Privacy Policy

«ASINTEX» Limited Liability Company (ASINTEX LLC) — in Russian: ООО «АСИНТЕКС».

• OGRN (registration number): 1252300041608
• INN (tax ID): 2312337130
• KPP: 231201001
• Registered and mailing address: 350059, Russia, Krasnodar Krai, Krasnodar, Yaltinskaya str., 14, office 204
• Phone: +7 (916) 555-55-12
• Privacy contact: privacy@jarbi.ru
• The controller is listed in the Roskomnadzor register of personal-data operators, registration number 23-25-158928.

Person responsible for personal-data processing (Art. 22.1 of 152-FZ): Yakhshibekyan Alexander Alexandrovich, General Director, appointed by Order No. 2 dated 27 August 2025.

Within the «Джарби» (Jarbi) service (the «Service») the following data may be processed:

• Account data: e-mail, hashed password, optional username, account ID.
• Optional profile data provided voluntarily by the user: last name, first name, patronymic, date of birth, phone number, list of time zones. These fields are not required to register or use the Service and can be edited or cleared at any time in the «Account» section.
• User content: tasks, projects, notes, Library/Graph items, energy-log entries, AI-assistant conversations, files and attachments uploaded by the user.
• Consent records: the fact, date and document version for each consent (age and Terms, push notifications, mailings, public profile, analytics cookies, AI features, recurring payments), and the fact and date of withdrawal.
• Payment data — only when a paid subscription is purchased on the website: e-mail, payment amount and status, payment and card-binding identifiers, masked card number, cash-receipt data. The full card number and CVV are never transmitted to or stored by the controller.
• Moderation data: reports you submit about other users (including the stated reason) and your list of blocked users — see section 6 of the Terms.
• Technical data: IP address, user-agent, OS, request timestamps, referrer, session ID — collected automatically for security and diagnostics.
• Mobile app data: device push-notification identifier (push token) — only if the user has enabled notifications in the mobile app (Android/iOS).
• League public-profile data — only if the user has enabled a public profile (profiles are private by default): nickname, season Pulse and consistency (aggregated weekly activity metrics, without task contents), season achievements (including historical level achievements of past seasons), mentor status and mentor–mentee links (nicknames), leaderboard position. This data becomes available to an unlimited audience via a direct profile link. Enabling the public profile is a voluntary act expressing consent to dissemination of the listed data; it can be revoked at any time in the League settings — the profile becomes private and the public page stops opening.
• Cookies: see section 7.

The Service is not designed to collect special categories of personal data (race, political/religious beliefs, health etc.) or biometric data. If a user voluntarily places such information in their content, processing is performed on the basis of the user's consent and at the user's own responsibility.

• Service provision — performance of contract (Art. 6(1)(b) GDPR).
• Authentication, account security, technical error logging — legitimate interest (Art. 6(1)(f) GDPR).
• Operational and legally significant communications with the user.
• Transfer to AI providers for assistant features — consent expressed by affirmative action (Art. 6(1)(a) GDPR).
• League public profile and leaderboard — based on the user's consent expressed by voluntarily enabling the public profile (revocable at any time in the League settings).
• Information & advertising mailings (news, tips, promotions, discounts, special offers) — on the basis of your consent (Art. 6(1)(a) GDPR; Art. 18 of the Russian «On Advertising» law; 152-FZ). Consent is voluntary and may be withdrawn at any time in settings or via the «Unsubscribe» link in every message. Opting out does not affect transactional (service) emails necessary for the Service to function.
• Product improvement via aggregated/anonymised metrics — legitimate interest.
• Compliance with applicable laws (tax, anti-fraud, lawful requests of authorities).

Contractual data-protection obligations are in place with each Russian sub-processor; transfers to Google and Apple for push-notification delivery are governed by their public data-processing agreements. Storage and primary processing take place within the territory of the Russian Federation; the only exception is mobile push-notification delivery (see below and section 5).

• «REG.RU» LLC (Russia, OGRN 1067746613494) — cloud hosting of the Service. Servers reside in the certified «Relcom Data» data centre (Moscow, Volgogradsky prospect 42 b. 5), within the territory of the Russian Federation.
• «Yandex.Cloud» LLC (Russia, OGRN 1187746678580) — encrypted backup storage (Object Storage) and AI services (YandexGPT) where used. When you use the AI assistant or the morning brief, the following is transferred to YandexGPT: the text of your request, the titles and descriptions of the tasks, projects and super-goals included in the request context, and the current conversation history. The transfer happens only at the moment an AI feature is used; AI features can be switched off entirely in the «Account» section, in which case nothing is sent to YandexGPT. Data centres located in Russia: Vladimir, Sasovo (Ryazan oblast), Kaluga, Mytishchi (Moscow oblast).
• Google LLC / Google Ireland Limited — Firebase Cloud Messaging (FCM) for mobile push-notification delivery; on Apple devices notifications are further delivered via the Apple Push Notification service (Apple Inc.). Transferred: the device push token and the notification content (title and reminder text). The infrastructure of these companies is located, among other places, outside Russia (USA) — see section 5 on cross-border transfers. The transfer occurs only if the user has enabled push notifications in the mobile app.
• «Unisender Smart» LLC (Unisender, INN 9731091240, a Russian legal entity) — email newsletter delivery. Engaged only to deliver informational and marketing emails to users who have consented (see section 3); transactional emails are not sent through it. Data transferred: email address, name/nickname, account identifier, email delivery/open and link-click data, and consent status. Infrastructure is located within the Russian Federation; no cross-border transfers are performed.
• «YANDEX» LLC (Russia, OGRN 1027700229193) — Yandex.Metrica web analytics. Loaded only after your consent in the cookie banner and only on the web (jarbi.ru and app.jarbi.ru); the Android and iOS apps contain no web analytics at all. Transferred: IP address, Yandex.Metrica cookie identifiers, pages viewed, referrer, anonymised on-page behaviour. Session recording («Webvisor») is disabled and form field contents are masked. Infrastructure is located in Russia.
• «TBank» JSC (Russia, OGRN 1027739642281) — payment acceptance and fiscal receipts for paid subscriptions purchased on the website. Transferred: e-mail, payment amount and purpose, payer and card-binding identifiers for recurring charges, and the data required to issue a cash receipt under Russian law 54-FZ. The full card number and CVV are entered on the bank's side and are never transmitted to or stored by the controller. No payments are made inside the mobile apps.
• GitHub, Inc. (USA) — source-code hosting and CI/CD. No personal data of Service users is transferred there.

Error telemetry is processed on the controller's own infrastructure within Russia. No third parties are involved in error telemetry.

Pursuant to Art. 18(5) of 152-FZ, primary recording, systematisation, accumulation, storage, clarification and extraction of personal data of Russian Federation citizens are performed using databases located within the territory of the Russian Federation (REG.RU and Yandex.Cloud servers listed in section 4).

Cross-border transfer of personal data is limited to a single case — mobile push-notification delivery: the device push token and notification content are processed by Google LLC (Firebase Cloud Messaging) and Apple Inc. (Apple Push Notification service), whose infrastructure is located, among other places, in the USA. Primary recording, systematisation, accumulation and storage of personal data are nevertheless performed in databases located in Russia. The user may disable push notifications in the app or device settings — in that case no cross-border transfer takes place.

External calendar subscription (ICS feed). In the calendar settings the Service issues a personal secret link to a calendar file (ICS) containing task titles, due dates and reminders. If you choose to add that link to a third-party calendar (Google Calendar, Apple Calendar or any other), your calendar provider will download the file on its own schedule — so task titles and due dates end up on that provider's infrastructure, including outside Russia (for Google LLC and Apple Inc. — in the USA). The controller does not send this data to third parties itself: the transfer is initiated by your action and happens between your calendar service and the Service. To stop it, remove the subscription in your calendar and/or rotate the secret link in «Settings → Calendar» — the old link stops working immediately.

No other transfers of personal data outside Russia are performed; all other sub-processors are Russian legal entities with infrastructure in Russia.

• User content — until user-initiated deletion or account closure.
• User-initiated account deletion — account data and user content are deleted immediately (hard-delete), including removal of the user's data directory. Restoration is not possible. Backups containing pre-deletion data are kept under general backup rotation and are not used to restore a deleted account.
• Technical request and application logs — retained for the time necessary for diagnostics and incident investigation.
• Backups — created regularly, retained for operationally necessary periods, and replicated to an off-site store with a Russian cloud provider (Yandex.Cloud bucket within Russia). Backups are kept encrypted and accessible to the controller only.
• Administrative action log (which operator staff member performed which action, including the staff e-mail and IP address) — kept for security and incident investigation purposes and retained after a user account is deletedfor as long as necessary for those purposes.
• Data required to be retained by law (accounting, tax, incl. 54-FZ receipts) — within statutory periods.

The Service uses strictly necessary cookies (authentication session, UI theme, cookie-banner choice) which do not require consent.

Analytics cookies (Yandex.Metrica web analytics) are loaded only after the user's explicit consent given via the cookie banner. The Yandex.Metrica script is not loaded before consent. Form field contents are masked and not recorded; session recording («Webvisor») is disabled. Your banner choice is stored in the browser, and for signed-in users the fact, date and version of the choice are additionally recorded on the controller's side as proof of consent or its absence. Consent may be withdrawn at any time via the “Cookie settings” link or by deleting cookies in the browser; on withdrawal the page reloads, Yandex.Metrica stops running and previously set _ym_* cookies are removed. The Android and iOS apps contain no web analytics. Advertising and marketing cookies are not used. See the Cookie Policy for details.

• Right of access — obtain confirmation and a copy of your personal data.
• Rectification, restriction, erasure.
• Data portability — export in a structured machine-readable format (JSON): the «Download my data» button in the «Account» section; if unavailable, by written request to the address below.
• Withdraw consent (where applicable), including switching off data transfers to the AI provider via the «AI features» toggle in the «Account» section.
• Object to processing based on legitimate interest (GDPR).
• Lodge a complaint with a supervisory authority (Russia — Roskomnadzor; EU/EEA — your national DPA; California — CPPA) or seek a judicial remedy.
• CCPA: right to opt out of "sale/sharing" — we do not sell personal data.

Submit requests in writing to privacy@jarbi.ru or to the controller's postal address. Response time — within 10 business days of receiving a reasoned request; the term may be extended by no more than 5 business days with a reasoned notice to the data subject (Art. 20 of 152-FZ). For GDPR requests — within one month.

• Designated person responsible for personal-data processing.
• Internal policies on personal-data processing in place.
• Encryption of data in transit and of backups at rest.
• Passwords stored as cryptographic hashes using strong algorithms.
• Access to server infrastructure is restricted and controlled; technical request and application logs are kept and used for diagnostics and incident investigation.
• An account-level security event log is maintained (sign-in, failed sign-in, password and email changes, account deletion request). Users can view their own log in the «Account» section; address and device details are anonymised once the retention period expires.
• Firewall and automated protection against brute-force attacks.

In the event of a confirmed unlawful or accidental disclosure of personal data resulting in a violation of data subject rights, the controller will notify the supervisory authority within the statutory timeframes (24 hours — initial notification; 72 hours — investigation results, per Art. 21(3.1) of 152-FZ; 72 hours under Art. 33 GDPR for EU/EEA users). Affected users will be notified without undue delay through available means of communication.

The Service is not directed to individuals under the age of 16. The controller does not knowingly collect data of such individuals. Any such data discovered will be deleted upon request of a legal guardian.

We will notify users in-app and/or by e-mail at least 14 calendar days before any material change. The current version is always available athttps://app.jarbi.ru/legal/privacy, with the effective date stated at the top of the document.