Privacy Policy of "UCHU" App

Revision: 1.3 dated 11.10.2026. Effective upon publication.

1. General Provisions

1.1. This Policy defines the procedure for processing and protecting the personal data of users of the "UCHU" mobile application and related email communications (hereinafter — the Application).

1.2. Personal Data Operator: Individual entrepreneur Erik Alexandrovich Minasov, address: 12 Arkhitektora Petina Street, Krasnodar, Russia; e-mail for personal data inquiries: uchuacademy@gmail.com.

1.3. The Operator processes personal data in accordance with the legislation of the Russian Federation, including Federal Laws No. 152-FZ "On Personal Data", No. 242-FZ (localization of databases), and No. 149-FZ. Advertising emails are also subject to Article 18 of Federal Law No. 38-FZ "On Advertising".

2. Processed Data and Sources

2.1. The User provides data during registration and use of the Application:

• Name (Contact Info — Name).
• Phone Number (Contact Info — Phone Number).
• Email address and its verification status, if the user provides an email during registration or links it to an existing account.
• Age Group (Demographics; e.g., 14–17, 18–24, 25–34, 35–44).
• Learning Preferences: goals, estimated study time per day, and interactions within the Application (App Interactions/Other Data).

2.2. Technical Data: information about the device and operating system, technical information, and error reports (log files) required for the functioning of the Application (minimum necessary volume).

2.3. The Application does not request access to the microphone/camera/geolocation unless explicitly indicated to the user.

2.4. An email subscription additionally involves topic preferences, account identifier, date, source and version of consent, preference changes and opt-out records. Interests, courses, learning progress and recent activity are used to select appropriate emails. Delivery records include message identifiers, statuses and times of delivery, opening, clicks, unsubscribes, complaints and delivery failures. An opt-out reason or comment is optional. See Section 16.

3. Purposes of Processing

1. Creation and maintenance of an account, authentication, user support.
2. Personalization of content and tasks, formation of the curriculum.
3. Delivery of necessary service emails: email verification, sign-in and account security, payment information and subscription servicing.
4. With separate consent, delivery of selected informational and advertising UCHU emails, personalization and response measurement, recording opt-outs and enforcing frequency limits.
5. Ensuring security and preventing fraud/abuse.
6. Product analytics — after separate activation of relevant features (if activated, the purposes will be expanded in App Privacy and this Policy).
7. Compliance with legal requirements and responding to requests from authorized bodies.

4. Legal Grounds for Processing

1. Conditions for personal data processing (Art. 6 of 152-FZ).
2. User consent (Art. 9 of 152-FZ).
3. Performance of a contract (public offer/Application Terms of Use).
4. Fulfillment of legal obligations imposed on the Operator.

4.1. Email subscriptions and direct promotion of UCHU services require prior user consent. Articles 6, 9 and 15 of 152-FZ apply; advertising is additionally subject to Article 18 of 38-FZ.

4.2. Consent is obtained separately from acceptance of the terms of use, acknowledgement of this Policy, and consent for other purposes. It requires an explicit action after information about the purposes, data, processor and withdrawal method is provided. Installing the Application, registering, providing or verifying an email, inactivity and previously allowing push notifications are not consent to email subscriptions. Refusal does not restrict access to the Application.

4.3. Service emails necessary for user-requested actions, account security or contract performance are independent of marketing subscriptions. This basis is not used to insert advertising offers without separate consent.

5. Processing of Children's Data

5.1. The Application is not intended for persons under 14 years of age. Registration for users under 14 is not available.

5.2. Users aged 14–18 use the Application with the consent of a legal representative if required by law.

6. AI Content and Automated Processing

6.1. Content in the Application may be generated by artificial intelligence systems. Inaccuracies and distortions are possible; the information is for reference only and does not replace specialist consultations.

6.2. Personalization of learning may include elements of automated processing and profiling for selecting content and tasks.

7. Transfer to Third Parties and Processors

7.1. The Operator may engage processors (hosting providers, SMS gateways, etc.) to provide services on behalf of the Operator, subject to compliance with 152-FZ and the conclusion of data processing agreements.

7.2. As of the time of publication, the Application does not use third-party advertising SDKs or cross-site tracking mechanisms (ATT). If analytics/SDKs are connected in the future, the Operator will update this Policy, App Privacy, and Privacy Manifest.

7.3. Data is not sold or disclosed to third parties outside the purposes specified in Section 3, except as provided by law.

7.4. UniSender Go (UniGo) is used for email delivery and status processing. The service rights holder is Unisender SMART LLC (ООО «Юнисендер СМАРТ»), INN 9731091240, OGRN 1227700213180; address: 127015, Moscow, Bolshaya Novodmitrovskaya Street, 23, floor/premises 2/46. Service company details.

7.5. Processing on behalf of the Operator is governed by a contract under Part 3 of Article 6 of 152-FZ and covered by the separate email consent. The service receives the recipient address, personalized message content, recipient and message technical identifiers, and information necessary for delivery, statistics and opt-outs. Passwords, UCHU account sign-in OTP codes, phone numbers and bank card details are not sent to the marketing project. Sending OTP and other service emails is a separate purpose. The processing arrangement limits purposes and requires confidentiality and data protection; the Operator remains responsible to the user for processing carried out on its behalf.

8. Cross-Border Transfer

8.1. The primary database of personal data of Russian citizens is stored on the territory of the Russian Federation (242-FZ).

8.2. As part of the Application's operation (generation of educational content), some user data (anonymized requests or learning context) may be transferred to foreign countries that provide adequate protection of the rights of personal data subjects (including the PRC for interaction with DeepSeek services). The Operator will ensure compliance with 152-FZ requirements for such transfers.

8.3. Email addresses and subscription information are not sent to AI content-generation services or advertising networks to create third-party advertising audiences as part of this email subscription. Engaging a foreign email processor or changing the processing location requires prior assessment of the grounds and compliance with applicable requirements of Article 12 of 152-FZ. Subscribing is not blanket permission for any cross-border transfer.

9. Storage Periods

9.1. Data is stored for the duration of the account's validity and/or until consent is withdrawn, unless other periods are provided by law.

9.2. Certain information may be stored for periods established by the legislation of the Russian Federation (e.g., statutes of limitations, accounting, and tax periods).

9.3. Email subscription retention periods and purposes are as follows:

• The profile email is retained while necessary for the account. Opting out of marketing does not itself remove an email used for sign-in and service messages.
• Consent and preference history is retained for the account's lifetime to demonstrate the user's choices and honour refusals, not to continue sending after consent is withdrawn.
• Individual campaign and outcome records have a technical retention period of 400 days from creation; normalized provider event records have a period of 30 days from receipt.
• A minimal opt-out, complaint or undeliverable-address record may be retained separately, including after account deletion, while necessary to honour the sending prohibition and prevent unwanted contact. It contains an email hash, reason, scope and date of the restriction and is not used for new advertising sends. A hash is not treated as anonymous data.

9.4. Technical retention periods do not extend processing when its lawful basis no longer exists. After withdrawal or completion of the purpose, data without another lawful retention basis is destroyed within the periods of Article 21 of 152-FZ, generally no later than 30 days. Any minimal information retained for legal obligations or protection of rights is limited in scope and time to that purpose. On request, the Operator explains the grounds for retention and ensures corresponding action by the processor.

10. Rights of the Personal Data Subject

• to receive information about the processing of personal data;
• to demand updating, blocking, or destruction of data if the data is incomplete, outdated, inaccurate, illegally obtained, or not required for the stated purpose;
• to opt-out of personalized recommendations and withdraw consent;
• to opt out of all marketing emails or particular topics, request information about consent and data recipients, and demand that processing for direct promotion cease;
• to appeal the Operator's actions to Roskomnadzor or a court.

11. Exercise of Rights and Contacts

11.1. Inquiries and statements should be sent to e-mail: uchuacademy@gmail.com or to the address: 12 Arkhitektora Petina Street, Krasnodar, Russia. The Operator considers requests within the periods specified by 152-FZ for the relevant request type. General request-handling periods do not delay stopping advertising after an opt-out.

11.2. An account deletion function is available in the Application: Profile → "Delete Account". After confirmation, we will delete personal data, except for that which we are required to keep by law, within a reasonable timeframe.

12. Data Protection Measures

12.1. The Operator applies organizational and technical measures to protect personal data from unauthorized or accidental access, destruction, modification, blocking, copying, provision, distribution, as well as from other illegal actions.

12.2. Access to data is limited; processing is carried out on a minimum necessary basis.

13. Cookies and Similar Technologies

13.1. The Application may use strictly necessary cookies/local storage to ensure functioning (sessions, interface settings). Third-party cross-site advertising trackers are not used in the Application. Statistics for consented email subscriptions are described separately in Section 16.

13.2. If the set of technologies is expanded, the Operator will update this Policy.

14. Changes to the Policy

14.1. The Operator may update the Policy; the new version comes into force from the moment of its publication at: https://uchu.academy/policy.

14.2. Significant changes will be brought to the attention of users in the Application.

14.3. Publishing a new revision does not obtain consent on the user's behalf or automatically expand previously selected purposes or topics. New consent is requested separately when required.

15. Acknowledgement of the Policy

15.1. This Policy explains data processing and does not replace separate consent where consent is required. Using the Application or reading this Policy is not consent to email subscriptions or to processing for all of the purposes listed above.

16. UCHU Email Subscriptions

16.1. Subscribing is voluntary and remains effective until withdrawn or the account is deleted. Users select learning and progress (including lesson and return-to-learning reminders), digest and recommendations, and, where corresponding campaigns exist, news and offers. Neither new nor existing accounts are automatically subscribed. Marketing emails are limited to three in any consecutive seven-day period; necessary service messages are outside this limit.

16.2. Before confirmation, a separate consent text is provided. It covers receipt of selected informational and advertising emails, data processing for personalization and response measurement, use of UniSender Go and withdrawal. The account, selected email hash, time, source, text version and selected topics are recorded. Verifying an email with a code does not subscribe the user; another address requires a new explicit choice.

16.3. Automated processing includes collection, recording, organization, storage, updating, retrieval, use to select and send messages, transfer to the processor as specified in Section 7, blocking and deletion. Selection considers topics, courses and progress, activity and study times, previous sends and clicks. These details are not made public or used for decisions affecting user rights based solely on automated processing.

16.4. Emails use images to register opening and identified links to register clicks. When these are loaded, the email service may receive the event time, IP address and browser or email-client technical details. UCHU retains normalized statuses and event times, not raw provider notifications containing full emails and IP addresses in its email event log. Statistics support delivery quality, relevant messages, frequency limits and measurement of return to learning. Image blocking and email-client privacy features may affect their accuracy.

16.5. Users can opt out without charge or giving a reason:

• Disable the main switch in the Application's email settings, or disable a particular topic using its switch.
• Follow the unsubscribe or preference link in a marketing email and confirm the opt-out. Account sign-in is not required for that link. If an email client displays an unsubscribe button, it can also be used.
• Send a request to uchuacademy@gmail.com, specifying the address for which sending must stop.

16.6. After receiving an opt-out, processing for direct promotion and new advertising sends to that recipient stop. Opting out does not cancel the Application subscription, delete progress or stop necessary service messages. Minimal opt-out records are retained solely for the purposes in Section 9. Marketing can resume after new explicit consent; complaint and technical delivery restrictions are not bypassed automatically.

16.7. Legal grounds for separate consent and withdrawal: Article 9 of 152-FZ, Article 15 of 152-FZ and Article 18 of 38-FZ.

© UCHU. All rights reserved.