Privacy Policy
Version 0.2
1. Who this policy is from
1.1. This Privacy Policy explains how personal data of visitors to https://chatamba.com (the "Site") is processed.
1.2. The controller is Ksentra LLC (ООО «КСЕНТРА»), a company registered in the Russian Federation: OGRN 1127746162741, INN 7729705107, address 119526, Moscow, Vernadskogo prospekt, 93, building 1, apt. 82, Russian Federation; email hello@chatamba.com ("we", "us").
1.3. Today the Site only publishes pages. It has no chat with Chatamba bot, no accounts for visitors, no forms, no payments and no analytics.
1.4. The current version is at https://chatamba.com/legal/privacy/. The version number and the date it takes effect are shown at the top of the page.
2. The chat with Chatamba bot is not open yet
2.1. Until the chat opens, we process no conversation data, because there are no conversations.
2.2. Before the chat opens, we will update this policy, and we will do it before we process any conversation data. We will also ask for your separate consent. Consent is never folded into this policy or into the Terms of Use.
2.3. This policy covers the Site as it is today and nothing more.
3. What we process
3.1. Server access logs. Each time your browser asks for a page, our web server records: your IP address and port; the date and time; the request method and the address of the page, including any parameters in the address; the request headers your browser sends, including your user agent (browser and operating system details), the page you came from and your preferred languages; details of the encrypted connection; and the status, size, duration and headers of the response. Cookie values and authorization headers are not written to the log.
3.2. Email. If you write to hello@chatamba.com, we receive your email address and your message, along with anything about yourself that you choose to include.
3.3. Staff accounts. The private admin area of the Site has named accounts for our staff and contractors: name, work email address, a password stored only as a one-way hash, and the time of the last login. These are the data of the people who run the Site. No visitor data is kept there.
3.4. The Site has no contact forms, registration or comments. We don't ask for special categories of personal data under Article 9 GDPR (for example data about health, beliefs or sex life) or for biometric data, so please don't email them to us. If you do, tell us and we will delete them.
4. Why we process it, and on what legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Keeping the Site secure and working: spotting attacks and abuse, automatically blocking the IP addresses they come from, finding the cause of faults | access logs (3.1) | Legitimate interests, Art. 6(1)(f) GDPR: a secure and working website. We keep the logs for 7 days at most and use them for nothing else |
| Replying to your email | email (3.2) | Legitimate interests, Art. 6(1)(f) GDPR: answering the people who write to us |
| Running the admin area | staff accounts (3.3) | Contract with the staff member or contractor, Art. 6(1)(b) GDPR |
| Meeting legal duties, including lawful requests from authorities | whatever the law requires | Legal obligation, Art. 6(1)(c) GDPR |
We don't use these data for advertising, we don't build profiles of visitors, and we don't make automated decisions that have legal or similarly significant effects on you. Automatic blocking of an IP address only stops requests from that address.
5. Cookies and third-party services
5.1. The Site sets no cookies for visitors.
5.2. Only the private admin area uses cookies, and only two strictly necessary ones that make logging in possible: a session cookie (valid for up to two weeks) and a cookie that protects against forged requests, known as CSRF (valid for up to one year). Strictly necessary cookies don't need your consent.
5.3. The Site has no analytics, no advertising or social-media widgets, no chat widgets and no other third-party scripts. Fonts, images and scripts come from our own server. That is why there is no cookie banner.
5.4. If we ever add a third-party service, we will change this policy first and, where the law requires it, ask for your consent before the service runs.
5.5. You can delete cookies or block them in your browser settings. It makes no difference to reading the Site.
6. Where data is stored and who can see it
6.1. The Site is operated from Russia. It runs on a server in the Russian Federation, rented from a hosting provider, and shares that server and its database with our other sites. The database holds pages and staff accounts, and no visitor data. Access logs are stored on the same server.
6.2. We regularly back up the database and store the copies in cloud storage in the Russian Federation. The hosting provider backs up the whole server, so access logs may be included in its copies.
6.3. Ksentra LLC is a company based in Russia, and its staff and contractors administer the server.
6.4. We don't sell personal data. We share it only with the providers named in this section, and with public authorities when the law requires it.
6.5. Email to hello@chatamba.com passes through Cloudflare, Inc.'s forwarding service in the United States and is delivered to a mailbox with a Russian email provider.
7. How long we keep data
| Data | Retention |
|---|---|
| Server access logs | 7 days at most, then deleted; they may remain in whole-server backups for up to 3 months |
| Database backups (pages and staff accounts) | up to 12 months |
| Emails and our correspondence with you | 12 months after the last message |
| Staff or contractor account | while the person works on the Site; deleted within 30 days after the work ends; it may remain in database backups for up to 12 months |
| Session and CSRF cookies in the admin area | up to two weeks and up to one year (5.2) |
If the law requires us to keep data for longer, we keep it for that period.
8. Your rights
8.1. Under the GDPR and, where they apply, similar laws, you have the right to:
- ask whether we process your personal data, and get a copy of it and information about how it is used;
- have inaccurate or incomplete data corrected;
- have your data erased, for example when we no longer need it;
- have processing restricted while a dispute about it is settled;
- object to processing that rests on our legitimate interests;
- receive data you gave us in a portable form, where this right applies;
- withdraw consent at any time, where processing rests on consent. Withdrawal doesn't affect processing done before it.
8.2. To use any of these rights, write to hello@chatamba.com. To find your records in the access logs, tell us your IP address and roughly when you visited; without that we can't pick your records out of the logs. We may ask you to confirm your identity. We reply within one month. For a complex request we may extend that by up to two further months, and we will tell you why. We don't charge a fee, unless a request is clearly unfounded or excessive.
8.3. You can also complain to the data protection authority in the country where you live or work, or where you think your rights were infringed. A list of authorities in the European Economic Area is on the website of the European Data Protection Board (https://edpb.europa.eu). In the UK, that is the Information Commissioner's Office (https://ico.org.uk). We would like the chance to put things right first, but you don't have to contact us before you complain.
9. Security
The connection between your browser and the Site is encrypted with HTTPS. Access to the server and the admin area is limited to the staff and contractors who need it to run the Site, and it goes through named accounts. We take technical and organisational measures to protect personal data against loss, misuse and unauthorised access. No system is completely secure, and if a breach puts your rights at risk we will act as the law requires.
10. Children
The Site is not aimed at children, and it collects no data from them on purpose: it has no forms or registration. The chat with Chatamba bot will be for people aged 18 and over, as the Terms of Use say. If you are under 18, please don't send personal details about yourself to hello@chatamba.com.
11. Changes to this policy
11.1. We may update this policy. The new version takes effect when it is published on this page, unless it says otherwise. The version number and the effective date are shown at the top of the page.
11.2. If a new version widens what data we process or why, we will ask for your consent again where the law requires it.
12. Contact
Ksentra LLC (ООО «КСЕНТРА»), 119526, Moscow, Vernadskogo prospekt, 93, building 1, apt. 82, Russian Federation. Email for privacy questions and requests: hello@chatamba.com. Requests about your rights (section 8) and complaints go to the same address.