Personal data processing policy
Edition of 5 October 2026
This is an English translation for convenience. The policy is governed by Russian Federal Law No. 152-FZ “On Personal Data”; in case of discrepancy, the Russian version prevails.
This Policy sets out how AR STUDIO LLC (INN 1655421202, OGRN 1191690061034, address: 54 Tatarstan St., apt. 18, Kazan, Republic of Tatarstan, 420021, Russia) — the “Operator” — processes personal data, as required by Part 2 of Article 18.1 of Federal Law No. 152-FZ of 27.07.2006.
It covers the Stories AR PRO service (pro.stories-ar.com), the stories-ar.com website, the Stories AR mobile apps and the web AR app. Consent to personal data processing is given in a separate document.
1. Terms
Personal data, processing, operator and data subject have the meanings given in Article 3 of 152-FZ.
User — an individual registered with the service (usually a photographer). Visitor — a person using the website without an account, including those who submit a request or pay for a service on the website. Content — photos and videos a User uploads to create an AR album.
2. Data and purposes
| Data | Purpose | Legal basis |
|---|---|---|
| Email, password (hashed) | sign-up, sign-in, account recovery | performance of the agreement, consent |
| Full name, phone, professional field | contacting the User, support, paperwork | consent |
| Plan, payment and balance details | performance of the agreement, accounting and tax records | performance of the agreement, legal obligation |
| Name, email, phone, request text, file links | handling requests and orders placed on the website, contacting the Visitor | consent, performance of the agreement |
| IP address, browser and device details, country | account security, preventing unauthorised access | Operator’s legitimate interest, performance of the agreement |
| Analytics and advertising cookie IDs | visit statistics, ad measurement | consent (cookie banner) |
| Name, email, support request | user support | consent |
| marketing and newsletter emails | separate consent, can be withdrawn at any time | |
| Content (photos and videos) | preparing the AR album on the User’s instruction | User’s instruction (Part 3 of Article 6) |
3. Images of people in uploaded content
Content may include images of third parties — the User’s clients. For such data the User is the operator: the User sets the purposes and obtains the consent of the people depicted. The Operator processes this data on the User’s instruction (Part 3 of Article 6 of 152-FZ), to the extent and on the terms set out in the Terms of Use.
Images are used only as visual markers that trigger video playback in augmented reality. The Operator does not identify people from them and does not create or store biometric templates, so this data is not biometric personal data within Article 11 of 152-FZ.
4. Principles and scope
The Operator processes only the data needed for the stated purposes, does not merge databases with incompatible purposes and makes no decisions with legal effect based solely on automated processing.
The Operator does not process special categories of personal data (Article 10) or biometric personal data (Article 11).
Declining optional consents (newsletters, analytics and advertising cookies) does not affect access to the service.
5. Storage and localisation
Personal data of Russian citizens is recorded, organised, accumulated, stored, updated and retrieved using databases located in the Russian Federation (Part 5 of Article 18 of 152-FZ). Servers are located in Saint Petersburg.
Copies of prepared AR album archives are also kept in storage abroad, solely to deliver content to viewers of the mobile apps and the web AR app. Cross-border transfer complies with Article 12 of 152-FZ.
Retention periods:
- account data — while the account exists and 3 years after deletion (limitation period);
- payment and accounting records — as required by accounting and tax law;
- requests and orders placed on the website without an account — until the order is fulfilled or the request answered, and 3 years after;
- demo albums — 20 days, unpaid albums — 60 days, paid albums — for the period of the plan;
- support conversations — 45 days after the last activity;
- device data — 180 days after the last sign-in.
When the period ends or the purpose is achieved, data is destroyed or anonymised.
6. Recipients
The Operator engages the following parties to process data to the extent needed for the respective services:
| Recipient | Country | Data |
|---|---|---|
| AmoCRM | Russia | name, email, phone, deal details |
| CloudPayments, АО «ТБанк» | Russia | email, user ID, payment amount |
| Stripe | USA, Ireland | email, user ID, payment amount |
| IDrive e2 | United Kingdom | AR album archives |
| Amazon Web Services (S3) | Sweden | AR album archives, thumbnails |
| Mailgun | EU | email, service email text |
| Telegram | UAE, United Kingdom | name, email, plan, support conversation |
| Cloudflare | USA | IP address, browser details |
| SendPulse | USA, EU | email, plan, payment amount — only with newsletter consent |
| ООО «Яндекс» (Яндекс Метрика) | Russia | IP address, cookie IDs, on-site actions — only with analytics cookie consent |
| Google (Analytics, Tag Manager) | USA | IP address, cookie IDs, on-site actions — only with analytics cookie consent |
| Meta (Facebook Pixel) | USA | IP address, cookie IDs, events — only with advertising cookie consent |
Data is also disclosed on reasoned requests from authorised public bodies where required by law.
7. Cookies
Necessary cookies keep you signed in, remember your language, make forms work and store your cookie banner choice — the website does not work without them.
Analytics (Yandex Metrica, Google Analytics) and advertising (Meta Pixel) cookies are set only after explicit consent in the banner shown on the first visit. Until then the corresponding scripts are not loaded. You can change your choice at any time via “Cookie settings” in the website footer.
8. Your rights
You may obtain information about the processing of your data, require it to be corrected, blocked or destroyed, withdraw consent, and complain about the Operator to Roskomnadzor or a court (Articles 14, 20, 21 of 152-FZ).
Send requests to info@stories-ar.com. We respond within 10 working days of receipt; this may be extended by up to 5 working days with notice to you.
You can delete your account and related data yourself in the profile. You can unsubscribe from newsletters via the link in any email or in the profile.
9. Security measures
The Operator takes legal, organisational and technical measures under Articles 18.1 and 19 of 152-FZ: a person responsible for organising data processing is appointed; internal policies are approved; access to data is limited to authorised persons; connections are encrypted; content download links are signed and short-lived; backups are kept; an incident response procedure is in place, including notifying Roskomnadzor within the periods set by Article 21 of 152-FZ.
10. Changes
The Operator may amend this Policy. The current edition is always available on this page. Material changes are communicated to Users by email or in the service interface.
11. Contact
AR STUDIO LLC, INN 1655421202, OGRN 1191690061034
54 Tatarstan St., apt. 18, Kazan, Republic of Tatarstan, 420021, Russia
Personal data requests, including to the person responsible for organising processing: info@stories-ar.com.