Privacy Policy

Version of 4 October 2026.

This is an English translation of the Политика обработки персональных данных (Personal Data Processing Policy). The Russian version is the governing text; in case of any discrepancy, the Russian version prevails.

1. General Provisions

1.1. This Policy sets out how personal data is processed by Individual Entrepreneur Roman Melikhov (OGRNIP 324774600520209, INN 682709660135), the “Operator”, and is adopted under Article 18.1(2) of Russian Federal Law No. 152-FZ of 27 July 2006 “On Personal Data” (the “Law”).

1.2. This Policy applies to all personal data the Operator processes in connection with the Amber mobile application, the online booking web interface and the website https://amberapp.app.

1.3. This Policy is publicly available at https://amberapp.app/PrivacyPolicy (Russian version: https://amberapp.app/PersonalDataPolicy). The following documents apply together with it:

2. Definitions

Personal data — any information relating to a directly or indirectly identified or identifiable natural person (data subject).

Processing — any operation or set of operations performed on personal data, with or without automation: collection, recording, organisation, accumulation, storage, adaptation or alteration, retrieval, use, transfer (provision, access), depersonalisation, blocking, erasure, destruction.

Application — the Amber mobile application for iOS and Android.

Online booking web interface — a User’s web page through which the User’s Clients book services themselves.

Website — the website https://amberapp.app.

Service — the Application, the online booking web interface and the server infrastructure supporting them.

User — a natural person (including a self-employed person), an individual entrepreneur or a representative of a legal entity registered in the Application.

User’s Client — a natural person whose data the User enters into the Service, or who submits their own data through the online booking web interface.

Website Visitor — anyone who opens the Website.

Other terms have the meanings given to them in the Law.

3. Principles

The Operator processes personal data lawfully and fairly; only for specific, predefined purposes; to the extent necessary for those purposes; does not combine databases created for incompatible purposes; keeps personal data accurate; stores it no longer than its purposes require; and destroys it once the purposes are achieved or no longer need to be achieved.

4.1. Registration, account management and provision of the Service

  • Data subjects: Users.
  • Data: surname, first name, patronymic; email address; phone number; other details the User adds to their profile.
  • Legal basis: performance of the Terms & Conditions, to which the data subject is a party (Article 6(1)(5) of the Law).
  • Retention: for as long as the account exists. After the account is deleted, the data is destroyed within 30 days.

4.2. Payment for subscription plans

  • Data subjects: Users.
  • Data: selected plan, amount, date and status of payment, linked to the account.
  • Legal basis: performance of the Terms & Conditions (Article 6(1)(5) of the Law); compliance with obligations imposed on the Operator by tax law (Article 6(1)(2) of the Law).
  • Retention: for the periods required by Russian tax law.

Users enter bank card details on the payment provider’s side. The Operator does not receive or store them.

4.3. Customer support

  • Data subjects: Users; other persons who contact support.
  • Data: surname, first name, patronymic; email address; phone number, if provided; content of the request and correspondence; account details and technical information needed to resolve the issue.
  • Legal basis: for Users — performance of the Terms & Conditions (Article 6(1)(5) of the Law); for other persons — the Operator’s legitimate interest in responding to the request (Article 6(1)(7) of the Law).
  • Retention: for Users — for as long as the account exists; for other persons — 1 year from the last message.

4.4. Application analytics and measuring advertising effectiveness

  • Data subjects: Users who have given consent.
  • Data: device and installation identifiers, including advertising identifiers where allowed in the device settings; IP address; device model, operating system and version; Application version; language and region; in-app activity and crash information; the source of the Application install and the advertising campaign it came from.
  • Legal basis: the data subject’s consent (Article 6(1)(1) of the Law). Consent is optional: the Application can be used in full without it.
  • Processing on the Operator’s behalf: YANDEX LLC (AppMetrica service).
  • Retention: until consent is withdrawn, but no longer than 24 months from collection.

4.5. Website visit statistics

  • Data subjects: Website Visitors who have given consent in the cookie banner.
  • Data: Yandex Metrica cookie identifiers; IP address; browser, operating system and device information; pages viewed and referring page; on-page activity; date and time of the visit.
  • Legal basis: the data subject’s consent (Article 6(1)(1) of the Law), given by clicking “Accept” in the cookie banner.
  • Processing on the Operator’s behalf: YANDEX LLC (Yandex Metrica service).
  • Retention: until consent is withdrawn, but no longer than 24 months from collection. See the Cookie Policy for details.

4.6. Website operation and security

  • Data subjects: Website Visitors.
  • Data: IP address, date and time of the request, requested page, browser information (User-Agent), referring page.
  • Legal basis: the Operator’s legitimate interest in keeping the Website running and protecting it from attacks (Article 6(1)(7) of the Law).
  • Retention: no longer than 30 days.

4.7. Personal data of Users’ Clients

The User decides the purposes and scope of processing of their Clients’ personal data and is the operator (controller) of that data. The Operator processes it solely on the User’s instructions (Article 6(3) of the Law) under section 7 of the Terms & Conditions and does not use it for its own purposes.

  • Data: surname, first name, patronymic; phone number; email address; booking details (date, time, service); comments and other information entered by the User or by the Client through the online booking web interface.
  • Legal basis: the User’s instructions. The User is responsible for having a legal basis for processing their Clients’ personal data, including obtaining the Clients’ consent.
  • Retention: for as long as the User keeps the data in the Service. When the User deletes the data or their account, the data is destroyed within 30 days.

5. How Personal Data Is Processed

5.1. The Operator processes personal data both with and without automation (mixed processing).

5.2. Recording, organisation, accumulation, storage, alteration and retrieval of personal data of Russian citizens are carried out using databases located in the Russian Federation. The Service and Website servers are hosted by BEGET LLC in the Russian Federation. The support chat and mail server run on the Operator’s own servers. The hosting provider only supplies infrastructure and has no access to personal data.

5.3. The Operator engages only YANDEX LLC (16 Lva Tolstogo St., Moscow, 119021, Russia) to process personal data on its behalf — to the extent and for the purposes set out in sections 4.4 and 4.5, and only with the data subject’s consent.

5.4. The Operator does not disclose personal data to any other third parties, except where expressly required by Russian law (for example, at the request of a court or authorised bodies).

5.5. Push notifications are delivered through the operating system services (Apple, Google). The Operator does not include personal data in the text of push notifications.

5.6. Personal data is not transferred across borders.

5.7. Personal data is not made public (disclosed to an indefinite number of persons).

5.8. The Operator does not process special categories of personal data (racial or ethnic origin, political opinions, religious or philosophical beliefs, health, sex life) or biometric personal data.

5.9. No decisions producing legal effects concerning the data subject, or otherwise affecting their rights, are made solely on the basis of automated processing.

6. Your Rights

You have the right to:

  • obtain information about the processing of your personal data: confirmation that it is processed, the legal bases and purposes, the methods used, the Operator’s name and location, the data processed and its source, processing and retention periods, the name of the person processing data on the Operator’s behalf, and other information listed in Article 14(7) of the Law;
  • request that your personal data be corrected, blocked or destroyed if it is incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose;
  • request that the processing of your personal data be stopped;
  • withdraw your consent to processing;
  • lodge a complaint about the Operator’s actions or inaction with Roskomnadzor (the Russian data protection authority) or in court.

How to exercise these rights:

  • delete your account and all associated data — in the Application: Settings → Delete Account;
  • withdraw consent to Application analytics — by email to support@amberapp.app;
  • withdraw consent to Website cookies — via the “Cookie settings” link at the bottom of any Website page;
  • anything else — by email to support@amberapp.app with the subject “Personal data”.

The Operator may request additional information to verify the requester’s identity.

7. Response Times

7.1. Information about processing is provided within 10 working days of receiving the request (Article 14(3) of the Law).

7.2. Incomplete or inaccurate personal data is corrected within 7 working days of receiving supporting information (Article 20(3) and Article 21(2) of the Law).

7.3. Unlawful processing is stopped within 3 working days of its discovery. If processing cannot be made lawful, the data is destroyed within 10 working days (Article 21(3) of the Law).

7.4. A request to stop processing is fulfilled within 10 working days of receipt, except in cases provided for by the Law (Article 21(5.1) of the Law).

7.5. When consent is withdrawn or the purpose of processing is achieved, the personal data is destroyed within 30 days, unless otherwise provided by the Law or an agreement (Article 21(4) and (5) of the Law).

7.6. The periods in sections 7.1 and 7.4 may be extended by no more than 5 working days, with a reasoned notice.

7.7. If personal data cannot be destroyed within the period specified, the Operator blocks it and destroys it within no more than 6 months, unless another period is set by federal law (Article 21(6) of the Law).

7.8. Destruction of personal data is documented in the manner established by the authorised data protection body.

8. Security

8.1. The Operator takes legal, organisational and technical measures to protect personal data against unlawful or accidental access, destruction, alteration, blocking, copying, provision, dissemination and other unlawful actions (Article 19 of the Law), including:

  • identifying security threats and the required level of protection;
  • limiting the number of people with access to personal data and familiarising them with legal requirements and the Operator’s internal policies;
  • access control;
  • encryption of data in transit between the Application, the Website and the servers;
  • backups and event logging;
  • regular monitoring of compliance with processing and protection requirements.

8.2. If an unlawful or accidental transfer (provision, dissemination, access) of personal data violates data subjects’ rights, the Operator notifies Roskomnadzor within 24 hours of the incident and within 72 hours of the results of its internal investigation (Article 21(3.1) of the Law).

9. Final Provisions

9.1. The Operator may amend this Policy. A new version takes effect when it is published at https://amberapp.app/PersonalDataPolicy, unless stated otherwise.

9.2. This Policy is reviewed when the law or the way personal data is processed changes, and at least once every three years.

10. Operator Details

Individual Entrepreneur Roman Melikhov
INN 682709660135
OGRNIP 324774600520209
Email: support@amberapp.app