Privacy Policy

Information We Collect

We collect information both directly from you and automatically as you use the Service. This may include the following.

Log data. When you visit approvehub.app, our servers and analytics tools may automatically log standard data provided by your browser. This may include your device's IP address, browser type and version, the pages you visit, the date and time of your visit, the time spent on each page, and other diagnostic details.

Personal information. We may ask for personal information such as your name, email address, and profile details, as well as the content you create in the Service, including organizations, workflows, approval requests, comments, and files you upload.

Transaction information. If you purchase a paid plan, payments are processed by our payment provider, Robokassa. We do not collect or store your full card details on our servers; we receive only the limited transaction information (such as confirmation of payment) needed to provide the paid service.

Legitimate reasons for processing. We process your personal information only when we have a lawful basis to do so, we can identify a legitimate reason, and this processing does not override your rights. Before processing for a new purpose, we will make that purpose clear to you.

How we use information. We use the information we collect to operate and maintain the Service, authenticate you and keep your account secure, send you transactional emails (such as email verification, invitations, and password resets), respond to your support requests, understand and improve how the Service is used, and comply with our legal obligations.

Security of Your Personal Information

We protect the personal information you provide using commercially acceptable measures to prevent loss, theft, and unauthorized access, disclosure, copying, use, or modification. Although we will do our best to protect your personal information, we advise that no method of electronic transmission or storage is 100% secure, and no one can guarantee absolute data security.

Session and audit records. When you sign in, we record the IP address and browser information of the session so you can review your active sessions and sign out of the ones you do not recognize; these details are visible only to you. When an approval decision is made, we record the same details as part of the audit trail of the request; they are visible only to the administrators of the organization. Records of expired sessions are deleted within 30 days.

How Long We Keep Your Personal Information

We keep your personal information only for as long as we need it. This period may relate to how long you continue using the Service, how long is reasonably necessary to keep your account open, or as long as required to comply with our legal obligations. If you terminate or delete your account, we will delete your personal information within 30 days of the deletion of your account.

We may, however, retain some personal information where necessary to comply with a legal, accounting, or reporting obligation, or for archiving purposes in the public interest, or for scientific, historical research, or statistical purposes.

Children's Privacy

We do not aim any of our products or services directly at children under the age of 13, and we do not knowingly collect personal information about children under 13. If you believe a child has provided us with personal information, please contact us so we can delete it.

Disclosure of Personal Information to Third Parties

We may disclose personal information to third-party service providers ("subprocessors") that help us operate the Service. We share only what is necessary and require these providers to protect your information. They include:

• UpCloud (Finland; data stored in the European Union) — cloud hosting and data storage;
• Cloudflare (United States) — content delivery, TLS termination, and protection against attacks;
• Mailgun (United States; and, where applicable, Amazon Simple Email Service) — delivery of transactional emails;
• Google Analytics (United States) — measuring and understanding how the Service is used;
• Robokassa (Kazakhstan) — processing payments for paid plans.

We may also disclose personal information to third parties where required to comply with the law, to enforce our terms, to protect our rights, property, or safety, or in connection with a business transfer as described below.

International Transfers of Personal Information

The Service is operated from the Russian Federation, and our hosting provider stores data in the European Union. Payments are processed by a provider established in Kazakhstan, and some of our other providers are established in the United States. As a result, the personal information we collect may be stored, processed, and transferred in these and other countries whose data protection laws may differ from those of the country in which you initially provided the information. Where we transfer your personal information, we take steps to ensure it remains protected in accordance with this policy.

Your Rights and Controlling Your Personal Information

You retain control over your personal information. Depending on your location, you may have the right to:

• access and receive a copy of the personal information we hold about you;
• correct information that is inaccurate or out of date;
• request that we delete your personal information;
• restrict or object to our processing of your personal information;
• request a portable copy of your personal information;
• withdraw consent where we rely on it to process your information.

You can update most of your information directly in your account settings. To exercise any of these rights, contact us using the details below. You also have the right to complain to a data protection authority about our collection and use of your personal information.

Use of Cookies

A cookie is a small piece of data that our website stores on your device and accesses on each visit. We use strictly necessary cookies to keep you signed in and to secure your session. We also use Google Analytics, which sets cookies to help us understand how the Service is used.

You may decline cookies if your browser permits. Most browsers let you refuse all or some cookies, though declining strictly necessary cookies may prevent you from signing in. At this time, we do not respond to browser "Do Not Track" signals.

Business Transfers

If we or our assets are acquired, or in the unlikely event that we cease operating or become insolvent, personal information may be among the assets transferred to third parties. You acknowledge that such transfers may occur and that any party acquiring the Service may continue to use your personal information in accordance with this policy.

Limits of Our Policy

The Service may link to external sites that are not operated by us. Please be aware that we have no control over the content and policies of those sites, and we cannot accept responsibility for their respective privacy practices.

Changes to This Policy

We may change this policy from time to time to reflect updates to the Service or to comply with the law. When we do, we will revise the effective date at the top of this page. Your continued use of the Service after any change means you accept the updated policy.

Additional Disclosures for GDPR Compliance (EU)

The data controller responsible for your personal information is Ilya Sayakhov, an individual operating the ApproveHub service. We process your personal information on one or more of the following lawful bases: your consent; the performance of a contract with you; our legitimate interests in operating and improving the Service; and compliance with our legal obligations.

Where processing is based on your consent, you may withdraw it at any time. Where it is based on legitimate interests, you may object to that processing. You also have the right to lodge a complaint with your local data protection supervisory authority.

Additional Disclosures for California Compliance (US)

Under the California Consumer Privacy Act (CCPA), California residents have the right to know what categories of personal information we have collected about them and how it is used, to request deletion of their personal information, and to be free from discrimination for exercising these rights. We do not sell your personal information.

California's "Shine the Light" law also permits residents to request information about our disclosure of personal information to third parties for their direct marketing purposes. We do not share personal information with third parties for their direct marketing.

Contact Us

If you have any questions about this Privacy Policy or how we handle your personal information, please contact:

Ilya Sayakhov
INN (taxpayer ID) 422316490493
[email protected]