Personal Data Processing Policy
Material structure
Version of 18 October 2026.
1. General Provisions
1.1. This Policy sets out the procedure for processing personal data of users of the website void0.dev (the "Platform") and is adopted pursuant to Part 2, Article 18.1 of Federal Law No. 152-FZ of 27 July 2006 "On Personal Data" (the "Law").
1.2. The operator is individual entrepreneur Dmitrii Evgenevich Zhdanov, INN (taxpayer ID) 773175001050, OGRNIP (state registration number) 317774600330731 (the "Operator"). Contact for personal data matters: course@void0.dev.
1.3. Terms are used in the meanings given in Article 3 of the Law.
2. What Data Is Processed
| Category | Contents | Source |
|---|---|---|
| Account data | email; name; avatar; Google or Telegram account identifier; Telegram username | The User, when signing in via Google, Telegram or a link sent to email |
| Subscription and payment data | subscription status and term; price and currency; payment amount, status and identifier; link to the cash receipt; Stripe customer identifier or YooKassa saved payment method token | Payment services |
| Progress | marks of completed materials | The User's actions on the Platform |
| Technical data | IP address, browser type, date and time of the request; session and language cookies | The User's browser |
| Analytics data | Google Analytics and PostHog cookie identifiers, pages viewed, interface events | The User's browser, only after consent in the cookie banner |
| Correspondence | content of inquiries and the contact from which they are sent | The User |
The Operator does not receive or store bank card numbers: they are processed by the payment services. The Operator does not process special categories of personal data or biometric personal data.
3. Purposes, Legal Bases and Retention Periods
| Purpose | Data | Legal basis | Retention period |
|---|---|---|---|
| Registration, sign-in, account maintenance | account data, technical data | contract (Clause 5, Part 1, Article 6 of the Law), consent | until the account is deleted |
| Access to paid materials, acceptance of payment, auto-renewal, refunds | account data, subscription and payment data | contract (Clause 5, Part 1, Article 6 of the Law) | until the account is deleted; payment documents: 5 years |
| Cash receipts, accounting and tax records | email, payment data | legal obligation (Clause 2, Part 1, Article 6 of the Law; Federal Law No. 54-FZ, Tax Code of the Russian Federation, Federal Law No. 402-FZ) | 5 years |
| Saving course progress | progress | contract | until the account is deleted |
| Service notifications: payment confirmation, sign-in links, changes to terms | contract | until the account is deleted | |
| Responding to inquiries | correspondence | contract, consent | 3 years from the last inquiry |
| Protection against abuse: request rate limiting, incident investigation | technical data | legitimate interest of the Operator (Clause 7, Part 1, Article 6 of the Law) | up to 30 days |
| Traffic statistics and improvement of the Platform | analytics data | consent | up to 14 months |
The Operator does not send marketing emails.
4. Processing Procedure
4.1. The Operator carries out automated processing: collection, recording, systematization, accumulation, storage, clarification, retrieval, use, transfer (provision, access), blocking, deletion and destruction of personal data.
4.2. When collecting personal data of citizens of the Russian Federation, recording, systematization, accumulation, storage, clarification and retrieval are carried out using databases located in the territory of the Russian Federation (Part 5, Article 18 of the Law).
4.3. The Operator does not make decisions that produce legal consequences for the User solely on the basis of automated processing.
5. Transfer to Third Parties
5.1. The Operator transfers personal data to the persons below to the extent necessary for the relevant purpose:
| Recipient | Purpose | Data | Country of processing |
|---|---|---|---|
| YooMoney LLC (YooKassa) and the fiscal data operator | acceptance of payments in rubles, cash receipts | email, payment data | Russia |
| Stripe | acceptance of payments in US dollars | email, payment data | USA, Ireland |
| sign-in via Google; Google Analytics | Google account data; analytics data | USA | |
| Telegram | sign-in via Telegram, private subscriber channel | Telegram identifier and username | UAE and others |
| Resend | sending emails | email, email content | USA |
| PostHog | product analytics | analytics data | Germany |
| Hosting provider | hosting of the Platform | all data stored on the Platform | under Part 5, Article 18 of the Law: see Clause 4.2 |
5.2. Transfer to the USA, the UAE, Germany and Ireland is cross-border. The Operator carries it out after notifying Roskomnadzor (the Russian data protection authority) under Article 12 of the Law and only for the purposes listed in Section 3.
5.3. The Operator does not sell personal data and does not transfer it for third-party advertising.
5.4. The Operator discloses personal data to state authorities only in cases provided for by law.
6. Cookies
| Cookie | Purpose | Duration | Consent required |
|---|---|---|---|
session | keeping the user signed in to the account | 30 days from the last visit | no: necessary for the account to work |
lang | selected language | 1 year | no: necessary for the website to work |
g_state, g_verifier, g_return | protection of sign-in via Google | 10 minutes | no: necessary for sign-in |
promo-lock | keeping the promotional price when signing in during subscription checkout | 1 hour | no: necessary for checkout |
Google Analytics (_ga, _ga_*) | traffic statistics | up to 14 months | yes |
PostHog (ph_*) | product analytics | up to 1 year | yes |
Analytics cookies are set only after the User clicks "Accept" in the cookie banner. Refusal does not restrict access to the Platform. The User can change the decision at any time via the "Cookie settings" link at the bottom of any page: the banner opens again, and declining deletes the analytics cookies.
7. User Rights
7.1. The User has the right to:
- obtain information about the processing of the User's personal data (Article 14 of the Law);
- require clarification, blocking or destruction of data that is incomplete, inaccurate, outdated or unlawfully obtained;
- withdraw consent to processing;
- delete the account;
- appeal against the Operator's actions to Roskomnadzor or to a court.
7.2. Requests are sent to course@void0.dev from the email linked to the account. The Operator responds within 10 business days. This period may be extended by 5 business days with notice of the reasons.
7.3. Upon withdrawal of consent or deletion of the account, the Operator stops processing and destroys the data within 30 days, except for data that the Operator is required to store by law (Section 3). Withdrawal of consent while a subscription is active makes performance of the agreement impossible: the subscription terminates, and settlements are made under Section 5 of the offer.
8. Data Protection
The Operator applies legal, organizational and technical measures under Articles 18.1 and 19 of the Law:
- data is transmitted only over an encrypted connection (HTTPS);
- session tokens and sign-in link tokens are stored in the database only as a cryptographic hash;
- access to the database and servers is restricted by the Operator;
- bank card data is processed only by PCI DSS certified payment services;
- the frequency of sign-in attempts is limited.
9. Users from the European Union
For users from the EU, processing is carried out on the bases of Article 6(1) GDPR: performance of a contract under point (b), legal obligation under point (c), legitimate interest under point (f), consent under point (a), in accordance with the table in Section 3. In addition to the rights in Section 7, such users have the right to receive their data in a machine-readable format and to lodge a complaint with the data protection supervisory authority of their country.
10. Changes to the Policy
The Operator may amend the Policy by publishing a new version on this page. Users with an account are notified of material changes by email. The Policy is published in Russian, English and Spanish. In the event of a discrepancy, the Russian version prevails.