Privacy Policy

1. General Provisions

1.1. The Controller is committed to safeguarding the rights and freedoms of individuals in the processing of their personal data, including the right to privacy.

1.2. This Policy applies to all information the Controller may obtain about users of the WŬMÙ AI Office SaaS platform at wumu.ru.

1.3. By using the Platform the User agrees to this Policy. If the User disagrees, they should refrain from using the Platform.

2. Categories of Personal Data Processed

2.1. The Controller processes the following minimum necessary data:

• Email address
• Name, surname or display name
• Subscription plan and payment history data

2.2. Automatically collected anonymised data:

• IP address
• Cookies
• Browser and operating system information
• Date and time of access to the Platform

2.3. The Controller does not collect, process or store payment card data. Payments are processed on the secure side of the payment aggregator (Robokassa), which complies with PCI DSS standards.

3. AI-Specific Data Processing (Prompts)

3.1. Texts, queries and documents uploaded by the User to the AI chat (Prompts) are transmitted to AI model provider servers solely for the purpose of generating a response.

3.2. The Controller does not use User Prompts to train its own AI models.

3.3. The User shall not upload personal data of third parties without their written consent or prior anonymisation.

3.4. The Controller does not initiate data collection from Prompts and is not responsible for any breach by the User of third-party rights.

4. Purposes of Data Processing

• Performance of the Terms of Service agreement
• Creating the User Account and granting access to paid plans
• User identification and processing of support requests
• Sending system notifications (billing status, token limits)
• Improving Platform quality based on anonymised analytics

Marketing communications are sent only with the User's separate explicit consent.

5. Lawful Basis for Processing

• Performance of a contract (the Terms of Service)
• Consent of the User, given by affirmative action (ticking a consent checkbox)
• Legitimate interests of the Controller (service improvement, fraud prevention)

6. Collection, Storage and Disclosure to Third Parties

6.1. Security is ensured through the use of HTTPS, password hashing (Argon2) and restricted database access.

6.2. Disclosure to third parties is permitted:

• With the User's consent
• For payment identification (transmission of User ID to Robokassa)
• To technology partners (AI API providers) for processing requests
• Upon request by law enforcement or court order

7. International Data Transfers

7.1. When accessing global AI models, cross-border data transfer may occur.

7.2. Where personal data is transferred outside the UK, the Controller ensures that appropriate safeguards are in place in accordance with Chapter V of the UK GDPR, including standard contractual clauses or adequacy decisions.

8. Data Retention and Erasure

8.1. Personal data is processed for as long as the User Account exists.

8.2. Upon a request for account deletion, data shall be erased within 30 days, except where retention is required by applicable law.

9. Data Subject Rights

9.1. Under the UK GDPR, the User has the right to:

• Access their personal data held by the Controller
• Request rectification of inaccurate or incomplete data
• Request erasure of their data (“right to be forgotten”)
• Object to or restrict processing
• Data portability
• Withdraw consent at any time
• Lodge a complaint with the Information Commissioner's Office (ICO)

9.2. Withdrawal of consent will result in deletion of the User Account and inability to use the Platform.

9.3. To exercise your rights, contact info@wumu.ru. Response time: up to 30 calendar days in accordance with UK GDPR Article 12(3).