Personal Data Processing Policy
Revision of July 2, 2026
This Policy defines how personal data of users of the Novellatte service (the “Service”) is processed and protected in accordance with Russian Federal Law No. 152-FZ “On Personal Data”. By signing up, the user consents to the processing of personal data under this Policy; the moment of consent is recorded in the account.
1. General provisions
The personal data controller is the operator of the Service (the “Operator”); contact details are provided in Section 9. The Policy applies to all data the Operator receives about users of the Service.
Processing is carried out on a lawful and fair basis, is limited to specific purposes, and is not excessive in relation to them.
2. What data is processed
The Operator processes the following categories of data:
- account data: email address, name (nickname), selected interface language;
- consent records: date and time of consent to personal data processing and acceptance of the terms of service;
- usage data: coin transaction history, payments (amount, status, payment provider identifier), reading progress, created content;
- technical data: session cookies, IP address, browser and device information.
Bank card data is not collected or stored by the Operator — it is processed by the payment provider (YooKassa) in accordance with PCI DSS.
3. Purposes of processing
Data is processed for the purposes of:
- user registration and authentication, account operation;
- providing Service features: reading and creating novels, coin operations;
- processing payments and sending fiscal receipts (Law 54-FZ);
- user support and Service-related notifications;
- compliance with the laws of the Russian Federation.
4. Legal grounds
The legal grounds for processing are: the data subject's consent given at registration; a contract to which the data subject is a party (terms of service, public offer); and obligations imposed on the Operator by the laws of the Russian Federation.
5. Storage and protection
The Service databases are hosted on servers located in the Russian Federation (Yandex Cloud data centers, ru-central1 region), which satisfies the database localization requirement (Article 18(5) of Law 152-FZ).
Data is transferred over secure channels (TLS). Access to data is limited to authorized personnel of the Operator to the extent necessary for their duties.
Data is stored until the user's account is deleted, or longer where required by law (for example, payment records are kept for statutory accounting periods).
7. Data subject rights
The user has the right to:
- obtain information about the processing of their personal data;
- demand rectification, blocking, or deletion of inaccurate or unlawfully processed data;
- withdraw consent to personal data processing;
- appeal the Operator's actions to the authorized personal data protection authority (Roskomnadzor) or to court.
To exercise these rights, send a request to the support address specified in Section 9. Withdrawal of consent may make further use of the Service impossible.
9. Changes and contacts
The Operator may update this Policy; the current revision is always available at /privacy with the revision date indicated.
Questions about personal data processing: support@novellatte.ru.