agent, files, and access to the systems you connect yourself.
- To answer you, the agent passes the request text and the fragments it needs to a language model provider. The list of recipients is on the Subprocessors page.
- We do not sell your data and do not train our own models on your chats and files.
- Interface analytics runs only with your consent, and you can opt out at any time.
- You can delete your account in settings.
- Questions about your data: support@samreshuuu.ru.
1. Who we are and what this policy covers
Data controller: Whatnot Hungary Kft., registration number 01 09 441632, tax number 32769300-2-41, VAT number HU32769300, address: 1053 Budapest, Veres Pálné utca 28. 3. em. 16. ajtó.
The policy covers the samreshuuu.com website, the web app, the Samreshuuu mobile and desktop apps, messenger bots and Samreshuuu apps installed into third-party systems: CRM, accounting and inventory systems. The service is intended for people over 18.
The policy follows the General Data Protection Regulation (Regulation (EU) 2016/679, GDPR). Consent to data processing is a separate document.
2. What data we receive
We process data of service users, representatives of client companies, partners, website visitors, and people whose data users bring into the service themselves (section 4). What exactly we receive depends on which features you use.
When you sign in
Your email and a confirmation code. If you sign in with Yandex ID, Google, Apple, Telegram, MAX or your organization's corporate sign-in, we receive an identifier and the profile data you allowed them to share, such as your name and email. We also note where you came from: an ad tag, a referral code or a promo code.
Profile and company
Your name, phone number, company details (name, tax number, address, business description) and billing details, if you provide them.
Working with the agent
Messages and replies, chat titles, uploaded files, task results. Voice messages, photos and videos, including ones with your face and voice, are processed like any other file: speech is transcribed and the content is passed to the model to answer. We do not use them to identify you, so they are not biometric personal data (Article 11 of Law No. 152-FZ). The agent remembers facts that help with the work (memory): for example, how your company is set up and how you prefer to receive reports. You can view and turn off memory in settings.
Connected systems
When you connect an accounting system, CRM, marketplace, bank, mailbox or another service from the catalog, access keys and tokens are stored with protective measures, including encryption. The agent receives data from the system to fulfil your requests and can do in it only what the connected account is allowed to do. So connect an account with the minimum rights needed, for example read-only. Data received this way is handled like your request: it may be passed to the language model and is kept in chats and task results.
Desktop app
The agent works with files in the folder you choose, with the browser and with your computer's screen while carrying out your tasks, within the permissions in the access settings. What it receives is handled like files in a chat. If you save a bank card for the agent's purchases, the card number, expiry date and CVC are stored only on your device, in the operating system's keychain, and are not sent to our servers. While the card is filled into the payment fields of a page, no screenshot is sent, and the values of those fields are hidden on the device before anything is sent. On the server we keep a purchase log: the site, the items, the amount, the store's order number, the time and the last four digits of the card, without the card number.
Messengers and notifications
If you connect a messenger, we store your identifier there. For push notifications we store the device token.
Payments
Payment and plan details. Card data is handled by the payment service; we do not receive the full card number. For a company invoice we use the payer's details.
Technical data
IP address, cookies and device identifiers, device and browser type, sign-in time, activity and error logs.
Partner program
If you are a partner: payout details (tax number, bank details) and your accrual history.
3. Why we process data and on what basis
For each purpose you can see what data it needs, on what basis we process it and how long we keep it.
We do not send marketing emails without your separate consent. We send service messages (about tasks, payments, security, changes to terms) without separate consent because they are needed to perform the contract.
We do not make decisions that have legal or similarly significant effects on you based solely on automated processing (Art. 22 GDPR).
| Purpose | Data | Basis | How long we keep it |
|---|---|---|---|
| Signing in | email, sign-in data, technical data | contract, Art. 6(1)(b) GDPR (Terms of Use) | while the account exists |
| The agent's work: replies, tasks, files, connections | chats, files, memory, profile and company data, data from connected systems and your computer (sections 2.4 and 2.5) | contract, Art. 6(1)(b) GDPR | while the account exists or until you delete them |
| Payments, receipts and invoices | payment data, company details, email | contract and law, Art. 6(1)(b) and 6(1)(c) GDPR | as long as the law requires |
| Tracking sign-up sources, promo codes and partner accruals | ad tag, referral code, promo code | contract and legitimate interest, Art. 6(1)(b) and 6(1)(f) GDPR | while the account exists or as long as the law requires |
| Notifications about tasks and the service | email, messenger, device token | contract, Art. 6(1)(b) GDPR | while notifications are on |
| Support | requests and support correspondence | contract, Art. 6(1)(b) GDPR | while the account exists |
| Security and abuse prevention | technical data, activity logs | legitimate interest and law, Art. 6(1)(f) and 6(1)(c) GDPR | as long as an investigation needs and the law requires |
| Interface analytics and debugging | data from section 8 | consent, Art. 6(1)(a) GDPR | until you withdraw consent |
| Improving the service | usage statistics | legitimate interest, Art. 6(1)(f) GDPR, in anonymized form | while needed to improve the service |
| Partner program | partner details, accruals | contract and law, Art. 6(1)(b) and 6(1)(c) GDPR | as long as the law requires |
4. Other people's data in your files and systems
Documents, mailboxes, CRMs and accounting systems often contain data about your customers, employees and partners. You are the controller of that data, and we process it as your processor (Art. 28 GDPR) and only to fulfil your requests. You give this instruction by accepting the Terms of Use. By connecting a system or uploading a file you confirm that you have the right to share this data for such processing. Organizations can request a separate data processing agreement at support@samreshuuu.ru.
Do not upload health data, biometrics or other special categories of data (Art. 9 GDPR): we do not aim to process them. If such data ends up in your files or systems, we process it only on your instruction, and you are responsible for the lawfulness of sharing it.
If a person whose data you shared contacts us, we may redirect their request to you.
5. Who we share data with
We do not sell data. We share it only with the recipients listed below and to the extent needed for the relevant purpose:
- language model, speech and document recognition, and web search providers: the request text and the fragments needed for the answer;
- hosting, data storage, computing environment and error logging providers;
- payment services, banks and the fiscal data operator: for payment, invoices and receipts;
- push notification delivery services and the messengers you connected;
- the systems you connected yourself, at your request;
- analytics services, if you agreed to analytics (section 8);
- our advisers (lawyers, auditors) bound by confidentiality, when needed to protect our rights;
- courts, government authorities and other parties at their lawful request.
6. Transfers abroad
Some recipients are outside the EU and EEA. What data each of them receives and where it is located is listed on the Subprocessors page. We transfer data to them under the European Commission's standard contractual clauses (Art. 46 GDPR) or an adequacy decision.
If your files and systems contain other people's data, you are the controller of that data (section 4). The list of countries on the Subprocessors page will help you assess the transfer on your side.
7. Where data is stored and how we protect it
Accounts, documents, chats, company data and access keys to connected systems are stored on servers in the EU and EEA and processed under the GDPR.
How we protect it:
- we take technical and organizational measures under Art. 32 GDPR, including encryption and access control;
- access to data is limited to a small group of administrators: to run the service and investigate failures they use error logs and technical data, and they open the content of chats and files only to the extent needed to solve a specific problem, or when the law requires it.
8. Cookies and analytics
The site cannot keep you signed in without essential cookies, so they are always on.
Analytics runs only with your consent. We use web analytics services, including session recording, to find errors and make the interface easier to use. We configure recording to hide the contents of input fields. A recording may be linked to your account so we can investigate a specific error.
You can opt out at any time: with the button below, with Cookie settings at the bottom of the site, or in the app under Settings → Privacy.
9. How long we keep data and how we delete it
We keep data no longer than its purpose requires:
- account data is kept while you have the account;
- the data of a deleted account is destroyed within 30 days unless the law requires keeping it longer;
- payment and accounting documents are kept as long as the law requires, including after the account is deleted;
- information needed to protect our rights in a dispute may be kept until the limitation period expires;
- if the account belongs to an organization, the organization's shared data stays with it;
- aggregated statistics that cannot identify a specific person are not personal data and may be kept longer.
10. Your rights
You can:
- access your data and learn how we use it;
- correct inaccurate data;
- have your data erased;
- restrict processing;
- receive your data in a machine-readable format: Settings → Privacy → Export data;
- object to processing;
- withdraw consent at any time;
- delete your account in settings;
- complain to a supervisory authority.
You can download an archive of your data in the app: Settings → Privacy → Export data.
After you withdraw consent, we may continue processing if another legal basis allows it. Withdrawal does not affect the lawfulness of processing before it.
How to reach us: write to support@samreshuuu.ru from the email your account is linked to. If we cannot verify your identity, we will ask for more information; until it is confirmed, no data is disclosed. We reply within the time limits set by Art. 12 GDPR.
11. Changes to the policy
We may update this policy. The new version is published on this page and applies from the date of publication unless it says otherwise. We tell you by email or in the app about changes that materially affect your rights. If a new purpose needs your consent, we will ask for it.
12. Contacts
For questions about personal data:
- email: support@samreshuuu.ru;
- controller: Whatnot Hungary Kft., 1053 Budapest, Veres Pálné utca 28. 3. em. 16. ajtó;
- supervisory authority: Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH), naih.hu.