Privacy Policy
The Impact Relay personal data processing policy. What data we process, why, who we pass it to, how long we keep it and how you can manage it.
On this page
Effective October 15, 2026.
- We keep your e-mail address, payment records and request metadata (model, token counts, cost). We do not store the text of your requests and answers.
- A request goes to the chosen model's Provider, which processes it under its own rules.
- We never receive your bank card details: they are entered on the payment provider's page.
- We do not sell data, and we use no advertising cookies or third-party counters.
- Requests about your data go to the e-mail addresses in section 14.
If the English and Russian texts differ, the Russian text prevails.
1. General provisions
1.1. This Policy is the document that sets out the Operator's policy on processing personal data (clause 2 of part 1 of Article 18.1 of Federal Law No. 152-FZ of July 27, 2006 "On Personal Data", the "Law"). It describes what personal data the Operator processes, on what grounds, for what purposes, how long it keeps the data and what measures it takes to protect it.
1.2. The Operator is the person whose requisites are given in section 14. The Operator itself decides the purposes and the scope of processing the personal data of users of the website impact-relay.com and the API at api.impact-relay.com (the "Service").
1.3. The Policy applies to all personal data the Operator receives when the Service is used. It is drawn up in line with the Constitution of the Russian Federation, the Law, the Federal Law "On Information, Information Technologies and Information Protection" and other acts of the Russian Federation.
1.4. Using the Service means that the user has read the Policy. A user who does not agree with the Policy should not use the Service. The Policy is openly available on this page.
1.5. How services are provided and the parties' rights are set out in the Terms of Service.
2. Definitions
- Personal data — any information relating to a directly or indirectly identified or identifiable individual (the data subject).
- Processing — any action with personal data: collection, recording, organizing, accumulation, storage, updating, retrieval, use, transfer, blocking, deletion and destruction.
- Operator — the person who organizes and carries out the processing of personal data and decides its purposes and scope.
- Cross-border transfer — transfer of personal data to the territory of a foreign state.
- Model Provider — the developer or owner of an artificial intelligence model available through the Service, such as OpenAI, Anthropic, Google or xAI.
3. What data we process
The Operator processes the personal data of users of the Service (individuals, individual entrepreneurs and representatives of organizations), visitors to the website and people who contact support. The Operator does not process special categories of personal data or biometric data. Processing is carried out with automation.
| Category | Data |
|---|---|
| Account | E-mail address, profile name, avatar (when signing in with GitHub or Google), password hash (the password itself is not stored), e-mail verification status, two-factor authentication settings (the secret is stored encrypted), Telegram ID (if you linked it), GitHub and Google account IDs |
| Sessions and security | IP address, browser and device type, sign-in time, security events |
| API keys | Name, limits, time of creation and last use. The key itself is stored only as an irreversible hash |
| Payments and Balance | Payment ID, payment method, amount, currency, rate, status, time, the invoice ID at the payment provider, records of top-ups, charges and adjustments to the Balance. For cryptocurrency payments: the coin, network, receiving address and amount. The Operator does not receive or store bank card details |
| API request metadata | Time, endpoint, requested and answering Model, token counts, cost, status and response code, response time, client application name, end-user ID (if you sent one in the request). The text of requests and answers is not stored |
| Own accounts and proxies (BYOK) | Sign-in details for accounts with Model Providers, and proxy addresses with a login and password, if you added them. Stored encrypted and used only to serve your requests |
| Support requests | E-mail address, the text of the message and attachments |
| Technical data | Cookies and browser local storage (see section 10) |
The content of requests to models may include personal data that the user sends on their own initiative. The Operator does not store that content but passes it to the chosen Model's Provider (see section 6). The user is responsible for having grounds to send such data.
4. Purposes, grounds and retention
| Purpose | Legal basis (Article 6 of the Law) | Retention |
|---|---|---|
| Registering and keeping the Account, providing the service, issuing and counting API keys | Performing a contract to which the user is a party | While the Account exists. After the Account is deleted the data is deleted or anonymized within 30 days |
| Taking payments, keeping the Balance, refunds, accounting and tax records | Performing a contract; meeting obligations that the law places on the Operator | Payment records are kept for the periods set by accounting and tax law (as a rule up to 5 years), including after the Account is deleted |
| Counting usage, working out cost, the request log and statistics, support | Performing a contract | Request metadata — 90 days. Aggregated usage statistics — while the Account exists |
| Security, preventing fraud and abuse, meeting the requirements of the law and of payment providers on countering money laundering | Legitimate interests of the Operator and third parties; meeting obligations that the law places on the Operator | Session data — while the session is valid. Records of blocks and violations — while the Account exists and, where needed, for the limitation period |
| E-mails about verifying the address, resetting the password, payments and changes to the terms; answers to requests | Performing a contract | Support requests — up to 3 years (the limitation period) |
| Protecting the Operator's rights and legitimate interests in claims and in court | Legitimate interests of the Operator | The limitation period — 3 years |
For purposes not listed in this section (for example advertising mailings) the Operator will ask for separate consent. The Operator does not sell personal data and does not pass it on for advertising.
5. How we process data
5.1. The Operator collects data from the user, and also receives it from sign-in services and payment providers to the extent described in section 6. The Operator then records, organizes, accumulates, stores, updates, uses, transfers, blocks, deletes and destroys the data.
5.2. The Operator processes data no longer than the purposes in section 4 need. When a purpose is reached or the user asks for the data to be deleted, the Operator deletes or anonymizes it, except for data it must keep by law.
5.3. The Operator does not take decisions that have legal consequences for the user solely on the basis of automated processing of their personal data.
6. Who we pass data to
6.1. The Operator passes data only to the extent needed to provide the service:
- Payment providers. Lava (bank cards and SBP) receives the order ID, the amount and the currency of the payment. Heleket (cryptocurrency) receives the order ID, the amount and the currency, and the invoice parameters. The providers collect the payer's data (card, bank, wallet) themselves and process it under their own rules: Lava, Heleket. The providers check payments, including under anti-money-laundering requirements.
- Model Providers. The content of requests (text, files, images) and the technical data needed to run the request go to the Provider of the chosen Model. Model Providers decide the purposes and means of processing themselves, under their own terms and privacy policies, and may keep the data they receive. The Operator does not control what they do.
- Sign-in services. When you sign in with GitHub, Google or Telegram, those services learn that you signed in and give the Operator the account ID, the e-mail address (except Telegram), the name and the avatar.
- E-mail delivery service. Receives the e-mail address and the text of the message in order to deliver messages about verifying the address, resetting the password and payments.
- Hosting and network infrastructure providers. Host the Operator's servers and databases.
- State authorities. Data is passed on their reasoned request in the cases the law provides.
6.2. When a third party processes data on the Operator's behalf, the Operator requires it to keep the data confidential and secure, as the law requires.
7. Cross-border transfer
7.1. Model Providers, payment providers and sign-in services may be outside the Russian Federation, including in states that do not give adequate protection to the rights of data subjects. The content of requests to models goes to Model Providers on the user's initiative, when the user sends a request.
7.2. Cross-border transfer is carried out to the extent needed to perform the contract with the user, and in the way Article 12 of the Law provides.
8. Storage in the Russian Federation
The recording, organizing, accumulation, storage, updating (revision, change) and retrieval of the personal data of citizens of the Russian Federation are carried out using databases located on the territory of the Russian Federation (part 5 of Article 18 of the Law).
9. Protecting data
9.1. The Operator takes legal, organizational and technical measures to protect data from unlawful access, destruction, change, blocking, copying, disclosure and distribution. They include:
- sending data over a secure connection (HTTPS);
- keeping passwords and API keys only as irreversible hashes;
- encrypting the credentials of own accounts and proxies that the user adds;
- two-factor authentication, which the user can turn on;
- limiting access to data to the people who need it for their work.
9.2. No measures give absolute protection. If you find a vulnerability or a leak, report it to the e-mail address in section 14. The Operator notifies the authorized body of incidents that affect personal data within the periods the law sets.
10. Cookies and local storage
10.1. The website uses only necessary cookies: a session cookie (to keep you signed in and for protection) and a cookie for the chosen language. Browser local storage keeps interface settings, such as filters and collapsed panels.
10.2. The website does not use advertising or analytics cookies, pixels or third-party counters.
10.3. You can turn cookies off in your browser settings, but signing in may then not work.
11. Your rights
11.1. You have the right to:
- get information about the processing of your personal data (Article 14 of the Law);
- demand that data be corrected, blocked or destroyed if it is incomplete, out of date, inaccurate, unlawfully obtained or not needed for the stated purpose;
- withdraw consent to processing, if it was given;
- appeal the Operator's actions to the authorized body for protecting the rights of data subjects (Roskomnadzor) or in court;
- protect your rights and legitimate interests, including claiming damages and compensation for moral harm.
11.2. To use your rights, write to the e-mail address in section 14 from the e-mail address on the Account and describe what you want. The Operator may ask for information that confirms your identity.
11.3. The Operator answers a request within 10 working days of receiving it. That period can be extended by no more than 5 working days if the Operator sends a reasoned notice. A demand to delete data or the Account is met within the period the law sets, as a rule within 30 days. Before the Account is deleted you can get the remaining Balance back (refunds).
12. Children
The Service is for people over 18. The Operator does not knowingly collect the personal data of minors. If the Operator learns that it has received such data, it will delete it.
13. Changes to the Policy
The Operator may change the Policy. The new version is published on this page with a new date and takes effect when published. For material changes the Operator will, where it can, tell users by e-mail or in the dashboard.
14. Operator contacts
- Name
- Not specified
- Legal status
- Not specified
- Taxpayer ID (INN)
- Not specified
- Registration number (OGRN / OGRNIP)
- Not specified
- Address
- Not specified
- E-mail for support and requests
- [email protected][email protected]
- Telegram support
- @impact_sup
- Phone
- Not specified
Requests about personal data, requests from data subjects and reports of incidents are taken at the e-mail addresses above. They are also the contact of the person responsible for organizing the processing of personal data.