This is a convenience translation. The Russian version of the document is legally binding. Russian version
Privacy Policy
Version of October 31, 2026. The current version is always available at slafy.co/en/privacy.
1. General provisions
1.1. This Policy sets out the procedure for processing personal data and the measures to ensure its security, and has been drawn up in accordance with Federal Law No. 152-FZ of 27.07.2006 “On Personal Data” and Federal Law No. 149-FZ of 27.07.2006 “On Information, Information Technologies and Information Protection”.
1.2. The Policy applies to the website slafy.co, the web chat, the API and the Slafy IDE application (hereinafter the Service).
1.3. The Policy is an integral part of the Terms of Service. In case of any conflict between this Policy and the Terms of Service, this Policy prevails.
2. Operator
The personal data operator is the Contractor specified in the “Parties” section of the Terms of Service.
Email for inquiries about personal data processing: support@slafy.co.
Personal data processing began on 10.2026.
3. Categories of data subjects and data processed
3.1. The Operator processes the personal data of users of the Service.
3.2. The following data is processed:
- username and a value derived from the password (hash). The password itself is not stored. No email address or phone number is requested at registration;
- IP address, browser and device information, date and time of sign-ins and requests;
- web chat content: user messages, AI Model responses and generated images;
- information about requests to AI Models via the chat, API and Slafy IDE: model, number of tokens, cost, time and IP address. The content of requests via the API and Slafy IDE is not stored on the Operator's server;
- information about API keys and connected Slafy IDE applications: name, date of creation and last use;
- information about payments made and balance transactions: date, amount, order number, payment status. Bank card details are not transferred to or stored by the Operator;
- information voluntarily provided by the user when contacting support.
3.3. Slafy IDE projects, files and chat history are stored on the user's device and are not transferred to the Operator's server, except for content that the user or the agent sends to an AI Model as part of a task.
3.4. The Operator does not process special categories of personal data or biometric personal data. The user should not include in requests to AI Models information relating to special categories of personal data, or other people's personal data without a legal basis.
4. Purposes of processing, legal grounds and retention periods
| Purpose | Legal basis | Retention period |
|---|---|---|
| Registering and maintaining the account | Clause 5, Part 1, Article 6 of Law 152-FZ, performance of a contract (Terms of Service) | Until the account is deleted |
| Providing the Services: forwarding requests to AI Models, storing chats, accounting for and debiting tokens | Clause 5, Part 1, Article 6 of Law 152-FZ | Chats until deleted by the user or until the account is deleted; request information until the account is deleted |
| Accepting and accounting for payments | Clause 5, Part 1, Article 6 of Law 152-FZ; accounting and tax law requirements | 5 years from the date of the transaction |
| Ensuring security, preventing fraud and abuse | Clause 7, Part 1, Article 6 of Law 152-FZ, legitimate interests of the Operator | Sign-in sessions for 30 days or until sign-out; other information until the purpose is achieved |
| Handling inquiries and feedback | Clause 5, Part 1, Article 6 of Law 152-FZ | 1 year from the date of the inquiry |
5. Consent and its withdrawal
5.1. Consent to the processing of personal data is given upon registration and when using the relevant features of the Service that require processing in order to work.
5.2. Consent may be withdrawn by sending a request to support@slafy.co. Withdrawal results in the termination of processing and deletion of the account, except where processing continues on another legal basis, including to fulfill obligations under accounting and tax law.
6. Data transfer. Processors
6.1. The Operator does not transfer personal data to third parties except: with the data subject's consent; to authorized government bodies in the manner prescribed by law; to persons engaged in processing on behalf of the Operator, to the extent necessary for the stated purposes.
6.2. The following processors are engaged:
| Processor | Purpose | Data transferred | Location |
|---|---|---|---|
| TBank JSC | accepting payments in rubles | order number, payment amount | Russian Federation |
| Fornex Hosting S.L. | server hosting and data storage | account, chat, request and payment data | Germany |
| AI model access providers and model developers (Anthropic, OpenAI, Google, xAI, DeepSeek, Moonshot AI, Zhipu AI) | processing requests to models | request text, files and images that the user sends to the model; without the user's username or IP address | USA, China and other countries |
6.3. Requests to AI Models are sent on behalf of the Operator without the user's username, IP address or other identifiers. Model providers process the content of requests in accordance with their own terms.
7. Cross-border transfer
7.1. The Operator carries out cross-border transfer of personal data to the persons listed in Clause 6.2 located outside the Russian Federation, to the extent necessary to provide the Services and operate the Service.
9. Security measures
9.1. The Operator takes the measures provided for by Articles 18.1 and 19 of Law 152-FZ, including: restricting and segregating access to personal data; storing passwords and API keys only as hashes; transmitting data over a secure HTTPS channel; additional sign-in confirmation for the administrative section and a log of administrator actions; backups.
10. Rights of the personal data subject
10.1. The data subject has the right to receive information about the processing of their personal data, to demand its clarification, blocking or destruction if it is incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose, to withdraw consent, and to appeal the Operator's actions to Roskomnadzor or to a court.
10.2. Requests are sent to support@slafy.co stating the account username and an address for the reply.
10.3. Information about processing is provided within 10 business days of receiving the request. This period may be extended by no more than 5 business days, with a reasoned notice sent to the data subject (Article 20 of Law 152-FZ). A demand to clarify, block or destroy data is reviewed within 7 business days.
10.4. A repeated request with the same demand is allowed no earlier than 30 days after the original one, except where the information was not provided in full.
11. Cookies
11.1. The website uses only essential cookies: for signing in to the account and, if you followed a referral link, a cookie with the invitation code for 30 days so that the invitation is counted at registration. The selected theme, model and chat settings are stored in the user's browser and are not sent to the server.
11.2. No web analytics services or advertising counters are used on the website. Fonts and other website resources are loaded from the Operator's server.
12. Changes to the Policy
12.1. The Operator may amend this Policy. The current version is published at slafy.co/en/privacy with the version date.