← Back to home

Privacy Policy

Version of September 30, 2026 · applies to devunit-lab.business

1. General

1.1. This policy explains how personal data of visitors to devunit-lab.business (the "Website") is processed: what is collected, why, where it is stored, who receives it and how to stop it.

1.2. The Website is addressed to business clients outside Russia. For visitors from the European Economic Area and the United Kingdom we follow the principles of the General Data Protection Regulation (GDPR): we process the minimum, for a stated purpose, and delete data on request.

1.3. By ticking the box in the request form or sending a message in the chat, you consent to the processing of the data you provide on the terms below, including its transfer to Russia described in section 7.

2. Definitions

• Operator (data controller) — the person who decides why and how personal data from the Website is processed (contacts in section 12).
• User — any visitor to the Website.
• Personal data — any information relating directly or indirectly to a user.
• Processing — any action with data: collection, recording, storage, use, transfer, deletion, etc.
• International transfer — transfer of data to another country.

3. What data we process and why

3.1. The Website runs no analytics and no advertising scripts: we do not build visitor profiles and do not track you across sites.

3.2. We do not collect special categories of data (health, beliefs, ethnicity, etc.) or biometrics. Please don't enter passport details, passwords or card numbers — they are not needed for a request.

3.3. The Website is not intended for persons under 18. If you learn that a child has left their data with us, let us know and we will delete it.

4. Legal grounds

• your consent (GDPR Art. 6(1)(a)) — for form and chat data and for their transfer outside your country;
• steps taken at your request before entering into a contract (Art. 6(1)(b)) — preparing a proposal;
• legitimate interest in keeping the Website secure (Art. 6(1)(f)) — server logs and spam protection.

5. What we do with data

5.1. We collect, record, store, use, transfer and delete it — only for the purposes in section 3. We do not use it for marketing mailings.

5.2. The AI consultant replies automatically but makes no decisions with legal or similarly significant effect for you: price, timing and terms are always agreed by a human.

6. Where and how long we store data

6.1. The Website's pages are static files on a server in Moldova. Requests from the form and chat messages are forwarded over an encrypted channel to the operator's server in Moscow, Russia, which delivers them to the operator in Telegram.

6.2. After the period expires or consent is withdrawn, data is deleted within 30 days unless the law requires longer storage.

7. Who receives data

Data is never sold or shared for advertising. To run the Website it is shared, to the extent necessary, with:

7.1. International transfers. Russia, the UAE and, for some services, the USA are not covered by an EU adequacy decision. Data you send through the form or the chat is transferred there on the basis of your explicit consent (GDPR Art. 49(1)(a)), which you give by ticking the box in the form or by sending a chat message after reading this policy. The transfer is limited to what the purpose requires.

7.2. If you don't want your text to reach Google, don't use the chat. If you don't want your data to be transferred at all, write to us by email and tell us only what you are comfortable sharing.

7.3. Data may be disclosed to public authorities only in cases and in the manner expressly provided by law.

8. Cookies and browser storage

8.1. The Website sets no tracking or advertising cookies and therefore shows no cookie banner. It stores only what it needs in your browser's own storage:

• your chosen theme (light or dark);
• the ID of the current chat conversation — until the tab is closed;
• the chat window size.

8.2. You can clear this storage in your browser settings at any time — the Website will keep working.

9. How we protect data

• all traffic goes over HTTPS; requests travel between our servers inside an encrypted tunnel;
• only the operator has administrative access to the servers;
• each site and service runs in its own container and network — a failure or breach of one does not expose another's data;
• service access keys are stored separately from code and never committed to repositories;
• only the operator can access requests;
• we collect the minimum — we don't store anything we don't need.

9.1. If a data breach creates a risk for you, we will inform the affected users without undue delay and notify the competent authority where the law requires it.

10. Your rights

At any time you may:

• find out what data we hold about you, where it came from and why, and get a copy of it;
• ask us to correct or delete it, or to restrict its processing;
• object to processing based on legitimate interest;
• withdraw your consent — this does not affect processing that took place before the withdrawal;
• lodge a complaint with the data protection authority of the country where you live or work.

10.1. How: write to any contact in section 12 and tell us how to identify you (for example, the contact from your request). We reply within 30 days and delete data within 30 days of consent withdrawal.

11. Other terms

11.1. The Website links to other resources (Telegram, GitHub, project demos). Their data rules are set by their owners.

11.2. The operator may update this policy. The current version is always available at this address, with the version date shown at the top.

12. Operator contacts

Telegram: @tosha_DevUnit
Email: anton@devunit-lab.ru