1.1. This Personal Data Processing Policy (the “Policy”) has been developed in furtherance of the requirements of Clause 2, Part 1, Article 18.1 of Federal Law No. 152-FZ “On Personal Data” dated 27 July 2006 (the “Federal Law No. 152-FZ”) and sets out the procedure for processing personal data and the security measures taken by the Operator.
1.2. The personal data Operator is Kristina Alekseevna Yadova, a payer of tax on professional income (self-employed), TIN 667471164215 (the “Operator”).
1.3. The Policy applies to all personal data that the Operator processes in connection with providing the “Whistler Ai” service through the website https://whistlerai.ru or through the Service interfaces in the MAX messenger (bot named “Whistler Ai”, https://max.ru/se13319000_bot) and the Telegram messenger (bot named “Whistler Ai”, https://t.me/YouTube_SummarySummary_Bot) (jointly, the “Service”).
1.4. The Policy is publicly available and is published by the Operator on the website whistlerai.ru, at this address, as well as in the Service interfaces in the MAX / Telegram messengers. By using the Service, the User confirms that they have read this Policy.
1.5. The Operator may amend the Policy. The date of the latest update is indicated at the beginning of the document.
Personal Data (PD) — any information relating directly or indirectly to an identified or identifiable individual (the personal data subject).
Processing of PD — any action (operation) or set of actions performed with PD, whether or not using automation tools, including collection, recording, systematization, accumulation, storage, updating (refreshing, amending), extraction, use, disclosure (transfer, access), depersonalization (anonymization), blocking, erasure, or destruction.
Operator — the person organizing and/or carrying out the processing of PD, and determining the purposes and scope of the PD processed (Clause 1.2 of the Policy).
User (PD subject) — a legally capable individual who has reached the age of 18 and uses the Service.
Content — any materials submitted by the User to the Service for processing: video links, audio and video files, texts, and other data.
Cross-border transfer of PD — the transfer of PD to the territory of a foreign state to a foreign individual or legal entity.
Pseudonymization — processing whereby the User is assigned a de-identified identifier (UUID) that does not allow the individual to be identified without additional information.
Other terms are used in the meanings defined by Federal Law No. 152-FZ and the Service's Public Offer.
The Operator processes PD on the following grounds:
3.1. the contract (the Public Offer) to which the PD subject is a party — processing is necessary for its performance (Clause 5, Part 1, Article 6 of Federal Law No. 152-FZ);
3.2. the consent of the PD subject to processing (Clause 1, Part 1, Article 6, Article 9 of Federal Law No. 152-FZ), executed as a separate document;
3.3. the consent of the subject to the cross-border transfer of PD (Article 12 of Federal Law No. 152-FZ), executed as a separate document;
3.4. requirements of Russian law that the Operator is obligated to comply with (including Federal Law No. 152-FZ “On Personal Data” dated 27 July 2006, Federal Law No. 149-FZ “On Information, Information Technologies and Information Protection” dated 27 July 2006, tax legislation, and legislation on the professional income tax regime).
3.5. The Operator processes the User's personal data only where such data has been entered and/or submitted by the User personally through the dedicated forms located on the website whistlerai.ru, or through the Service interfaces in the MAX / Telegram messengers.
4.1. providing the Service's functions — summarization (brief presentation) of videos via links, as well as transcription (converting speech to text) and diarization (separation by speaker) of audio and video files, with the subsequent processing of the result by a language model, and processing of the user's text queries;
4.2. entering into and performing the contract (the Public Offer), providing paid subscriptions;
4.3. accepting and recording payments, generating receipts, and performing the duties of a payer of tax on professional income;
4.4. providing technical support to Users and informing them about the operation of the Service;
4.5. ensuring the security of the Service, preventing abuse and violations.
5.1. PD subjects — Users of the Service.
5.2. The Operator processes the following categories of PD:
a) account identifiers on the website whistlerai.ru: the user's email, full name, phone number, date of birth;
b) messenger account identifiers: numeric identifier (MAX ID / Telegram ID), username, display name — to the extent transmitted by the messenger;
c) Content submitted by the User, and the results of its processing, including voice contained in audio and video files, and information mentioned in the Content;
d) technical data: date and time of requests, selected processing parameters, service logs;
e) information on subscriptions, transactions, and payment status.
f) where the Service is used via the website whistlerai.ru — de-identified visitor data, including data collected using special information technologies with cookie files (after obtaining the User's separate consent on the website whistlerai.ru).
5.3. The Operator does not collect or store bank card details or other payment details — these are processed by the payment service within its own secure infrastructure.
5.4. Where the User's Content contains voice recordings, the Operator processes such Content exclusively for the purposes of transcription and diarization, and not to establish identity based on physiological characteristics. The Service has no technical capability to match the voice contained in the Content with the User's personal (registration) data. Accordingly, it is processed as ordinary PD and does not constitute biometric PD within the meaning of Article 11 of Federal Law No. 152-FZ.
5.5. The Operator does not purposefully process special categories of PD (Article 10 of Federal Law No. 152-FZ); the User should refrain from including in the Content, without necessity, information about health, political views, and other special categories.
5.6. Where the Content contains the personal data of third parties, the User is the operator of such data, and the Operator processes it on the User's instructions (Part 3, Article 6 of Federal Law No. 152-FZ) solely for the purposes specified in Clause 4.1. By submitting such Content, the User instructs the Operator to process the personal data contained therein and confirms that it has a lawful basis for its transfer.
6.1. Processing is carried out by mixed means (using automation tools and without them) and includes the actions listed in the definition of “processing of PD” (Section 2).
6.2. Processing is carried out on a lawful and fair basis and is limited to the stated purposes; only PD that meets those purposes is processed.
6.3. The Operator does not make decisions that produce legal consequences for the User based solely on automated processing of PD.
6.4. The User's Content is not used by the Operator to train or fine-tune any artificial intelligence models — neither its own nor those belonging to third parties.
7.1. The collection of PD of citizens of the Russian Federation, and their recording, systematization, accumulation, storage, updating, and extraction, are carried out using databases located on the territory of the Russian Federation.
7.2. The initial receipt of PD and Content, and their recording, are carried out on server infrastructure located in the Russian Federation (a VPS server in Moscow and S3 object storage in Saint Petersburg, provided by TIMEWEB.CLOUD LLC). Foreign server infrastructure is used exclusively as a transport node for delivering messenger messages and downloading publicly available videos, and is not used for the initial collection and storage of Users' PD.
8.1. To operate the Service, the Operator engages the following persons, to whom PD or data derived from it may be transferred or made accessible:
| Service / Role | Provider | Jurisdiction | Data processed |
|---|---|---|---|
| RF VPS hosting and S3 object storage | Timeweb.Cloud LLC | Russia (Moscow, Saint Petersburg) | Storage of Content, processing results, account data |
| Messenger message transport, downloading of publicly available videos | Timeweb.Cloud LLC | Netherlands (Amsterdam) | Transit without storage of the User's PD |
| Processing of text by a language model | Alibaba Cloud Computing Ltd., Hangzhou DeepSeek | USA, PRC | Transcript / Content text |
| Transcription and diarization of audio | Veelma, x.Ai LLC | USA | Compressed audio from the User's Content |
| Messengers through which the Service operates | Max, Telegram | Telegram — foreign; MAX — Russia | Account identifiers and messages |
8.2. PD is transferred to third parties to the extent necessary to render the relevant services, and on the basis of agreements (including terms of use of services) providing for confidentiality and protection of PD.
9.1. In the course of processing Content, certain data (compressed audio from the User's Content and transcript text) may be transferred to legal entities located in the USA and the PRC.
9.2. Before the cross-border transfer begins, the Operator files a notification with Roskomnadzor of its intention to carry out such a transfer, pursuant to Article 12 of Federal Law No. 152-FZ. Transfers to states that do not ensure adequate protection begin taking into account the period for the authorized body's review of the notification.
9.3. The cross-border transfer is carried out only where the User has given separate consent to such transfer, obtained before the User's data is sent to the recipients.
9.4. Summarization of publicly available videos via a link is not aimed at transferring the User's PD: publicly available third-party content is processed, and the only personal data involved is the fact that the User made the request.
10.1. The User's Content (the source file) is deleted immediately after transcription is completed, and the results of its processing (transcripts, summaries) are stored for no more than 30 (thirty) calendar days from creation, after which they are automatically deleted.
10.2. Account data (account identifiers, subscription and payment information) is processed for the term of the contract and thereafter for the periods established by Russian law (including for accounting and tax purposes), or until consent is withdrawn, if no other basis for processing exists.
10.3. PD is destroyed in a manner that precludes further processing, with confirmation of destruction in the manner established by the regulations of the authorized body.
11.1. Pseudonymization: each User is assigned a de-identified identifier (UUID) used in internal systems instead of direct identifiers.
11.2. Data is transmitted over secure communication channels (encryption in transit).
11.3. Restriction and delimitation of access to PD; secrets and keys are stored in protected form.
11.4. Application of organizational and technical measures provided for by Articles 18.1 and 19 of Federal Law No. 152-FZ (including access logs, regular audits, cybersecurity services) to protect PD from unlawful access, destruction, alteration, copying, and dissemination.
11.5. If it is established that PD has been unlawfully or accidentally transferred (disclosed, disseminated, or accessed) in a manner that violates the rights of PD subjects, the Operator shall, from the moment such an incident is discovered, notify the authorized body for the protection of the rights of personal data subjects (Roskomnadzor):
a) within 24 hours — of the incident that occurred, the presumed causes that led to the violation of the rights of personal data subjects and the presumed harm caused to those rights, the measures taken to remedy the consequences of the incident, and information on the person authorized by the Operator to liaise with Roskomnadzor on matters related to the identified incident;
b) within 72 hours — of the results of the internal investigation of the identified incident, and information on the persons whose actions caused the identified incident (if any).
11.6. If inaccurate personal data or unlawful processing of personal data is identified upon an application from the personal data subject or their representative, or at the request of the authorized body for the protection of the rights of personal data subjects, the Operator shall block and/or correct such personal data and cease its unlawful processing within the periods and in the manner established by Article 21 of Federal Law No. 152-FZ “On Personal Data” dated 27 July 2006.
The User has the right to:
12.1. receive information concerning the processing of their PD (Article 14 of Federal Law No. 152-FZ);
12.2. demand the correction, blocking, or destruction of PD if it is incomplete, outdated, inaccurate, obtained unlawfully, or is not necessary for the purpose of processing;
12.3. withdraw consent to the processing of PD and/or to the cross-border transfer;
12.4. appeal the actions (or omissions) of the Operator to Roskomnadzor or in court.
The User is obligated to:
12.5. provide the Operator with accurate data and notify it of any updates or changes thereto.
12.6. bear full responsibility for the presence of prohibited content in any uploaded audio or video materials.
13.1. To exercise their rights, or to withdraw consent, the User shall send a request to the Operator's email address: info@whistlerai.ru
13.2. Withdrawal of consent entails the cessation of processing and destruction of PD, unless its processing may continue on another lawful basis. After withdrawal, it may become impossible to provide the Service's functions that require the processing of the relevant PD.
13.3. The Operator considers the request and provides a response within the periods established in the Public Offer.
14.1. The Operator and other persons who have gained access to personal data are obligated not to disclose it to third parties and not to disseminate personal data without the consent of the personal data subject, unless otherwise provided by federal law.
15.1. In all matters not governed by the Policy, the Operator and the User shall be guided by the legislation of the Russian Federation and the Service's Public Offer.
15.2. The current version of the Policy is published at https://whistlerai.ru.
Kristina Alekseevna Yadova
TIN: 667471164215
Website: https://whistlerai.ru
Address where the Service's Personal Data Processing Policy is published: https://whistlerai.ru
Service in the MAX messenger: https://max.ru/se13319000_bot (“Whistler Ai”)
Service in the Telegram messenger: https://t.me/YouTube_SummarySummary_Bot (“Whistler Ai”)
E-mail: info@whistlerai.ru