← Pricing · Offer · RU

Personal data processing policy

Edition dated 13.07.2026 · Site: iranpetrochemstats.ru

1. Personal data operator

Operator: sole proprietor Kocherov Vasiliy Andreevich (TIN 772606453045, OGRNIP 326774600345700).
Requisites: iranpetrochemstats.ru/legal/requisites.
Contact for personal data matters: info@iranpetrochemstats.ru.

2. What data is processed

Depending on user actions, the Operator processes the following categories of data:

• Registration and account: email address, full name, organisation name (if provided), organisation TIN (if provided), password hash (bcrypt), date and time of accepting the offer and privacy policy, last login date;
• Corporate request: company name, TIN, contact person, email, phone (if provided), comment;
• Billing: plan, subscription and payment details (amount, status, payment-provider identifiers), usage counters (export, API);
• Team work: email addresses of invited users, role in the organisation;
• API access: key name, masked prefix, key hash, last-used date (keys are never stored in plain text);
• Technical data: session identifier (cookie), IP address — within the scope described in section 8;
• Service logs: email addresses and notification texts in the outbound mail queue (if SMTP is temporarily unavailable).

Aggregated market quotes published on the platform are not personal data (including the demo fragment on the pricing page, which is not tied to a specific user).

3. Purposes and legal bases of processing

• registration, authentication, and granting access to the platform — performance of a contract (the offer);
• invoicing, accepting payment, and subscription accounting — performance of a contract and requirements of Russian law;
• technical support and replies to enquiries — performance of a contract and the Operator’s legitimate interest;
• protection against abuse (limiting login attempts) — the Operator’s legitimate interest;
• retaining payment data for accounting and tax purposes — legal obligation of the Operator.

4. Processing methods and storage

Processing is carried out using automated means. User personal data is stored in an SQLite database on a server located in the Russian Federation (Yandex Cloud infrastructure). Passwords are stored only as irreversible bcrypt hashes.

The outbound mail queue (email_queue.log) and database backups may contain personal data and are stored on the same server in a protected file system.

5. Transfer to third parties

Personal data may be disclosed to the following categories of recipients — only to the extent necessary:

• Payment services (NCO “YuMoney” / YooKassa, partner bank for settlements) — to process payment and issue a receipt;
• Hosting provider (Yandex Cloud) — to host server infrastructure in the Russian Federation;
• Email operator (SMTP provider, if configured) — to deliver notifications;
• Technical CDN providers (fonts, charting library) — the user’s browser may contact their servers; the IP address and technical request parameters are transmitted. Advertising analytics and behavioural tracking are not used.

Personal data is not sold or disclosed for marketing purposes.

6. Retention periods

• account data — until the account is deleted at the user’s request or use of the service ceases;
• payment details and closing documents — at least 3 (three) years from the transaction date (accounting and tax requirements);
• server access logs (nginx) — up to 90 (ninety) calendar days, unless a longer period is required to investigate an incident;
• outbound mail queue — up to 180 (one hundred eighty) calendar days, or until SMTP with direct delivery is configured.

7. Security measures

Organisational and technical measures are applied: HTTPS, login-attempt limits, password hashing, access-rights segregation, database backups, and isolation of the server environment.

8. Cookies, local storage, and logs

• Cookie dashboard_session — mandatory session cookie for sign-in (valid up to 7 days). Authorisation is impossible without it;
• Browser sessionStorage — dashboard UI settings (language, filters); not sent to the server;
• IP address — used to rate-limit login attempts (in application memory, not written to the database); may be recorded in web-server (nginx) logs when the site is accessed;
• User-Agent — not deliberately stored by the application; may appear in web-server logs.

Third-party online advertising and behavioural analytics systems are not connected.

9. Rights of the data subject

You have the right to:

• obtain information about the processing of your data;
• request rectification, blocking, or deletion of data;
• withdraw consent (where processing is based on consent);
• appeal the Operator’s actions to Roskomnadzor or to a court.

10. Account deletion

To delete your account, email info@iranpetrochemstats.ru with the subject “Account deletion” from the email address used at registration. Processing time — up to 30 calendar days.

After deletion, access to the platform is blocked; account personal data is deleted or anonymised, except for information the Operator is legally required to retain (payments, accounting documents) for the periods stated in section 6.

11. Policy changes

The current version is published at /legal/privacy-en (Russian: /legal/privacy). Registered users are notified by email of material changes.