Personal data
Personal data processing policy
This document sets out the policy of Coredex Technologies LLC on the processing of personal data and describes the data protection measures in place (Part 2, Article 18.1 of Russian Federal Law No. 152-FZ "On Personal Data"). This is a courtesy translation; the Russian version prevails.
Edition of 13 September 2026. Effective from 13 September 2026.
1. General provisions
1.1. The personal data operator is Coredex Technologies Limited Liability Company (Coredex Technologies LLC), TIN (INN) 1684031447, KPP 168401001, OGRN 1261600015160, address: 16 Universiade Avenue, apt. 290, Kazan, Republic of Tatarstan, 420059, Russian Federation, email: info@coredex.ru (the "Operator").
1.2. This Policy applies to all personal data the Operator receives through www.coredex.ru, the Coredex web application, the Coredex ID single sign-on service (id.coredex.ru) and by email (together, the "Service").
1.3. This Policy is based on the Constitution of the Russian Federation, Federal Law No. 152-FZ "On Personal Data", Federal Law No. 149-FZ "On Information, Information Technologies and Information Protection", Government Decree No. 1119 of 1 November 2012 and other applicable regulations.
1.4. This Policy is publicly available at www.coredex.ru/en/privacy. The current edition takes effect on publication unless stated otherwise.
1.5. Terms such as "personal data", "processing", "operator", "cross-border transfer", "blocking" and "destruction" have the meanings given in Article 3 of Law No. 152-FZ.
2. Processing principles
2.1. The Operator processes personal data lawfully and fairly, only for specific, predefined and legitimate purposes, does not combine databases with incompatible purposes, processes only data necessary for those purposes, keeps data accurate and stores it no longer than required.
2.2. The Operator does not make decisions that produce legal effects for users solely on the basis of automated processing.
2.3. The Operator does not process special categories of personal data or biometric personal data.
3. Purposes, data categories, legal grounds and retention
3.1. For each purpose the Operator defines the data subjects, data, legal ground and retention period:
| Purpose | Subjects and data | Legal ground | Retention |
|---|---|---|---|
| Creating and maintaining a Coredex ID account, signing in to Coredex products | Users: name, public username, email address, password hash, invitation code, role, account identifier | Performance of the terms of use to which the user is a party (Art. 6(1)(5) of Law 152-FZ) | While the account exists; no more than 30 days after account deletion |
| Providing Service features: digital asset registry, renewal radar, reminders, encrypted Vault | Users: asset details (names, types, cost, currency, renewal dates), settings, time zone, encrypted Vault data | Performance of the terms of use (Art. 6(1)(5)) | While the account exists or until the user deletes the data; no more than 30 days after account deletion |
| Push notifications about renewals and Service operation | Users: browser subscription endpoint and keys, device and browser type, User-Agent string, notification category settings | Performance of the terms of use (Art. 6(1)(5)); enabled by the user in settings | Until notifications are disabled, the browser subscription expires or the account is deleted |
| News and promotional messages about Coredex | Users: account identifier, browser subscription endpoint, email address | Consent (Art. 6(1)(1)) and prior consent to receive advertising (Art. 18(1) of Federal Law No. 38-FZ "On Advertising") | Until consent is withdrawn or the category is disabled |
| Maintaining the early access list and sending an invitation | Site visitors: email address | Consent (Art. 6(1)(1)) | Until the invitation is sent or consent is withdrawn, but no longer than 3 years |
| Handling enquiries, requests and claims | Applicants: name, email address, content of the enquiry and attachments | Consent (Art. 6(1)(1)); compliance with legal obligations (Art. 6(1)(2)) | 3 years from the reply (limitation period, Art. 196 of the Civil Code) |
| Digital Legacy (beta): notifying a user's trusted contact | Users' trusted contacts: email address | Legitimate interests of the user as a third party, provided the data subject's rights are respected (Art. 6(1)(7)) | Until the user cancels the plan or deletes the account |
| Service security, preventing unauthorised access and abuse | Users and visitors: IP address, User-Agent string, session and sign-in records, administrator audit log | Legitimate interests of the Operator (Art. 6(1)(7)); duty to protect information (Art. 16 of Law 149-FZ, Art. 19 of Law 152-FZ) | Session data — session lifetime plus up to 30 days; security logs — up to 1 year |
| Technical operation of the website (interface language, Coredex ID sign-in) | Site visitors: cookies listed in the Cookie Policy | Performance of the terms of use (Art. 6(1)(5)) | As stated in the Cookie Policy |
3.2. When paid plans launch, the Operator will also process order and payment records to perform the contract and meet accounting requirements (primary accounting documents are kept for 5 years, Art. 29 of Federal Law No. 402-FZ). The Operator does not store bank card details; they are processed by the payment service provider.
3.3. The website does not use web analytics, advertising or tracking cookies. If such services are introduced, the Operator will update this Policy in advance and request consent before enabling them.
4. Encrypted Vault data
4.1. Sensitive Vault fields are encrypted with AES-256-GCM in the user's browser before they are sent to the server. The decryption key is never transferred to the Operator, so the Operator stores only ciphertext and cannot read its contents.
4.2. Users decide what they place in the Vault. A user who stores information about third parties must have a lawful basis to do so.
4.3. The Operator cannot restore Vault contents if the user loses both the key and the recovery kit.
5. Processing operations and methods
5.1. The Operator collects, records, organises, accumulates, stores, updates, retrieves, uses, transfers (provides access to the persons listed in section 6), anonymises, blocks, deletes and destroys personal data.
5.2. Processing is carried out both with and without automation (mixed processing). The Operator does not disclose personal data to the general public.
5.3. When the purpose is achieved, the retention period expires or consent is withdrawn, the Operator destroys personal data within the time limits of Article 21 of Law 152-FZ unless the law requires otherwise.
6. Third parties and cross-border transfer
6.1. The Operator does not sell personal data or share it with third parties for their own marketing.
6.2. To run the Service, the Operator engages the following processors under agreements meeting Article 6(3) of Law 152-FZ:
- Vercel Inc. (USA) — website and serverless function hosting, content delivery;
- Neon, Inc. (USA), servers in the Federal Republic of Germany (Frankfurt am Main) — managed database;
- browser push notification services (Google LLC, Apple Inc., Mozilla Corporation and others, depending on the user's browser) — delivery of push notifications if the user enables them. Notification content is transmitted encrypted.
6.3. This involves cross-border transfer of personal data to the Federal Republic of Germany (a country providing adequate protection) and the United States of America, carried out in accordance with Article 12 of Law 152-FZ.
6.4. The Operator discloses personal data to public authorities only in the cases and manner prescribed by Russian law.
7. Data subject rights
7.1. Data subjects have the right to:
- receive information about the processing of their personal data as set out in Article 14(7) of Law 152-FZ;
- request correction, blocking or destruction of data that is incomplete, outdated, inaccurate, unlawfully obtained or unnecessary;
- withdraw consent and request that processing stop;
- opt out of news and promotional messages;
- complain to Roskomnadzor (rkn.gov.ru) or a court about the Operator's actions or inaction.
7.2. Send requests to privacy@coredex.ru from the email address linked to your account, or in writing to the Operator's address. A request must allow the Operator to identify you and confirm your relationship with the Operator (for example, your account email) and bear your or your representative's signature.
7.3. The Operator responds within 10 business days of receipt; this may be extended by up to 5 business days with a reasoned notice. A request to stop processing is fulfilled within 10 business days, and withdrawal of consent within 30 days, unless the law provides otherwise.
7.4. To delete your account and its data, email privacy@coredex.ru from your account address. Push notifications and their categories can be turned off in profile settings.
8. Operator obligations
8.1. The Operator appoints a person responsible for organising personal data processing, adopts internal policies, performs internal control, assesses potential harm under Roskomnadzor Order No. 178 of 27 October 2022 and trains staff.
8.2. If an unlawful or accidental disclosure of personal data violates data subjects' rights, the Operator notifies Roskomnadzor within 24 hours and reports the results of its internal investigation within 72 hours (Article 21(3.1) of Law 152-FZ).
8.3. Person responsible for organising personal data processing: Ivan Vladimirovich Ermolaev, Chief Executive Officer, privacy@coredex.ru.
9. Data protection measures
9.1. The Operator applies the legal, organisational and technical measures required by Article 19 of Law 152-FZ, including:
- identifying security threats and the required protection level under Government Decree No. 1119;
- encrypting connections (TLS, HSTS) and sensitive Vault data on the user's side (AES-256-GCM);
- storing passwords only as strong hashes (Argon2id);
- using HttpOnly, Secure and SameSite cookies and limiting session lifetime;
- role-based access control, re-authentication for privileged actions and an administrator audit log;
- rate limiting, a Content Security Policy and other protections against attacks;
- backups, vulnerability management and incident response;
- limiting access to personal data to authorised persons bound by confidentiality.
10. Changes and contacts
10.1. The Operator may amend this Policy. A new edition is published on this page with its date. Previous editions are available on request.
10.2. Questions about personal data processing: privacy@coredex.ru or Coredex Technologies LLC, 16 Universiade Avenue, apt. 290, Kazan, Republic of Tatarstan, 420059, Russian Federation.