Privacy Policy

1.1.This Policy is drawn up in accordance with Federal Law No. 152-FZ of 27.07.2006 "On Personal Data" (the Law) and sets out which personal data of the users of the MillionViews site at millionviews.plus (the Site) is processed, for what purposes, how it is protected and what rights the users have.

1.2.The operator of personal data is Индивидуальный предприниматель Кирин Максим Игоревич (the Operator). The Operator's details and contacts are given in section 11.

1.3.The Policy applies to all personal data the Operator receives about the users of the Site (the Users). Terms not defined in the Policy have the meanings given in the Law and in the Public Offer.

1.4.By registering an Account, the User consents to the processing of their personal data on the terms of the Policy. By using the Site without registering, the User agrees to the processing of the data listed in clause 2.6 and section 7.

1.5.The Policy is publicly available at millionviews.plus/privacy.

2.1.Account data: the email address and the password. The password is stored only as a hash from which it cannot be recovered.

2.2.Sign-in and security data: IP address, browser information (user agent), the date and time of registration and sign-in, the session cookie, and records of sign-in and registration attempts (email address, IP address, time, result).

2.3.Payment data: the amount, date, status and identifier of a payment, and the email address passed to the Lava payment service to set up the payment. The User enters bank card details on the page of the payment service; the Operator neither receives nor stores them.

2.4.Materials and records of using the Site: uploaded videos, the captions of orders, records of orders, posts and Balance transactions. Videos may show people's images and voices: the User is responsible for having their consent where the law requires it.

2.5.Correspondence with the Operator: the email address and the content of the messages.

2.6.Data about visits to the Site collected by the Yandex Metrika service: cookies, IP address, information about the browser, operating system and device, the pages viewed, where the visit came from and actions on the pages (clicks, scrolling, cursor movements), including as session recordings (Webvisor).

2.7.The Operator does not process special categories of personal data or biometric personal data.

3.1.The Operator processes personal data in order to:

• register an Account, sign in to it and identify the User;
• conclude and perform the agreement on the terms of the Public Offer: take orders, publish posts, keep the Balance, accept payments and make refunds;
• answer requests and support Users;
• keep the Site secure: protect it from password guessing, abuse and fraud;
• meet obligations set by law, including accounting and tax obligations;
• analyze visits to the Site and its use in order to improve it.

3.2.The Operator does not send the User advertising mailings without their separate consent.

4.1.The Operator processes personal data on the basis of:

• the User's consent (item 1 of part 1 of article 6 of the Law);
• an agreement to which the User is a party (item 5 of part 1 of article 6 of the Law);
• obligations placed on the Operator by law (item 2 of part 1 of article 6 of the Law);
• the need to exercise the Operator's rights and legitimate interests, including protecting the Site from abuse, provided that the User's rights are not violated (item 7 of part 1 of article 6 of the Law).

5.1.The Operator collects, records, organizes, accumulates, stores, clarifies (updates, changes), retrieves, uses, transfers (provides, gives access to), anonymizes, blocks, deletes and destroys personal data. Processing is done both with and without automated means.

5.2.The Operator transfers personal data to third parties only to the extent needed for the purposes of processing:

• Hetzner Online GmbH (Germany) — provides the servers and the file storage the Site runs on and the data is kept in;
• the Lava payment service (lava.top) — the email address and the payment details, to carry out the payment;
• the ParityPay payment service (paritypay.net) — the payment details (the amount, identifier and purpose of the payment), to carry out a payment in rubles; the email address is not passed to ParityPay;
• Yandex LLC — the data about visits to the Site collected by Yandex Metrika, processed under Yandex's rules;
• state bodies — in the cases provided for by law.

5.3.The videos and captions of posts are published on Instagram and become publicly available. The email address and other Account data are not passed to Instagram. Instagram is a social network owned by Meta Platforms Inc., whose activities are recognized as extremist and banned in the Russian Federation.

5.4.The servers the Site runs on and the data is kept on are located in the Republic of Singapore, and the file storage in the Federal Republic of Germany. The Operator transfers personal data across the border to these states in the manner set by article 12 of the Law.

5.5.Retention periods:

• Account data and records of orders — while the Account exists and up to 30 days after it is deleted;
• payment records and related documents — for the periods set by accounting and tax law;
• records of sign-ins and sign-in attempts — no longer than needed to keep the Site secure;
• videos — until the User deletes them, subject to the storage terms of the Public Offer; unique copies are deleted once their post is over;
• correspondence — no longer than needed to answer the request and settle possible disputes.

5.6.Personal data is destroyed when the purposes of processing are achieved, when consent is withdrawn and the Operator has no other legal grounds for processing, or at the User's request, within the periods set by the Law.

6.1.The User may:

• get information about the processing of their personal data (article 14 of the Law);
• demand that their personal data be clarified, blocked or destroyed if it is incomplete, outdated, inaccurate, unlawfully obtained or not needed for the stated purposes;
• withdraw consent to the processing of personal data;
• appeal against the Operator's actions or inaction to Roskomnadzor or to a court.

6.2.A request or a withdrawal of consent is sent to the Operator's email address from the email address of the Account, or by post to the Operator's address. The Operator answers within 10 working days of receiving the request; this period may be extended by no more than 5 working days if the Operator tells the User why.

6.3.Withdrawing consent does not affect the lawfulness of processing before it. The services cannot be provided without the Account data, so once consent is withdrawn the Account is deleted, and the data the Operator must keep by law is kept for the periods set.

7.1.The Site uses:

• a session cookie that keeps the User signed in to the Account (for up to 30 days); without it, signing in to the Dashboard is impossible;
• Yandex Metrika cookies, used to collect visit statistics.

7.2.The User can delete cookies and block them in the browser settings, and turn off data collection by Yandex Metrika with Yandex's opt-out add-on. With cookies blocked, signing in to the Dashboard is impossible.

8.1.The Operator takes legal, organizational and technical measures to protect personal data from unlawful access, destruction, alteration, blocking, copying and distribution, including:

• data travels between the browser and the Site over the secure HTTPS protocol;
• passwords and session keys are stored only as hashes;
• the number of sign-in and registration attempts is limited;
• only people who need the data for their work have access to it, with separate access rights;
• the servers are housed in data centers with security and access control.

9.1.The Site is not intended for people under 18. If the Operator learns that it has received the personal data of such a person, it will delete the Account and its data.

10.1.The Operator may change the Policy. A new version enters into force when it is published on the Site, unless it states otherwise.

10.2.The current version of the Policy is always available at millionviews.plus/privacy.

10.3.The Policy is drawn up in Russian. The English translation is provided for convenience; if the texts differ, the Russian text prevails.