Personal Data Processing Policy

Edition of 01 April 2026.

1. General Provisions

1.1. This Personal Data Processing Policy (the “Policy”) defines the procedure, conditions and purposes of processing personal data of users of the HotCat.ai service, as well as the protective measures applied.

Operator: IE Samus Polina Olegovna (INN 9707036255, OGRN 1247700623334), legal address: 191119, Russia, St. Petersburg, Ligovsky Ave., 125, lit. A, 16, e-mail: in@hotcat.ai.

1.2. The Policy is developed to comply with Federal Law No. 152-FZ of 27.07.2006 “On Personal Data” (the “Law No. 152-FZ”).

1.3. Use of the Service is possible only after explicit consent to this Policy by checking the appropriate box upon registration on the Site.

1.4. If the User does not agree with the terms of this Policy, the User must refrain from using the Service.

2. Key Definitions

Personal data — any information relating to a directly or indirectly identified natural person (the personal data subject).

Operator — a person who independently organises and carries out the processing of personal data and determines the purposes and composition of the processed data.

User — a natural person who has reached 18 years of age, or a legal entity, using the HotCat.ai Service.

Analysed Content — publicly available materials of third parties (videos, texts, images from Instagram*, TikTok and other open platforms) provided by the User as links for analysis. Analysed Content is not the User’s personal data.

Neural Network Services — external artificial intelligence systems used to process Analysed Content. The User’s personal data is not transferred to such services.

* The social network Instagram is owned by Meta, whose activities have been declared extremist and banned in the territory of the Russian Federation.

3. Principles of Personal Data Processing

The Operator is guided by the following principles:

• legality, fairness and transparency of processing;
• processing of data only for specific, predefined and lawful purposes;
• correspondence of the volume of processed data to the stated purposes; no redundancy;
• accuracy and currency of the data;
• storage of data no longer than required to achieve the processing purposes;
• ensuring data security through organisational and technical measures;
• initial collection, recording and storage of personal data of citizens of the Russian Federation — exclusively in databases located in the territory of the Russian Federation (part 5 of Art. 18 of Law No. 152-FZ).

4. What the Operator Processes and What It Does Not

4.1. Personal data of the User that the Operator processes:

• email address;
• phone number (if provided);
• last name, first name, patronymic (if provided);
• masked bank card details (only for recurring payments; full card details are not received or stored by the Operator — they are processed directly by the payment aggregator);
• IP address, browser type and version, operating system, interface language;
• cookies and session identifiers;
• behavioural data: clicks, page views, interaction with the Service interface;
• statistics on the use of Service functionality.

4.2. Localisation of personal data. The User’s personal data is stored and processed exclusively on servers located in the territory of the Russian Federation. Cross-border transfer of the User’s personal data is not carried out.

4.3. Processing of Analysed Content. To perform the main functions of the Service, the Operator transfers Analysed Content — links to publicly available videos and other materials of third parties — to external Neural Network Services. Such content:

• is not the User’s personal data;
• does not contain data provided by the User upon registration or payment;
• is not stored by the Operator after the request has been processed;
• is public content already posted in the public domain by third parties.

Therefore, no cross-border transfer of the User’s personal data takes place. No special consent for cross-border transfer is required.

5. Purposes of Personal Data Processing

5.1. The Operator processes personal data for the following purposes:

• identification and authentication of the User upon registration and login to the Service;
• conclusion and performance of the License Agreement (public offer);
• provision of access to the functional capabilities of the Service;
• making and confirming payments, including recurring ones;
• sending notifications of upcoming recurring debits and changes to the terms of the Agreement;
• technical support of Users;
• sending marketing and informational mailings (only with separate User consent);
• statistical analysis and improvement of Service quality (based solely on depersonalised data);
• compliance with the requirements of the legislation of the Russian Federation.

6. Legal Grounds for Processing

6.1. The legal grounds for processing personal data are:

• the Constitution of the Russian Federation;
• the Civil Code of the Russian Federation;
• Federal Law No. 152-FZ of 27.07.2006 “On Personal Data”;
• Federal Law No. 149-FZ of 27.07.2006 “On Information, Information Technologies and Information Protection”;
• the public offer (license agreement) concluded with the User;
• explicit User consent expressed upon registration on the Site by checking the corresponding box.

7. Transfer of Data to Third Parties

7.1. The User’s personal data may be transferred to third parties in the territory of the Russian Federation only in the following cases:

• to payment systems and aggregators — for the purposes of settlements and recurring payments (only data necessary to identify the payer and process the transaction is transferred);
• to analytics services — exclusively in depersonalised and aggregated form;
• to the Operator’s contractors — strictly to the extent necessary to perform the contract, subject to confidentiality obligations;
• to authorised state bodies — in the cases and manner provided for by the legislation of the Russian Federation.

7.2. The User’s personal data is not transferred to foreign legal or natural persons. Only Analysed Content (public materials of third parties), which is not the User’s personal data, is transferred to Neural Network Services.

8. Use of Third-Party AI Services

8.1. To provide certain features of the Service (AI analysis of materials, generation of scripts and texts, recommendations), the Operator may transmit user-provided content to one of the following third-party AI services: Google Gemini (provider — Google LLC), OpenAI / ChatGPT (provider — OpenAI, L.L.C.), or Anthropic / Claude (provider — Anthropic PBC).

8.2. The content that may be transmitted to a third-party AI service includes: descriptions and transcripts of video materials, texts and other materials uploaded or selected by the user for analysis, and user prompts or requests necessary to generate the model’s response.

8.3. Personal data of the user (including, but not limited to: surname, first name, email address, phone number, payment details and any other identifying information) is NOT transmitted to third-party AI services.

8.4. AI features are used solely at the user’s initiative. Before the first use of such features in the app, the user is shown a notice informing them about the transmission of the specified content to the AI service, after which the user confirms their consent.

8.5. The user may refuse to use AI features at any time by discontinuing the corresponding actions in the app. Refusal to use AI features does not affect the operation of the other features of the Service.

9. Data Retention Periods

9.1. The User’s personal data is stored for 3 (three) years from the moment the User stops using the Service (last login to the Personal Account), unless otherwise provided by the legislation of the Russian Federation or the terms of the Agreement.

9.2. Data necessary to fulfil tax, accounting and other mandatory requirements is stored for the periods established by the relevant legislation (as a rule, at least 5 years).

9.3. Upon expiration of the storage period, personal data is destroyed or depersonalised in a manner that excludes the possibility of its restoration.

10. User Rights

10.1. In accordance with Law No. 152-FZ, the User has the right to:

• receive information about the personal data being processed and the grounds for its processing;
• demand clarification, blocking or destruction of the data if it is incomplete, outdated, inaccurate or processed unlawfully;
• withdraw consent to the processing of personal data;
• separately withdraw consent to marketing mailings without ceasing to use the Service;
• appeal the actions or inaction of the Operator to the authorised body for the protection of the rights of personal data subjects — Roskomnadzor (rkn.gov.ru) — or to court.

10.2. Requests are sent to in@hotcat.ai. The Operator considers a request within 30 (thirty) calendar days from the moment of its receipt.

10.3. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal. After withdrawal of consent, use of the Service may become impossible.

11. Use of Cookies and Similar Technologies

11.1. The Site uses cookies and similar technologies (web beacons, pixel tags) for activity analysis, content personalisation and improvement of Service operation.

11.2. Consent to the use of cookies is expressed by the User separately upon the first visit to the Site through a special banner (pop-up notice). This consent is not included in this Policy.

11.3. The User may at any time restrict or disable cookies in their browser settings. Disabling cookies may affect the operation of certain Service features.

12. Personal Data Protection Measures

12.1. The Operator takes the following organisational and technical protection measures:

• data encryption during transmission (HTTPS/TLS);
• separation of access rights to personal data among employees;
• appointment of a person responsible for organising the processing of personal data;
• regular audit and monitoring of information systems;
• briefing of employees who have access to personal data.

12.2. In the event of an incident involving unauthorised access to personal data, the Operator notifies Roskomnadzor within the time limits established by the legislation of the Russian Federation and takes measures to mitigate the consequences.

13. Final Provisions

13.1. The Operator has the right to make changes to this Policy. The updated version comes into force from the moment of publication on the Site. Continued use of the Service after publication of changes constitutes consent to the new version.

13.2. The current version of the Policy is permanently available at: https://hotcat.ai/privacy.

13.3. For all questions related to the processing of personal data, please contact: in@hotcat.ai.

Date of publication: 01.04.2026.

Operator details