Privacy policy

1.1.Service — the Paper Bot bot for the Lolka platform, the website paperbot.ru and the web panel for managing the bot.

1.2.Operator — the owner of the Service, who organises the processing of data and determines its purposes. The Operator can be contacted via the support server (section 12).

1.3.Platform — the Lolka communication platform on which the bot runs.

1.4.Server — a community on the Platform to which its administration has added the bot. Server Administration — its owner and persons with administrator rights. Staff — members with support roles who work with tickets.

1.5.User — any person who uses the Service: opens a ticket, writes in a ticket channel, answers form questions or signs in to the web panel.

1.6.Ticket — a User’s request: a separate channel on the Server with the conversation between the User and the Staff.

1.7.Personal data — any information relating directly or indirectly to a User, including their identifier and name on the Platform.

1.8.Processing — any actions with data: collection, recording, storage, use, transfer, anonymisation, deletion.

2.1.The Operator processes only the data needed for the Service to work:

• Platform identifiers of servers, users, channels, roles and messages;
• the User’s name and avatar on the Platform — in ticket conversations and in the web panel;
• ticket data — number, category, who opened it and who claimed it, dates, subject, answers to form questions, closing reason;
• the conversation in ticket channels and links to attachments, as well as transcripts made from it;
• the ticket rating after closing and the comment on it, if the User left them;
• the Staff note on a ticket — only the Staff can see it (in the web panel and as a hidden bot reply in the ticket channel); it does not get into the ticket conversation or the transcript;
• Server settings set by the Server Administration, and blacklist entries with the reason;
• the log of Staff actions in the web panel;
• technical data — the web panel session cookie, website request logs (IP address, browser, time), error reports;
• information about visits to website pages (except the web panel) — the web analytics service cookie, IP address, browser and device, pages viewed, referral source and link clicks.

2.2.The Operator does not store messages outside ticket channels. Special categories of personal data (health, beliefs, etc.) and biometric data are not collected on purpose; if a User writes them in a ticket themselves, they are processed as an ordinary conversation.

2.3.Purposes of processing: opening and handling tickets; showing the conversation to the Staff; keeping transcripts; Server statistics for its Administration; applying limits and the blacklist; signing in to the web panel; ensuring security, finding and fixing errors; website traffic statistics to improve the website.

2.4.The Operator does not use data for advertising, does not sell it, does not build User profiles and does not link data from different Servers with each other.

3.1.The User gives consent to the processing of data within the scope of section 2 by taking actions in the Service: opening a ticket, sending a message to a ticket channel, answering form questions or signing in to the web panel. The User gives consent to the collection of website visit information (clause 2.1) separately, by clicking “Accept” in the cookie notice; until then the web analytics service is not loaded. If the User declines, the website works just the same. The choice is stored in the User’s browser; you can change the cookie choice at any time. The web panel session cookie is necessary for signing in and is used without separate consent.

3.2.By adding the bot, the Server Administration agrees to this Policy and is responsible for making sure the Server’s members know that ticket conversations are kept.

3.3.Consent can be withdrawn at any time by sending a Request (section 7). After withdrawal, the data is deleted as set out in sections 6 and 7; consent will be needed again to keep working with tickets on the Server.

4.1.The conversation of closed tickets (messages, transcript, form answers, subject, closing reason, rating comment, Staff note) is kept for the period set by the Server Administration in the Service settings — by default 180 days after the ticket is closed and no more than 365 days. When the period ends, it is deleted automatically; the ticket number, category, dates and rating are kept for Server statistics.

4.2.The data of open tickets is kept while the ticket is open.

4.3.Server settings and blacklist entries are kept while the bot is on the Server or until the Server Administration changes them. A copy of the settings made for transfer by code (the “Transfer” tab) is kept for one day and deleted automatically.

4.4.The web panel action log is kept for 1 year.

4.5.After the bot is removed from a Server, all data of that Server (tickets, conversations, transcripts, settings) is deleted within 3 days. This period is there in case the bot was removed by mistake and is added back.

4.6.Database backups are kept for no more than 7 days.

4.7.Files and messages the bot has sent to Server channels (for example, transcripts and log entries) are stored on the Platform and are managed by the Server Administration; deleting data on the Operator’s side does not affect them.

4.8.Processing ends when its purposes are achieved, retention periods expire, consent is withdrawn or unlawful processing is discovered.

5.1.Data is stored on the servers of a hosting provider in the Russian Federation.

5.2.The Operator does not transfer data to third parties, except where the Service cannot work without it: the Platform — when the bot performs actions; the Operator’s backup storage — for database copies; monitoring and error reporting services — for technical information about failures. In addition, information about website visits (clause 2.1) is processed by the Yandex Metrica web analytics service (Yandex LLC); the web panel has no visit counter.

5.3.Error reports may be processed by a service located outside the Russian Federation; they contain only technical information about the failure, which may include identifiers from the request.

5.4.Data is provided to government authorities only in the cases and in the manner expressly provided for by the legislation of the Russian Federation.

6.1.The User has the right to:

• find out what of their data is processed, for what purposes and for how long;
• demand that data be corrected, blocked or deleted if it is incomplete, outdated, inaccurate, unlawfully obtained or not needed for the purposes of processing;
• withdraw consent to processing;
• appeal against the Operator’s actions to Roskomnadzor or in court;
• exercise other rights provided for by the legislation of the Russian Federation.

6.2.On a deletion request, the Operator deletes the User’s messages in tickets on all Servers, transcripts that contain them, their answers to form questions and records about them in the web panel log. Blacklist entries are a moderation decision of a specific Server — the User contacts that Server’s Administration about them.

6.3.The Server Administration can at any time shorten the conversation retention period, delete a ticket in the web panel or remove the bot from the Server.

7.1.Inquiries, demands, withdrawal of consent and claims (the “Request”) are sent to the support server (section 12).

7.2.A Request must contain the User’s name and identifier on the Platform, so the Operator can find their data, and what the Request is about. The Operator may ask for confirmation that the Request was sent by the User themselves.

7.3.The Operator answers a Request within no more than 10 working days from the day it is received.

7.4.Inaccurate data is corrected within 7 working days after the inaccuracy is confirmed. Unlawful processing is stopped within 3 working days of being discovered, and if it cannot be made lawful, the data is destroyed within 10 working days. After consent is withdrawn or the purposes of processing are achieved, the data is destroyed within 30 days, unless the law requires it to be kept.

8.1.The Operator takes legal, organisational and technical measures to protect data from unlawful or accidental access, modification, deletion, copying and distribution.

8.2.These include: access control — a Server’s data is available only to its Administration and Staff, and permissions are checked on every request to the web panel; encryption of the connection to the website; restricted access to the database; monitoring of unauthorised access attempts; backups.

8.3.The Operator processes data on their own, has technical access to the database and uses it only to support Users and fix failures.

9.1.The Operator is not liable for consequences arising:

• from failures of the Platform, communication networks, equipment and software the Operator does not control;
• from the User giving third parties access to their account or to the web panel;
• from unlawful actions of third parties despite the protection measures taken;
• from actions of the Server’s Administration and Staff — they decide themselves who sees tickets and how tickets are handled.

9.2.Data processed by the Platform itself (the account, messages outside the bot) is governed by the Platform’s policy. Age restrictions and rules of use are set by the Platform; the Service works within them.

10.1.The Operator may change the Policy unilaterally. A new version takes effect when it is published on this page; the version date is given at the top of the document.

10.2.The Operator announces significant changes on the support server.

10.3.Continuing to use the Service after the changes means agreeing to the new version. If the User does not agree, they stop using the Service and may demand that their data be deleted.

11.1.The Policy and the relations between the User and the Operator are governed by the legislation of the Russian Federation.

11.2.Disputes are settled through negotiation. Before going to court, the User sends a claim via the support server; it is considered within 30 calendar days. If the dispute is not settled, it is heard in court in the manner established by the legislation of the Russian Federation.

12.1.Matters not covered by the Policy are governed by the legislation of the Russian Federation, including Federal Law No. 152-FZ “On Personal Data” and Federal Law No. 149-FZ “On Information, Information Technologies and Information Protection”.

12.2.Requests, data deletion requests and claims are sent to the support server.

12.3.The current version of the Policy is always available on this page. See also the Terms of use.