Privacy Policy

Version: 1.2 · Effective date: August 01, 2026

Personal Data Controller

For the processing activities described in this Policy, the personal data controller is Andrey Aleksandrovich Litvinov, an individual.

Privacy contact email: litvinov.andreiy@proton.me.

Controller postal address: 296100, Dzhankoy, Oktyabrskaya St., 93.

Legal details contain the shared provider and controller information.

1. Controller and roles

Wappy acts as an independent controller for visitor, account, and team-member data needed to provide and protect the service. When a Form Owner determines the purpose, fields, retention, and use of responses, the Form Owner is the controller and Wappy processes responses under the Data Processing Terms.

2. Data categories

Wappy may process website and technical data, account and team information, workspace data, forms, responses, bookings, products, services, support requests, and limited verified Telegram ID, username, name, and language. The Form Owner determines the response fields and must limit them to the stated purpose.

3. Purposes and grounds

Purposes include registration and login, workspaces, teams, forms, products, services, bookings, responses, security, support, and legal compliance. Grounds include the agreement and requested pre-contract steps, law, legitimate interests balanced with data-subject rights, and a separate dissemination permission for public profiles.

The respondent sees the controller, purpose, data, recipients, ground, and retention before submission. Consent uses a separate initially unchecked checkbox; contract-based forms show a notice without a consent checkbox. Acknowledging that the Policy was read is not consent to personal-data processing.

4. Public profiles

Public profiles and search indexing are disabled by default. Project information is published only when enabled. A member's name, role, or avatar is shown only with that member's separate active permission. Withdrawal hides the selected field immediately and does not require account deletion.

5. Recipients and transfers

Data is available to authorized workspace members and the Form Owner within assigned access. An email provider receives only an email address, one-time code or link, and delivery metadata. Telegram is used for Telegram interaction and neutral linked notifications; full form answers are not sent in notifications.

External services may involve processing outside Russia. Future WhatsApp functionality, if launched, is not an active processing channel by default. Wappy completes applicable transfer requirements and recipient assessment before transfer. Initial recording and storage of Russian citizens' data use a database in Russia where required by applicable law.

6. Cookies, security, and logs

Only technically necessary cookies and session data are used. Wappy applies access control, authentication, encrypted transport, updates, and log filtering. Logs are retained for no more than 30 days except minimal data isolated for a specific incident; response bodies, codes, tokens, init data, email, phone, and Telegram payloads are not logged.

7. Retention

account and workspace data: until deletion or termination, then removed from active systems within 30 days;
ended administrative sessions: no more than 90 days;
responses: the Form Owner's disclosed period and no more than 365 days if no shorter period is configured;
Telegram subscriber data: until interaction ends, then removed within 30 days;
public data: until profile deactivation or withdrawal;
acceptance and consent evidence: the relationship and three years afterward; destruction evidence: three years.

8. Deletion and rights

Deleting one response removes its content and deletes or irreversibly anonymizes identifying context in statistics, notifications, and bookings where no independent basis applies. A shared Client or Telegram subscriber is not deleted while valid records still reference it.

A person may request access, correction, restriction, deletion, withdrawal, or an end to dissemination at litvinov.andreiy@proton.me through the personal-data request form. Proportionate identity verification may be requested. Copies already provided to independent recipients are governed by their rules.

9. Restricted data and age

Accounts and teams are for people aged 18 or older. Wappy is not intended for intentional collection of minors' data, special categories, medical or intimate-life information, political or religious beliefs, biometric identification data, identity-document copies, payment-card data, passwords, or other secrets. An ordinary display photo is not used for face recognition.

10. Changes and contact

Previous versions are archived. Material changes are published as a new version and do not retroactively replace separate consents.

Andrey Aleksandrovich Litvinov
Status: an individual
Controller postal address: 296100, Dzhankoy, Oktyabrskaya St., 93
Email: litvinov.andreiy@proton.me
Website: https://wappy.space