Consent to the Processing of Personal Data

Last updated: 2026-07-15 Version: 1 Applies to: all LighChat clients (web, desktop, mobile).

⚠️ Draft. Requires legal review and placeholder completion before publication.

This consent is provided as a separate document in accordance with Russian Federal Law No. 152-FZ "On Personal Data" (as amended, effective 01.09.2025) and is not part of the Terms of Service or the Privacy Policy.

By ticking the corresponding box at registration, acting freely, by your own will and in your own interest, you give [LEGAL ENTITY NAME] (Reg. No. [TAX_ID], address [ADDRESS]) (the "Operator") your consent to process your personal data on the terms below.

1. Categories of personal data

• email address;
• phone number (if provided or verified);
• name, username, avatar, profile details (at your discretion — bio, date of birth);
• device and session data (device identifier, platform, login country/city derived from IP; the IP address itself is not stored);
• content you create and transmit through the Service (messages, files, calls), to the extent necessary to operate the Service;
• technical data required to deliver notifications (push tokens).

2. Purposes of processing

• registration, authentication and account management;
• operating the Service: messaging, calls, storing and delivering content;
• security, fraud and abuse prevention;
• sending service and push notifications;
• compliance with legal requirements;
• improving the Service and analytics in anonymized form (only with separate consent to analytics cookies).

3. Processing operations

Collection, recording, systematization, accumulation, storage, adaptation (updating, modification), extraction, use, transfer (provision, access), anonymization, blocking, deletion and destruction — by both automated and non-automated means.

4. Transfer to third parties

To provide the Service the Operator engages processors acting on its behalf. The current list is in the "Sub-processors Registry" (/legal/subprocessors). As of this version it includes, among others: cloud infrastructure and push-delivery providers, email and SMS/verification-code providers, and a media-server provider for calls.

5. Cross-border transfer

You are notified that certain processing operations may take place on servers located outside the Russian Federation (including in countries that do not ensure adequate protection of data-subject rights). By ticking the consent box you consent to the cross-border transfer of your personal data for the purposes above. The Operator files the corresponding notification with Roskomnadzor under Art. 12 of 152-FZ.

Note for the future RF segment: once data localization is in place, the primary recording of RF users' data will occur within the Russian Federation; cross-border transfer will be secondary only and within the scope of consent.

6. Term and withdrawal

The consent is valid from the day it is given until the purposes of processing are achieved or until it is withdrawn.

You may withdraw your consent at any time: in the app under Settings → Privacy, or by contacting [OPERATOR_EMAIL]. Withdrawal entails cessation of processing and deletion of personal data, unless the Operator retains another lawful basis for processing (e.g. statutory retention). Withdrawal is equivalent to deleting the account with respect to data that cannot be processed without consent.

7. Your rights

You have the right to access your data, to have it rectified, blocked or deleted, to obtain information about the processing, and to export your data in a machine-readable format (Settings → Privacy → Export data).

8. Contacts

• Operator: [LEGAL ENTITY NAME], [ADDRESS]
• Personal-data enquiries: [OPERATOR_EMAIL]