Consent to Personal Data Processing

1. List of Processed Data

• First and last name (obtained from the Yandex OAuth provider or provided by the User)
• Email address (obtained from the OAuth provider or provided at registration)
• Profile photo (image URL from the OAuth provider)
• OAuth account identifier (internal provider UUID)
• Studio name (only for the Designer role, filled in profile)
• Content of chat messages, files and documents uploaded to projects
• Records of approval decisions with timestamp and comment
• Technical data: IP address, browser User-Agent, interface language, time zone

2. Processing Purposes

• Identification and authentication in the Service
• Providing Service functionality (creating projects, chat, approvals, file storage)
• Communicating with you on technical and service matters (push, email)
• Ensuring Service security and preventing abuse
• Storing legally significant approval records to protect the rights of project parties
• Compliance with the laws of the Russian Federation

3. Permitted Actions with Data

Consent is granted for the following Operator actions with personal data: collection, recording, systematization, accumulation, storage, refinement (updating, changing), extraction, use, transfer (provision, access), depersonalization, blocking, deletion, destruction. Processing method: mixed (automated and non-automated).

4. Third Parties Receiving Data

Consent extends to data transfer to the following processors in the volume necessary for the Service to function:

• Timeweb Cloud (Russia, Moscow): main application database, file storage, authentication service, web application hosting and operational logs
• Yandex LLC (Russia): OAuth authentication
• Unisender (Russia): transactional email notifications

5. Cross-Border Transfer

Cross-border transfer of personal data is not performed. All data is processed and stored within the Russian Federation (Timeweb Cloud, Moscow) in accordance with Part 5, Art. 18 of 152-FZ.

6. Duration and Withdrawal of Consent

Consent is valid from the moment of granting until withdrawal.

I can withdraw my consent at any time in one of the following ways:

• by deleting my account through profile settings in the Service;

• by sending a written application to roomixsupp@gmail.com indicating the account email.

The Operator confirms receipt of a withdrawal request and informs of the action plan within 10 working days. Full termination of processing and account deletion is performed within 30 calendar days from confirmation of withdrawal, except for data whose processing continues on grounds not requiring consent (legally significant approval records: Subclause 5, Clause 1, Art. 6 of 152-FZ; contract performance).

7. Confirmation of Consent

Confirmation of consent is performed by ticking the checkbox "I consent to processing of my personal data under the terms set out in this document and the Privacy Policy" on first login to the Service. The fact of consent is recorded in the database with date, time, IP address, and document version.

I confirm that I am 18 years of age or older and that I provide consent voluntarily, in my own interests.