SAYRIL Personal Data Processing Policy

Version of 10.11.2026. Effective from 10.11.2026.

Operator

• Kadurin Aleksandr Anatolevich, INN (Taxpayer ID) 111603182707, self-employed.
• Inquiries concerning personal data: email sayril-info@mail.ru.
• Website: https://sayril.ru. Personal Account: https://sayril.ru/en/account/.

1. General provisions

1.1. This Policy determines the personal data of which Personal Data Subjects, what personal data, for what purposes, on what legal basis, how, and for how long the Operator processes when it sells licenses for the SAYRIL computer program (hereinafter, the “Program”), maintains Personal Accounts and the license server, responds to inquiries, and receives reviews and suggestions, as well as the procedure by which Personal Data Subjects exercise their rights. The Policy is published pursuant to part 2 of Article 18.1 of Federal Law No. 152-FZ of 27 July 2006 “On Personal Data” (hereinafter, the “Law”) and contains information on the implemented requirements for the protection of personal data (section 10).

1.2. The Policy applies to the processing of personal data on the website https://sayril.ru (hereinafter, the “Website”), in the personal account https://sayril.ru/en/account/ (hereinafter, the “Personal Account”), on the license server https://sayril.ru, in the Program (with respect to the information it transmits to the Operator), and in email correspondence with the Operator.

1.3. The terms “personal data,” “operator,” “processing,” “dissemination,” “provision,” and “destruction” are used as defined in Article 3 of the Law. Other terms of the Policy:

• Personal Data Subject: an individual to whom personal data relates;
• Visitor: an individual who uses the Website or the Personal Account;
• User: an individual who acquires a personal license for the Program (SAYRIL Base or SAYRIL Pro) for themselves, including for use in their work;
• Organization: a legal entity or an individual entrepreneur that acquires licenses for the Program for its activities;
• Organization Representative: an individual who acts on behalf of an Organization on the Website; the provisions of the Policy on the Visitor also apply to such an individual unless otherwise stated;
• Organization Employee: an employee or contractor of an Organization to whom it has provided a seat under a license;
• Licensee: a User or an Organization that has entered into a license contract with the Operator;
• Order: an order placed in the Personal Account;
• Offer: the Operator's public offer on the Website; Agreement: the SAYRIL License Agreement.

In the Offer and the Agreement, the Operator is referred to as the Licensor.

1.4. The Operator processes personal data personally, without employees.

1.5. Registration of the Operator as an individual entrepreneur or a change of the Operator's tax regime does not change the operator: processing is continued by the same citizen on the same legal grounds.

2. What the Operator does not receive

2.1. Microphone audio, recognized and translated text, dictation history, meeting recordings, file transcriptions, and other information that the Program creates and stores are processed on the devices on which it runs and are not transmitted to the Operator (section 5 of the Agreement). With respect to this information, the Operator is not a personal data operator. If recognition for other devices on the local network or access for other programs is enabled in the Program, the information is transmitted between them without the Operator's involvement.

2.2. The Operator does not receive or store bank card data.

2.3. The Operator keeps Website visit statistics in the form of daily totals and only if the Visitor has allowed it; how the statistics are kept is described in the Cookie Notice. The daily statistics totals and the action counters contain no information relating to an identified or identifiable individual; therefore, the Operator does not treat them as personal data (clause 1 of Article 3 of the Law).

2.4. Dictation history, recordings, and transcriptions do not need to be attached to inquiries.

3. Whose data is processed

3.1. The Operator processes the personal data of:

• Visitors who have created a user account in the Personal Account or have started registration, including Licensees who are individuals;
• Organization Representatives;
• persons who use the Program but are not user account holders (including Organization Employees): only the information that the Program transmits to the license server (clause 5.4);
• Visitors who browse the Website or download files from it without a user account, including through the update program of the operating system (clause 5.4): only technical log information (Purpose 7);
• persons who have contacted the Operator, and persons who have paid for an Order on behalf of a Licensee;
• Personal Data Subjects who have sent a request concerning their personal data, and their representatives.

3.2. The Personal Account is intended for persons who have reached 18 years of age (clause 1.4 of the Agreement): during registration, a person marks that they have reached 18 years of age. The Operator does not request personal data of minors.

4. Purposes, data, and legal bases

4.1. For each purpose, the data and the legal basis (a clause of part 1 of Article 6 of the Law) are specified.

Purpose 1. Entering into and performance of the contract: placing and paying for an Order, granting the license and the Program, confirming the purchase, notices under the Offer and the Agreement, automatic renewal if the Licensee has turned it on, technical support, refunds, answers to questions before purchase, including a single email about the start of sales to a person who has asked for it.

Data: email address; the name or pseudonym of the Licensee, and for an Organization, its name and INN; the number, contents, number of seats, price, and date of the Order; the documents accepted, their versions, and the date and time of acceptance; the payment number, amount, status, and payment method; refund information (the moment the demand was received, the ground, the amount, the payout date) and the details for the refund if the money cannot be returned by the same method; for automatic renewal, also the record of consent and the log of its changes; correspondence and attachments to inquiries; information about the authority of the Organization Representative, if the Operator has requested it.

Legal basis: clause 5 (performance of a contract to which the Personal Data Subject is a party, and entering into a contract at the Personal Data Subject's initiative). For Organization Representatives and persons who have paid for an Order on behalf of a Licensee, clause 7 applies: exercise of the rights and legitimate interests of the Operator (entering into and performing a contract with the Organization, identifying the payment), provided that the rights and freedoms of the Personal Data Subject are not violated.

Purpose 2. Compliance with tax legislation: generating the receipt, recording income, retaining payment documents.

Data: the settlement information shown in the receipt (date and time, name, amount, and for a settlement with an Organization, also its INN); the email address to which the receipt is sent.

Legal basis: clause 2 (performance of the obligations imposed on the Operator by legislation; Article 14 of Federal Law No. 422-FZ of 27 November 2018).

Purpose 3. Protection of the rights and legitimate interests of the Operator and the Licensee: consideration of claims and disputes related to the Offer and the Agreement, and protection of the exclusive right to the Program against use without a license.

Data: the same as for Purposes 1, 5, 6, and 7, to the extent necessary for the specific claim or dispute.

Legal basis: clause 7.

Purpose 4. Responding to requests concerning personal data: responding to requests of Personal Data Subjects and their representatives, fulfilling demands for rectification, blocking, destruction, and cessation of processing (Articles 14, 20, and 21 of the Law).

Data: surname, first name, patronymic; email address or postal address; the content of the request; information about the identity document and the signature, if they are included in the request; for a representative: the same information about the representative and the document confirming the representative's authority.

Legal basis: clause 2.

Purpose 5. Licenses, devices, and activations: issuing licenses and keeping records of them and of the paid periods of Pro and SAYRIL Corporate Pro, linking devices to the user account, issuing activation codes and license files, transferring a license to another device and releasing a device, revoking licenses and activations, recording the trial period of a linked device.

Data: the number, type, rights, and validity periods of the license; the license key; the paid periods of Pro and SAYRIL Corporate Pro; the name or pseudonym of the Licensee or the name of the Organization, which are recorded in the activation code (clause 6.2); the device code (clause 6.1), the device name set by the user account holder, and the operating system; the numbers of activations, the dates of their issue, release, and revocation, and the reasons for revocation; the device linking date and the trial start time reported by the Program; the Program version and the network address from which the Program's request came.

Legal basis: clause 5. For revocation of licenses and activations upon breach of the Agreement, and for the data of Organization Representatives and of persons who use the Program but are not themselves Licensees (including Organization Employees), clause 7 applies: performance of the contract with the Licensee and protection of the Operator's exclusive right to the Program, provided that the rights and freedoms of the Personal Data Subject are not violated.

Purpose 6. User account and sign-in: registration, sign-in to the Personal Account and to the Program (if the user account holder signs in to it from the Program), confirmation of important actions, restoring access.

Data: email address; name or pseudonym; internal user account number; password; one-time confirmation codes; session information; second sign-in step information, if the user account holder has turned it on.

Legal basis: clause 5.

Purpose 7. Security and operability of the Website, the Personal Account, and the license server: protection against unlawful access and abuse, notifying the user account holder of security events, investigation of incidents, recovery after failures.

Data: network address, date and time, the requested page or type of request to the server, the referring page address, result, browser information (the User-Agent string); user account security events; internal user account and license numbers. For a Visitor without a user account, only technical log information is processed.

Legal basis: clause 7 (protecting the Website and the server against unlawful access and abuse, provided that the rights and freedoms of the Personal Data Subject are not violated); with respect to the measures the Operator is required to take under Article 19 of the Law, clause 2 applies.

Purpose 8. Reviews and suggestions: receiving a review of the Program from the Personal Account, checking it, and publishing it on the Website without information about its author; receiving a suggestion for improving the Program and the Website and responding to it.

Data: the rating and text of the review, the language, the check status, the reason for refusal to publish, and the dates of creation, modification, and publication; the mark confirming acceptance of the review publication rules and of section 12 of the Terms of Use of the Website and Personal Account; the text and date of the suggestion; the date of the first download of the installer from the Personal Account; the internal user account number; the email address of the author of a suggestion, to reply to them.

Legal basis: clause 5 (performance of section 12 of the Terms of Use of the Website and Personal Account).

Purpose 9. Promotional emails: sending promotional emails about the Program to the email address of the user account of a person who has given separate consent to this, and keeping records of consents and their withdrawal.

Data: the email address; the name or pseudonym; the internal user account number; the version of the consent and the date, time, and method of its giving and withdrawal (a mark during registration or in the profile of the Personal Account, the “Unsubscribe” link in an email, an email to the Operator).

Legal basis: clause 1 (the consent of the Personal Data Subject under the document “Consent to Receive Promotional Emails”; Article 15 of the Law, part 1 of Article 18 of Federal Law No. 38-FZ of 13 March 2006 “On Advertising”). Retention of the record of the consent and its withdrawal after withdrawal (clause 9.11) is based on clause 7: confirming that the emails were sent with consent, provided that this does not violate the rights and freedoms of the Personal Data Subject.

4.2. What is mandatory. Without an email address, a name (a pseudonym is allowed), and a password, a user account cannot be created, the Program cannot be downloaded, and an Order cannot be placed; without a device code, an activation cannot be issued; without the name and INN of an Organization, an Order cannot be placed on its behalf. A device name, automatic renewal, consent to promotional emails, a review, and a suggestion are optional: without them, the purchase, licenses, refunds, and support are available on the same terms.

4.3. The Operator does not process special categories of personal data or biometric personal data, sends promotional emails only for Purpose 9, and does not use data for purposes not named in this section. Personal data is not disseminated: a review is published with the signature “SAYRIL user,” without the name, email address, or other Personal Account information; a review containing information that could identify the author or third parties is not published; suggestions are not published.

5. Where the Operator obtains data

5.1. From the Personal Data Subject: upon registration, placing an Order, making an inquiry, sending a review or a suggestion, or making a request concerning personal data.

5.2. From the browser and other programs that access the Website (including the update program of the operating system): technical log information (Purpose 7), and from the browser also the cookies listed in the Cookie Notice.

5.3. From the payment service: the payment information needed to grant the license, for record-keeping, and for refunds (the payment number, amount, status, and payment method).

5.4. From the Program. The Program works without the internet and contacts the license server when online activation by key, releasing a device, or signing in to the user account is started in it, if this option is available in the installed version of the Program. Without such an action, the Program contacts the server only in two cases (clause 5.5 of the Agreement):

• if a license key has been passed to the installer, the Program attempts at startup to obtain an activation with that key until it receives a response from the server;
• if a Pro or SAYRIL Corporate Pro license key is saved in the Program and there is an internet connection, the Program requests the activation of the already paid next period: starting five days before the end of the current paid period and for 30 days after it ends, no more than once a day.

The Program transmits only what is necessary for the operation: the license key or the sign-in confirmation, the device codes, the activation number, and the Program version; the server also receives the network address from which the request came. Audio, text, and information about how the Program is used are not transmitted. If the composition of the transmitted information changes, the Operator will reflect this in the Policy.

The Program's DEB package for Linux adds to the operating system a source of updates on the Website (clause 5.5 of the Agreement). According to its settings, the operating system itself contacts the Website for the list of versions and downloads an update when it is being installed; the Program sends nothing in this case, and the Website receives technical log information (clause 5.2).

5.5. From the Program when a device is linked. The trial period runs in the Program itself, without contacting the server. If the user account holder links a device to the user account, the server records the linking date and the trial start time reported by the Program.

5.6. From the user account holder during activation without the internet. If the device with the Program has no internet connection, the user account holder enters the device code in the Personal Account or uploads a request file, and opens the resulting license file in the Program.

5.7. From emails to the Operator: the content of the email and its attachments.

6. Device code, license file, revocation list, automated checks

6.1. The device code (in the form SRM-…) is computed by the Program on the device from irreversible hashes of information about its hardware and operating system; this information itself is not transmitted to the Operator. In the Personal Account, the device code is linked to the user account and the license; therefore, the Operator processes it as personal data and uses it only to issue and verify licenses and activations.

6.2. The license file and the activation code contain the license number and the activation number, the device code, the rights and their validity periods, the date of issue, and the Licensee's name specified in the Personal Account, and for an Organization's license, the name of the Organization. The file is stored on the Licensee's device, and the Licensee's name is visible in the “About” window. The User has the right to specify a pseudonym instead of the name in the Personal Account. The name in an already issued code cannot be changed; at the Licensee's request, the Operator issues the activation for the same device again.

6.3. The revocation list contains only the numbers of revoked licenses and activations, without names, addresses, keys, device codes, or reasons for revocation.

6.4. Automated checks. The license server automatically performs the actions provided for by the Offer, the Agreement, and the Refund Policy: it grants a license after the payment is confirmed, counts devices, calculates dates and the refund amount using the formula of the Refund Policy, and verifies the authenticity of the Program's request, the key, and the device code. If a check fails, the server does not perform the action, and this is not deemed a refusal: upon request, the decision is made by the Operator. Decisions that produce legal consequences for the Personal Data Subject or otherwise affect the Personal Data Subject's rights and legitimate interests (refusal to activate or transfer a license, revocation of a license for breach of the Agreement, refusal of a refund) are made by the Operator personally and not on the basis of solely automated processing (Article 16 of the Law). An objection to an automated response of the server is sent to sayril-info@mail.ru stating the license number and describing what happened; it is considered by the Operator personally within the periods established for the relevant action by the Offer, the Agreement, and the Refund Policy, and in other cases no later than 30 days from the date of receipt. Consideration of the objection does not extend these periods.

7. How data is processed

7.1. The Operator performs the following actions with data: collection, recording, systematization, accumulation, storage, rectification (updating, modification), retrieval, use, transfer (provision, access) to the persons listed in section 8, blocking, deletion, destruction.

7.2. Processing is mixed: with the use of automation tools, with transmission over the internet, and without the use of automation tools.

7.3. The recording, systematization, accumulation, storage, rectification, and retrieval of personal data of citizens of the Russian Federation are carried out using databases located within the territory of the Russian Federation (part 5 of Article 18 of the Law).

8. To whom data is transferred

8.1. The Operator transfers personal data only to the extent necessary for the purpose:

• to the payment service through which payment is accepted and refunds are made: the Order and payment numbers, the amount, the name of the product, and the email address for the receipt;
• to the Federal Tax Service of Russia: settlement information as part of the receipt (Article 14 of Federal Law No. 422-FZ);
• to persons who, under a contract with the Operator, support the operation of the Website and the license server, store data, and deliver emails, to the extent necessary for this;
• to a new right holder of the Program, if the Licensor's rights and obligations under contracts with Licensees pass to it;
• to government authorities and courts in the cases provided for by law.

8.2. The Operator does not transfer personal data to foreign persons or foreign government authorities. The Operator sends emails only to the email address that the recipient has personally specified. If this address is served by an email service of a foreign person, the email is stored by that service under the recipient's contract with it; the Operator does not enter into contracts with such a service and does not transfer any other information to it.

8.3. The Operator provides the Personal Data Subject, upon request, with information about the persons to whom personal data is transferred (section 11).

9. Retention periods, user account deletion, destruction

9.1. The user account (Purpose 6) is retained until its holder deletes it. The Operator has the right to delete a user account without purchases if the 1-year period since the last sign-in to it has expired, after notifying the holder by email no later than 30 days before the deletion.

9.2. Closing the Personal Account (deletion of the user account). The user account holder can delete it in the Personal Account or by sending an email from the user account's email address. Within 30 days of confirmation of the request, the Operator destroys the email address, the name, session information, device names, the license key in the Personal Account, the review, suggestions, and the date of the first download of the installer. The information that must be retained further under clauses 9.3–9.5 is retained without information about the user account holder: the Order, payment, license, and activation numbers, the device code, the irreversible fingerprint of the license key, and for an Organization, also its INN. The consequences of closing the Personal Account for licenses are determined by the Terms of Use of the Website and Personal Account.

9.3. Licenses, devices, and activations (Purpose 5) are retained while the license is in effect and for three years after its termination: this information is needed to issue activations upon reinstallation, repair, and transfer to another device, to comply with the device limit, and to apply revocation (part 7 of Article 5 of the Law). The paid periods of Pro and SAYRIL Corporate Pro are retained in the same way, and their retention period is counted from the end of the last paid period.

9.4. Information on payments, receipts, refunds, and the granting of rights (Purposes 1 and 2) is retained for five years after the end of the calendar year in which the payment was received (subclause 8 of clause 1 of Article 23 of the Tax Code of the Russian Federation). Information about the accepted document versions is retained while the license is in effect and for three years after its termination, but not less than the period established for payment information. The record of consent to automatic renewal and the log of its changes are retained while the consent is in effect and for five years after the end of the calendar year in which it was withdrawn or the last charge took place.

9.5. Correspondence and inquiries (Purposes 1 and 3) are retained for three years from the date of the last payment or inquiry (the general limitation period, clause 1 of Article 196 of the Civil Code of the Russian Federation). Program log files and other attachments to an inquiry are deleted within 30 days after the response. Requests concerning personal data and responses to them (Purpose 4) are retained for three years from the date of the response.

9.6. Technical information (Purpose 7). The technical log of the Website and the license server is retained for a 60-day period, user account security events for a 365-day period, and the email sending log for a 90-day period. Session information is retained until the session ends and then for a 90-day period; one-time codes and information about uncompleted registrations and password recoveries are retained until they expire. An unpaid Order is retained for a 30-day period after the payment deadline expires and is then deleted.

9.7. The license issuance log contains only internal numbers, without email addresses, names, or network addresses, and is retained for as long as the related information under clauses 9.3 and 9.4.

9.8. Backup copies are retained for no longer than a 30-day period: deleted information disappears from them when the copies are replaced on schedule. The copies are not used to restore deleted information.

9.9. Upon expiry of the retention periods or upon achievement of the purpose of processing, personal data is destroyed within 30 days (part 4 of Article 21 of the Law).

9.10. Reviews and suggestions (Purpose 8) are retained until the author deletes the review in the Personal Account or deletes the user account.

9.11. Promotional emails (Purpose 9) are sent while the consent is in effect. When the consent is withdrawn or the user account is deleted, sending stops immediately (part 2 of Article 15 of the Law); the record of the consent and its withdrawal (the user account number, the version of the consent, the date, time, and method) is retained for three years after the withdrawal or the deletion of the user account.

10. Data protection: implemented requirements

10.1. The Operator takes legal, organizational, and technical measures to protect personal data against unlawful or accidental access, destruction, modification, blocking, copying, provision, dissemination, and other unlawful actions (Articles 18.1 and 19 of the Law).

10.2. The level of protection of personal data during their processing: 4th. It has been established in accordance with the Requirements for the Protection of Personal Data during Their Processing in Personal Data Information Systems approved by Resolution of the Government of the Russian Federation No. 1119 of 1 November 2012; the harm assessment was carried out in accordance with the Requirements approved by Roskomnadzor Order No. 178 of 27 October 2022.

10.3. The measures include, in particular: data transmission over a secure connection; access to the data only for the Operator, and for the persons listed in clause 8.1 only to the extent necessary for their work; cryptographic protection of passwords, one-time codes, license keys, and backup copies; limits on the number of attempts to sign in and to enter codes; security event logs; backup; installation of security updates; internal control over the compliance of processing with the Law and the Policy.

11. Rights of the Personal Data Subject and how to exercise them

11.1. The Personal Data Subject has the right to receive the information about the processing of their personal data specified in part 7 of Article 14 of the Law; to demand rectification, blocking, or destruction of their data if it is incomplete, outdated, inaccurate, unlawfully obtained, or not necessary for the stated purpose of processing; to demand cessation of processing; to withdraw consent to promotional emails (clause 5 of the “Consent to Receive Promotional Emails”); to delete the user account (clause 9.2); and to appeal against the Operator's actions or inaction to Roskomnadzor or to a court (Article 17 of the Law).

11.2. An inquiry is sent to sayril-info@mail.ru or through the Personal Account. If a request is sent from the user account's email address or through the Personal Account after signing in, the Operator replies to the same place and does not ask for information about the identity document. In other cases, the request must contain the information specified in part 3 of Article 14 of the Law: the number of the main identity document of the Personal Data Subject or of their representative, its date of issue and issuing authority, information about the relationship with the Operator (for example, an Order or license number), and the signature; the request may be sent in the form of an electronic document signed with an electronic signature.

11.3. Time limits:

• information about the processing and the opportunity to review the data are provided within 10 business days of receipt of the request; this period may be extended by no more than 5 business days with notice of the reasons (part 3 of Article 14 and part 1 of Article 20 of the Law); a reasoned refusal is sent within the same time limits (part 2 of Article 20 of the Law);
• incomplete, inaccurate, or outdated data is rectified within 7 business days of receipt of the supporting information, and unlawfully obtained data or data not necessary for the purpose is destroyed within the same period (part 3 of Article 20 of the Law);
• if the Personal Data Subject has reported that the data is inaccurate or is being processed unlawfully, the data is blocked for the duration of the verification (part 1 of Article 21 of the Law); unlawful processing is ceased within 3 business days of its discovery, and if the violation cannot be remedied, the data is destroyed within 10 business days (part 3 of Article 21 of the Law);
• a demand to cease processing is fulfilled within 10 business days, and this period may be extended by no more than 5 business days with notice of the reasons; processing necessary for the performance of a contract, payment of taxes, and protection of rights continues until the periods in section 9 expire (part 5.1 of Article 21 of the Law);
• when consent to promotional emails is withdrawn or a demand to stop them is made, sending stops immediately (part 2 of Article 15 of the Law).

12. Incident notification

If an unlawful or accidental transfer of personal data that has resulted in a violation of the rights of Personal Data Subjects is discovered, the Operator notifies Roskomnadzor within 24 hours about the incident and the measures taken and within 72 hours about the results of its investigation (part 3.1 of Article 21 of the Law).

13. Final provisions

13.1. The Policy is published on the Website at https://sayril.ru/en/legal/privacy/; a link to it is provided on the pages of the Website where data is collected.

13.2. A new version of the Policy is published on the Website with its date and takes effect on the day specified in it.

13.3. The Policy is effective in the Russian language. Its translation into English is provided for convenience; in the event of any discrepancy, the Russian text prevails. Pages of the Website in other languages collect the same data for the same purposes and link to this Policy.

Legal provisions are cited in the versions in effect on 10.11.2026.