Personal Data Processing Policy

Version of September 15, 2026.

This policy explains what personal data Lovox needs, who it may be shared with and how you can exercise your rights. It applies to the website https://lovox.ru, the Lovox apps and requests to our team. It is based on Federal Law No. 152-FZ of July 27, 2006 “On Personal Data” (Федеральный закон от 27.07.2006 № 152-ФЗ «О персональных данных»). Reading the policy, visiting the website or accepting the offer does not by itself mean consent to data processing for any purpose.

1. Who is responsible for the data

The operator (the person who determines the purposes of processing) is NitSoft RUS LLC (ООО «НитСофт РУС»), TIN (INN) 6700002413, PSRN (OGRN) 1236700010304. Address: Office L 15, 16/17 Bolshaya Sovetskaya St., Smolensk, Smolensk Region, 214000, Russia. For questions about data processing, write to hello@lovox.ru. If your email is not delivered, use hello@lovox.ru or the postal address.

We determine the purposes of processing data about accounts, payments, requests and website visits. If an organization or another customer uploads information about its employees, clients and counterparties, that customer usually determines the purposes. In this part, Lovox processes the data on the customer’s instruction set out in the agreement. The customer is responsible for the lawfulness of uploading the data and granting access to it; this does not cancel Lovox’s own obligations as the person instructed to process the data.

2. Sources and methods of processing

Data comes from the person themselves, the owner or members of a workspace, sign-in services and integrations connected by the user, the payment partner and the browser. Not all of the information listed below is required: what is collected depends on the features you use. Do not share unnecessary information about yourself or other people, passwords, or a full card number or its security code in tasks, emails and support requests.

Processing includes collection, recording, systematization, accumulation, storage, updating, retrieval, use, provision of access, transfer for the purposes stated in this policy, blocking, deletion and destruction. Most processing is automated. Authorized employees may work with data while supporting the service, handling payments, investigating incidents and reviewing requests, within the scope of their duties.

Lovox is not intended for processing information about health, political and religious views, intimate life or other special categories of personal data without the conditions specifically provided by law. Lovox does not use photos and voices in materials for biometric identification. A passkey gives the service a public cryptographic key, not a fingerprint or an image of your face from the device.

3. Why the data is needed

Account, sign-in and access protection. Data of users and invited members: email address, account ID, sign-in confirmation data, the ID and permitted information from the sign-in provider, IP address, browser and device information, sessions, security settings and activity logs. Legal basis: concluding and performing the agreement at the user’s initiative, and the legitimate interest in protecting the service and its users while respecting their rights. Account data is needed until the account is deleted; session data until the session expires. Information about an incident may be kept until the review is complete and related claims are resolved, to the extent necessary for this.

Additional profile. A name, display name, profile photo and contact phone number added voluntarily help introduce the user to members of their workspaces. Processing based on consent relies on a separate consent for profile data. Period: until the relevant information is deleted, the account is deleted or consent is withdrawn, whichever comes first. If work information was provided by an employer or another customer, that customer determines the legal basis and period within the law, and Lovox carries out its instruction.

Collaboration. Data of members, employees, clients, counterparty representatives and meeting participants: names, work contacts, job titles and organizations, assignments, deadlines, time spent, correspondence, documents, attachments, images, voices and transcripts, if they are added to the workspace. Purpose: to store and process materials, show them to users with access and perform the selected features. Legal basis: the agreement with the user, or the instruction of a customer that has its own legal basis for processing. Period: as long as the data is needed for this purpose and the customer’s grounds apply, until the material is deleted or the instruction ends. Publishing via a public link requires a separate check of rights and, where necessary, consent to dissemination.

Payments and documents. Data of payers, individual entrepreneurs and representatives of organizations: name, email address, phone number for the receipt, customer details, TIN (INN), information about the order, amount, period and payment status, transaction IDs and the recurring payment token. Purpose: to fulfill the order, process payments and refunds and issue payment documents. Legal basis: the agreement, tax and accounting requirements and the law on cash register equipment. Full bank card details and the security code are processed by the payment partner. Primary accounting documents are kept for at least five years after the reporting year, and longer where the law requires; the payment token does not allow charging money after its use has been prohibited.

Requests and service emails. Data of users, applicants and customer representatives: sender or recipient address, name, subject and text of the request, attached materials, and information about delivery and the reply. Purpose: to send a sign-in code, report service events, answer a question and fulfill a request. Legal basis: the agreement, actions taken at the person’s request before it is concluded, legal requirements, or the legitimate interest in handling the request with due regard for the applicant’s rights. Correspondence is processed until the issue is resolved; in a dispute, the related part is kept until the dispute is resolved and for the mandatory retention period. Marketing emails are not part of service notifications and require separate consent.

Website analytics. Visitor data: cookies and other browser identifiers, IP address, device type, pages and events of the visit, referral source and campaign tags. Purpose: to measure traffic, find errors and understand where sign-ups come from. Optional analytics requires separate consent; declining it must not prevent you from using the main features. Processing on this basis lasts until the purpose is achieved or consent is withdrawn. Technically necessary sign-in and security tools are used to perform the agreement and ensure security, not for advertising.

4. Cookies and analytics services

Cookies and the browser’s local storage are used for the session, sign-in protection, interface settings and information about the referral source. Yandex Metrica is used for statistics, and Google Tag Manager for tag management. GTM loads the code of the configured tags: its presence does not by itself mean that all Google products are used and does not allow sending arbitrary data to other recipients.

Consent to analytics must cover specific recipients, data and purposes and can be withdrawn separately from the agreement and from the consent for profile data. Blocking or clearing cookies in the browser removes local identifiers but does not delete information that has already been transferred. To ask about its processing and deletion, write to hello@lovox.ru, stating the website and the approximate time of your visit. If you block technical cookies completely, signing in to your account may not work.

5. Contractors and recipients

Lovox uses the following services. The data transferred is limited to the relevant task; having a contractor on this list does not mean that the entire content of every workspace is transferred to it.

• Timeweb, Russia: infrastructure for the Lovox database, files and backups. Data: the data stored in the service that is needed for storage and running the app.
• TBank JSC (АО «ТБанк»), Russia: payment processing. Data transferred: information about the order and the payer and contacts for payment documents; card details are entered in the partner’s payment interface.
• Resend (Plus Five Five, Inc., USA): email delivery. Data transferred: recipient address, subject, text and technical details of the email, including sign-in codes and the content of service notifications. Resend Privacy Policy.
• DeepSeek (Hangzhou DeepSeek Artificial Intelligence Co., Ltd., China): processing of AI requests. Data transferred: the request and the context needed for the selected feature; this may include the text of tasks, documents and other information about people. DeepSeek Privacy Policy.
• Deepgram, Inc., USA: speech recognition. Data transferred: audio or an audio stream with voices and the content of the conversation; the service returns text and recognition details. Deepgram Privacy Policy.
• YANDEX LLC (ООО «ЯНДЕКС»), Russia: Yandex Metrica processes information about website visits and events within the counter settings and the permitted purpose. Yandex Privacy Policy.
• Google, including Google LLC, USA: Google Tag Manager loads the tag container. When the browser connects to Google servers, technical request data is transferred, including the IP address and browser information. The data collected by individual tags depends on their purpose and requires its own legal basis. Google Privacy Policy.

Materials are also received by members with assigned access, integrations chosen by the customer and recipients of public links the customer creates. Data is provided to competent authorities when there is a legal basis and to the extent required. Transfer for third parties’ own advertising is not covered by the agreement for providing Lovox.

6. Storage in Russia and transfer abroad

The main Lovox database, files and backups are hosted on Timeweb infrastructure in Russia. When data of Russian citizens is collected, the requirements of Part 5 of Article 18 of Law No. 152-FZ must be met. Using Russian hosting does not mean that information never leaves Russia: foreign email, AI and analytics services may receive the data listed in Section 5.

Before starting a cross-border transfer, the operator must meet the requirements of Article 12 of Law No. 152-FZ: obtain the information required by law about the recipients and how they protect data, send a separate notification to Roskomnadzor (the Russian data protection authority) and comply with the applicable deadlines, prohibitions and restrictions. A contract with a foreign provider, the user’s consent and the publication of this policy do not by themselves confirm that these requirements have been met.

Requests and recordings are not considered depersonalized just because the author’s name has been removed: a person can be identified from the content and context. Before sending materials to AI or for transcription, the customer checks the legal grounds for processing the data of everyone involved. The rules for storage and use of data by a foreign provider are determined by the applicable contract with it; this policy does not promise that models are not trained on the data or that the data is not retained, unless this is confirmed by the terms of the relevant API.

7. Retention, blocking and destruction

The retention period depends on the purpose and legal basis from Section 3. When the purpose is achieved, or when consent is withdrawn and there are no other legal grounds, processing stops and the data is destroyed within 30 calendar days, unless the law sets a different procedure. A demand to stop processing is handled within the periods set by Article 21 of Law No. 152-FZ. Information needed for payments, compliance with the law or defense in a specific dispute is kept separately to the extent necessary and is not used for the previous purposes without a legal basis.

If data is confirmed to be inaccurate, it is corrected within seven working days after the supporting information is received. Unlawful processing stops within three working days after it is discovered; if it cannot be made lawful, the data is destroyed within ten working days. During a review provided for by law, the data is blocked with due regard for the rights of the data subject and third parties.

Deletion is carried out in active storage systems and, to the applicable extent, at engaged processors. Backups do not create a separate right to keep information indefinitely. If data cannot be destroyed within the set period, it is blocked and then destroyed under Part 6 of Article 21 of Law No. 152-FZ. Completion is confirmed by the documents and records required by law; simply disabling an account does not confirm destruction.

Materials of a shared workspace may remain after an individual member leaves if the customer continues to process them lawfully. This does not deprive the person of the right to demand a check of the legal basis, or the correction or deletion of information about them. Guaranteed recovery of a deleted account or material is not provided.

8. Security and access

Protection is based on restricted access rights, session checks, sign-in protection tools available to users, activity logging and backups. The specific features available are described on the Security and data page. These mechanisms do not mean that the information system is certified or that there are no risks at all.

The operator must appoint responsible persons, determine the required level of protection, organize internal control and give employees access only as needed for their work, in accordance with Articles 18.1 and 19 of Law No. 152-FZ. If an incident provided for by law is discovered, the operator notifies Roskomnadzor within 24 hours, and of the results of the internal investigation within 72 hours. For customer data, Lovox also fulfills notification obligations under the instruction.

9. Your rights and requests

• Get confirmation of processing and information about the purposes, legal grounds, sources, recipients, periods and scope of your data.
• Demand that inaccurate, excessive, outdated or unlawfully obtained data be corrected, blocked or destroyed.
• Withdraw consent or demand that processing stop in the cases provided by law, including for a specific purpose only.
• Appeal the operator’s actions to Roskomnadzor or a court and use other remedies provided by law.

Write to hello@lovox.ru from your account email address or send a request to the operator’s postal address. State which data the request concerns and what you want done. Do not send a copy of your passport in advance: if the law and the nature of the request require more information to confirm your identity or authority, we will tell you exactly what is needed and how to send it. A representative confirms their authority in the form required by law.

Information about processing is provided within ten working days; this period may be extended by no more than five working days with a reasoned notice. The same periods apply to a demand to stop processing, unless the law provides an exception. Correction and destruction follow the special periods from Section 7. A justified refusal comes with an explanation of its legal basis.

If the request concerns materials managed by your employer or another customer, you can send it to that customer or to us. We will determine our role and help direct the request to the appropriate operator. You cannot get information about another person just because it is in the same workspace.

10. Withdrawing consent

Send your withdrawal to hello@lovox.ru or to the operator’s postal address. You can name a specific consent or purpose. Withdrawal does not affect the lawfulness of processing before it was received and does not automatically stop processing that is needed on a separate legal basis, for example to perform the agreement or keep payment documents. You can ask for information about such a basis and the data that is kept.

Withdrawing consent for optional profile information or analytics does not by itself mean deleting the account, ending the subscription or giving up a refund. To delete the account and end paid access, use the relevant actions in the service or send a separate request. The consent text and the contact for withdrawal are available without signing in.

11. Changes to this policy

The current version is published on this page with its date. Before new processing starts, the operator informs affected users about significant changes to the purposes, data or recipients and obtains new consent where it is required. Updating the text does not automatically expand consent given earlier. You can ask the operator for the previous applicable version and for information about the legal basis for processing.