1. Controller and roles
Maxim Evgenyevich Georgiev, OGRNIP 326690000064721 · Russian Tax ID (INN) 691606134262 · individual entrepreneur. Data-subject requests and legal notices: support@aera-platform.ru. AERA is the controller for website, account, support, marketing and, once billing is launched, subscription/payment administration. When a customer connects a CRM containing third-party data, AERA normally processes that data on the customer’s documented instructions under the separate CRM Data Processing Terms.
2. Principles and legal bases
AERA processes only data reasonably required for stated purposes, limits retention and applies safeguards appropriate to risk. Depending on the purpose, processing is based on separate consent, entering into or performing the AERA agreement, a legal obligation, or another lawful basis applicable to the specific operation. Withdrawal of consent does not affect processing that was lawful before withdrawal.
3. Account and authentication
For registration and access AERA processes name, email, account/workspace identifiers, verification status, session data and security events. Passwords are not stored in readable form; the authentication service stores a one-way password hash. Email verification uses a short-lived one-time code.
- Retention: while the account is active; after account deletion access is blocked immediately and service data is deleted within 30 days, except records that must be retained by law.
4. Free access, billing and subscription
AERA processes the selected plan, subscription status and the free-question allowance when the server reports limit and used. When a payment is made, AERA processes subscription and payment status, provider, currency, amount, the processor fee when the provider sends it, settled amount, transaction identifiers, dates and fiscal-receipt data, including the email address the receipt is sent to. Card payments are made on the secure payment page of JSC “TBank”; AERA does not receive or store card details. CloudPayments is off in the default configuration. YooKassa remains a processor only for payments already made. The card number and CVC are entered on the payment provider page; AERA does not receive or store them.
5. CRM and connected systems
When a CRM is connected, AERA may receive identifiers and records for leads, customers, deals, orders, payments, responsible employees, stages, timestamps and other fields exposed within the permissions granted by the customer. The purpose is synchronization, metrics, change detection, summaries, evidence and alerts. Credentials and access tokens are protected and are not published.
- Retention: when a specific CRM is disconnected, data imported from it is deleted without undue delay; after account deletion it is deleted within 30 days at the latest.
- AERA does not require special-category or biometric data for ordinary service use; customers should not configure integrations to send such data unless separately agreed and legally permitted.
6. Telegram
If the user connects or uses the AERA Telegram bot/Mini App, AERA processes the Telegram identifier, username/name made available by Telegram, connection state and messages/commands sent to the bot. Metrics, alerts or other content requested by the user may be delivered to Telegram. The user must connect only a destination appropriate for the configured data.
7. Support and connection requests
When a person contacts support or submits a connection request, AERA processes the contact details and information voluntarily provided, such as name, work email, company, CRM, role, team size, approximate deal volume, technical details and message text.
- Retention where a request does not lead to a contract: an enquiry that does not lead to a contract is kept for up to 90 days after the last communication; contract and claims correspondence is kept for as long as needed to perform the contract and protect legitimate rights.
8. Technical logs and security
Servers may record IP address, date/time, request and response metadata, browser/user-agent, request identifiers, security events and errors. These records are used to operate the service, prevent abuse, investigate incidents and maintain availability. AERA does not use technical logs for solely automated decisions producing legal or similarly significant effects.
9. Cookies and browser storage
Strictly necessary cookies support login, session security and language choice. Current-tab storage may hold first-touch attribution and pending verification state. Optional analytics is used only after the visitor gives analytics consent. Details are in the Cookie Policy.
10. Analytics and Web Vitals
No external analytics counter is configured in this build; Google Analytics 4 and Yandex Metrica are disabled by default and require an explicit build-time configuration after the relevant data-flow decision. AERA also has a first-party same-origin Web Vitals path for LCP, INP and CLS. Production client sampling and server ingestion default to disabled. If this path is enabled, it runs only after analytics consent on allowed public routes, sends only metric name, numeric value and canonical public route, and stores aggregate statistics rather than raw events. AERA does not intentionally send names, email addresses, CRM records, message contents, credentials, tokens, query strings, URL fragments or referrers through analytics events.
11. Marketing messages
Product news, offers and promotions are sent only after a separate optional advertising consent. Refusal does not prevent registration or service use. Consent can be withdrawn using an unsubscribe control when available or by emailing support@aera-platform.ru. Verification, security, billing-status and requested support messages are service communications, not marketing.
12. Recipients and processors
AERA uses providers only where needed for the relevant function: Timeweb Cloud — hosting of AERA primary server infrastructure and database; data center in Saint Petersburg, Russian Federation; Resend — delivery of service emails and email verification codes; Telegram — delivery of alerts, summaries and messages through the bot/Mini App connected by the user; Cloud.ru — the only provider of Ask AERA answers (Foundation Models, host foundation-models.api.cloud.ru). A request carries the question text, earlier turns of the same login session and verified Core facts: metric values and the previous-period comparison, signal text, connected-source display names and their status. A contact name, phone or address is not sent as its own field. This material is not used to train models. Processing takes place in the Russian Federation; Google Analytics 4 (Google) — analytics for public website pages after the visitor separately consents to analytics; Yandex Metrica (Yandex) — analytics for public website pages after the visitor separately consents, when the counter is configured; YooKassa — historical payments already made; new checkouts are not sent to YooKassa; T-Bank — the individual-entrepreneur settlement account and internet acquiring: card payments are made on the bank’s secure payment page; AERA does not receive or store card details. CloudPayments is off in the default configuration and is not described as a live acquirer. External analytics providers receive data only when a corresponding counter is explicitly configured and the visitor has opted in. T-Bank or CloudPayments becomes a recipient only when the user proceeds to pay. YooKassa is a recipient only for payments already made. AERA does not sell personal data.
13. Location and cross-border transfers
AERA uses Timeweb Cloud for its primary server infrastructure and database. The servers and database are located in a data center in Saint Petersburg, Russian Federation; personal data of Russian citizens is recorded, stored and updated in databases in Russia. Cloud.ru is the only provider of Ask AERA answers; it processes requests in the Russian Federation. Browser integrations that would first write data abroad are disabled by default. Resend and Telegram may involve foreign infrastructure for the service functions in which they are used; where a flow qualifies as a cross-border transfer, the applicable legal basis and prior-notification requirements must be satisfied for that flow.
14. Retention and deletion
Account/service data is kept while the account is active; after account deletion access is blocked immediately and service data is deleted within 30 days, except records that must be retained by law. CRM data follows the shorter rule above. If first-party Web Vitals RUM is enabled, its aggregate store has a 35-day default retention and may not be configured above 90 days. Consent evidence, payment/receipt records, security evidence and correspondence may be kept longer only where required by law or reasonably needed to establish, exercise or defend legal rights. At the end of the applicable period data is deleted or irreversibly anonymized unless another lawful ground requires retention.
15. Security and incidents
AERA uses access controls, encrypted transport, protected credentials, restricted production access, backups and monitoring appropriate to the service. No internet service can guarantee absolute security. AERA investigates incidents, limits consequences and makes notifications required by applicable law and contract. Where the statutory incident-notification criteria are met, the operational runbook targets the initial Roskomnadzor notice within 24 hours of detection and the internal-investigation results within 72 hours.
16. Your rights
You may request information about processing, access, correction, blocking or deletion where applicable, and may withdraw consent. Analytics and marketing choices can be withdrawn separately. Once recurring billing exists, the user may also refuse future use of saved payment details. Requests: support@aera-platform.ru. AERA may ask for reasonable information needed to verify the requester.
Contact us about your data →
17. Changes
This policy may be updated when processing, providers or legal requirements change. The current version and effective date are shown on this page. The Russian text is legally controlling.