Personal Data Processing Policy

English translation for convenience. The Russian version prevails in case of any discrepancy.

Revision of 2026-07-09. This document has been prepared for legal review (see docs/legal/risk-register.md R-2). The operator's details and the procedure for cross-border transfer are being finalized after the legal entity is registered and the decision on data storage infrastructure is made.

Last revised: 2026-07-09 Version: 2026-07-09-v1

This Policy describes which personal data the PILICAR information platform processes, for which purposes, on which legal grounds, how long the data is stored and which rights the user has. The document has been prepared in accordance with Federal Law No. 152-FZ of 27 July 2006 "On Personal Data".

1. Personal data operator

PILICAR is an information platform for selecting cars from China for Russian buyers and intermediaries.

• Operator: [OPERATOR DETAILS: name, INN, OGRNIP, address]
• Contact for personal data matters: support@carchecker.ru

The operator processes personal data both on its own and by engaging persons acting on its behalf (see §7).

2. Purposes of processing

We process personal data for the following purposes:

1. User registration and identification — providing access to the personal account, restoring access and ensuring the security of the account.
2. Passing contact details to an intermediary at the user's request — when the user leaves a request for a selected car, their contact details are passed to the intermediary for further communication. Processed only with a separate consent to the transfer (see §5, §7).
3. Informational and promotional mailings — sending messages by email only with a separate consent (optional, off by default).
4. Subscription accounting and payment — providing paid plans and processing payment through the payment service (see §7).
5. Analytics and service improvement — anonymized and aggregated usage statistics, processing of cookies of the analytics categories (see §4, §8 and the separate Cookie Policy).

Processing for each purpose is carried out separately; consents to different operations are requested through separate user actions.

3. Categories of data subjects

• Natural persons — registered users of the service.
• Visitors without an account (to the extent of technical data and cookies).

4. Composition of the personal data processed

Special categories of personal data (on health, beliefs, etc.) and biometric data are not processed.

5. Legal grounds for processing

• Consent of the personal data subject (Art. 6, Art. 9 of 152-FZ) — separate consents are requested for processing, for transfer to third parties, for mailings and for subscription auto-renewal.
• Performance of a contract to which the subject is a party (Terms of Use, the subscription offer).
• Performance of obligations imposed on the operator by the legislation of the Russian Federation (tax and accounting records, retention of consent logs).

The exact wording and versions of the consents are set out in the Consent Texts document.

6. Retention periods

Personal data is processed until the purpose of processing is achieved or until the relevant consent is withdrawn. After the consent is withdrawn or the purpose is achieved, the data is deleted or anonymized within a period not exceeding 30 days, except where storage is mandatory by law (consent logs, tax and accounting documents are kept for the periods established by law).

7. Transfer to third parties

The operator engages the following persons acting on its behalf or receiving data on lawful grounds:

• Hosting provider (Supabase) — hosting of the service's database and files. The infrastructure is located outside the Russian Federation; see §8 on cross-border transfer and docs/legal/risk-register.md R-6.
• Payment service (YooKassa) — accepting and processing subscription payments. Payment details are processed by the payment service.
• Intermediaries — when a request for a specific car is submitted, the operator passes the user's contact details to the intermediary only with the user's separate consent, indicating the specific recipient. Each transferred request is recorded in the log.
• AI search service (DeepSeek) — when AI search is used, only the text of the user's search query is passed for processing; contact and account data (email, name, phone) are not passed to the AI search service. The service's infrastructure is located outside the Russian Federation (see §8).

Personal data is not transferred to any other third parties, except in cases provided for by the legislation of the Russian Federation.

8. Cross-border transfer

Part of the operator's infrastructure (database hosting, the AI search service) is located outside the Russian Federation, so the processing of personal data may involve their cross-border transfer. The operator discloses this fact honestly.

The question of localizing the storage of personal data of Russian citizens (242-FZ) and the procedure for notifying Roskomnadzor of cross-border transfer are being worked out; the corresponding risk is recorded in docs/legal/risk-register.md (R-6) and is to be resolved before the public launch of paid functions, with the involvement of a lawyer.

9. Protection measures

• Encryption of the data transmission channel (TLS).
• Encryption of data at rest on the hosting provider's side.
• Access control to data at the row level (RLS) and by role.
• Multi-factor authentication for administrative accounts.
• Logging of operations with personal data.

10. Rights of the personal data subject

You have the right to:

• obtain information about the processing of your personal data and access to it;
• demand the clarification, blocking or deletion of the data if it is incomplete, outdated, inaccurate or processed in breach of the law;
• withdraw any consent at any time in your personal account (/dashboard/privacy); withdrawing a consent does not cancel transfers that have already taken place on its basis;
• appeal the operator's actions or inaction to Roskomnadzor or in court.

Requests on personal data processing matters should be sent to support@carchecker.ru.

11. Cookies

The operator uses cookies of the strictly necessary and the analytics categories. The composition, purpose and retention periods of cookies, as well as the procedure for managing them, are described in the separate Cookie Policy.

12. Changes to the Policy

The operator may update this Policy. The current revision is published at /legal/privacy with the date indicated. Material changes are communicated to users in advance.