Telenoda This is a translation. The Russian text is legally binding.
1. General provisions
1.1.
This Policy sets out how the personal data of users of the Telenoda messenger and visitors to the websites telenoda.org and core.telenoda.org is processed and protected. The Policy was developed in accordance with Federal Law No. 152-FZ of 27.07.2006 “On Personal Data”.
1.2.
The personal data operator is the administration of the Telenoda service (the “Operator”).
1.3.
Requests regarding the processing of personal data are accepted in the support chat in the Telenoda app.
1.4.
The Policy is publicly available in accordance with Part 2 of Article 18.1 of Law No. 152-FZ. Terms are used in the meanings established by Law No. 152-FZ.
2. What data we process
| Category | What it includes | Source |
|---|---|---|
| Account | Phone number, name, username, photo, bio, date of birth and profile channels, if you provided them | From you |
| Settings | Privacy and exceptions, notifications, appearance, block list | From you |
| Contacts | Hashes of phone numbers from your address book and the list of found contacts, if you allowed access. Contact names are not transmitted | From your device |
| Messages and materials | Text, photos, videos, voice and video messages, files, polls, reactions, drafts | From you and other users |
| Information about messages and calls | Sender, recipients, time, delivery and read statuses, call history: participants, time, duration | Generated by the Service |
| Technical data | IP address and the country and city determined from it, device model and operating system, app version, session and device identifiers, sign-in times, notification tokens | From your device |
| Sign-in with Yandex ID | The phone number from your Yandex profile, to match it with the account number | From the Yandex ID service, if you chose this method |
| Requests and reports | Correspondence with support, reports and the materials attached to them | From you and other users |
| Bot owners | Created bots, token issuance history, webhook addresses, IP addresses of requests to the Bot API | From you and from your servers |
| Website visitors | IP address, request time, page address, browser information in web server logs | From your browser |
2.1.
We do not intentionally collect special categories of personal data or biometric personal data. Such information may end up in messages at the users' own discretion.
2.2.
Speech recognition and message translation in the iPhone app are performed on the device. Audio and text are not transmitted to the Operator.
3. Purposes and legal grounds
| Purpose | Data | Legal ground (152-FZ) |
|---|---|---|
| Registration, sign-in and identification by phone number | Account, technical | Performance of a contract (cl. 5, Part 1, Art. 6), legal requirement (cl. 2, Part 1, Art. 6) |
| Delivery of messages and calls, device synchronization | Messages, information about messages, technical | Performance of a contract |
| Finding friends via contacts | Contacts | Consent (cl. 1, Part 1, Art. 6) |
| Notifications | Notification tokens, technical | Performance of a contract |
| Protecting accounts from hacking, spam and fraud | Technical, information about messages | Legitimate interests (cl. 7, Part 1, Art. 6) |
| Handling reports and requests, moderation | Requests and reports | Performance of a contract, legitimate interests |
| Operation of the bot platform | Bot owners' data | Performance of a contract |
| Fulfilment of obligations established by law | To the extent provided by law | Legal requirement |
| Operation and protection of the websites | Web server logs | Legitimate interests |
3.1.
We do not use personal data or message content for advertising and do not sell personal data.
3.2.
Decisions with legal consequences are not made solely on the basis of automated processing. Automated anti-spam tools may temporarily restrict sending messages; such a restriction can be appealed via the support chat.
4. How messages are stored
4.1.
Messages and materials are stored on the Operator's servers in encrypted form. Every chat has its own encryption key, and keys are stored separately from the data. Data transfer between the apps and the servers is protected by TLS 1.3.
4.2.
Regular chats do not use end-to-end encryption: the server can decrypt messages to deliver them to all of the user's devices. Access to message content is restricted: moderators only see material attached to a report.
4.3.
Notification content is encrypted with the key of the app installation. Notification services only receive encrypted data.
5. Who receives the data
5.1.
Other users see your data according to your privacy settings. Content of public channels and groups is available to everyone.
5.2.
Bots receive the messages you sent them, your identifier, name and username; mini apps receive the same profile data at launch. Your phone number is passed to a bot only if you shared it yourself. The bot owner processes this data as an independent operator.
5.3.
Processing on behalf of the Operator (Part 3 of Article 6 of Law No. 152-FZ), subject to confidentiality and data protection, is carried out by:
- Selectel LLC — hosting of servers and file storage in Saint Petersburg; message content and files are stored in encrypted form;
- Timeweb LLC — balancing of incoming connections: IP addresses and encrypted traffic;
- Yandex.Cloud LLC — encryption key management service, with no access to messages or other user data;
- the operator of the SMS.RU service — phone number verification by call: phone number;
- Apple, RuStore and browser notification services — device token and encrypted notification content.
5.4.
The Yandex ID service receives and transmits data only if you chose to sign in with it.
5.5.
Government bodies receive information in the cases and manner established by law, at the request of authorized bodies.
6. Place of processing and cross-border transfer
6.1.
Recording, systematization, accumulation, storage, clarification and retrieval of personal data of citizens of the Russian Federation are carried out using databases located in the territory of the Russian Federation (Part 5 of Article 18 of Law No. 152-FZ).
6.2.
Cross-border transfer is carried out in accordance with Article 12 of Law No. 152-FZ and only to the extent necessary to deliver notifications: the device token and encrypted notification content are transmitted to Apple Inc. services (USA) for Apple devices and to browser notification services (Google LLC, Mozilla Corporation, Apple Inc., USA) for the web version.
7. Retention periods
7.1.
Account data is stored until the account is deleted.
7.2.
Messages and materials are stored until the user deletes them, and until the account is deleted. Copies in encrypted backup storage are deleted within 6 months.
7.3.
Technical data is stored until the account is deleted; security logs are kept for 3 years. Web server logs of the websites are overwritten as they fill up.
7.4.
If the Operator is subject to the obligations of an information dissemination organizer (Article 10.1 of Federal Law No. 149-FZ of 27.07.2006 “On Information, Information Technologies and the Protection of Information”), information about the facts of receipt, transmission, delivery and processing of messages and about users is stored for one year, and the content of messages for up to six months from the end of their receipt, transmission, delivery and processing.
7.5.
After the retention periods expire or when consent is withdrawn, data is destroyed within the time limits established by Article 21 of Law No. 152-FZ, unless otherwise provided by law.
8. Your rights
8.1.
You have the right to receive information about the processing of your data and access to it, to demand the clarification, blocking or destruction of incomplete, outdated, inaccurate or unlawfully obtained data, to withdraw consent, and to appeal the Operator's actions to Roskomnadzor or in court (Articles 14 and 17 of Law No. 152-FZ).
8.2.
Much of this is available in the app: edit your profile, set up privacy, delete messages and synced contacts, terminate sessions, delete your account (“Privacy → Delete account”). You can get a copy of your data by request in the support chat.
8.3.
We respond to requests within 10 business days; this period may be extended by 5 business days with an explanation of the reasons. To make sure the request was sent by you, we may ask you to send it from the app where you are signed in.
8.4.
When an account is deleted, all sessions end, the phone number and username are freed, and the messages you sent remain with the recipients and in communities.
9. Data protection
9.1.
The Operator takes legal, organizational and technical protection measures (Articles 18.1 and 19 of Law No. 152-FZ): encryption of connections and stored data, separate storage of encryption keys, access control and logging, encrypted backups, regular vulnerability checks.
9.2.
The Operator notifies Roskomnadzor of personal data incidents within the time limits established by Part 3.1 of Article 21 of Law No. 152-FZ, and notifies users if an incident affects their rights.
10. Children
10.1.
The Service is not intended for persons under the age specified in the Terms of Service. If we learn that we have received a child's data without the consent of a legal representative, we will delete it.
11. Websites, cookies and browser storage
11.1.
The websites telenoda.org and core.telenoda.org do not use cookies, visit counters or third-party analytics services. Fonts are loaded from our servers.
11.2.
The web version web.telenoda.org stores data in the browser without which it cannot work: session information, settings and a chat cache. This is necessary to provide the service you requested and does not require separate consent.
12. Changes to the Policy
12.1.
We announce material changes to the Policy in the app at least 14 days before they take effect. The current version is always published on this page.
13. Contacts
13.1.
Questions about data processing are accepted in the support chat in the Telenoda app. Consent to data processing is a separate document.