Privacy Policy

Version of 06.10.2026

1. General provisions

1.1. This Privacy Policy (the "Policy") sets out how personal data of users of the invitn web application available at invitn.ru (also invitn.com) (the "Service") is collected, stored, processed, used, transferred and protected.

1.2. Personal data operator:

Individual Entrepreneur Anastasiia Olegovna Mugina

OGRNIP: 326730000054792

INN (Taxpayer ID): 732710989912

Date of registration in the EGRIP: 18.08.2026

Address: Russian Federation, Ulyanovsk Region, Ulyanovsk

A notification of personal data processing has been filed with Roskomnadzor and entered in the register of personal data operators, registration number: 73-26-018370.

Contact email: support@invitn.com

(the "Operator", "we").

1.3. This Policy has been drawn up in accordance with Federal Law No. 152-FZ "On Personal Data" of 27.07.2006 ("152-FZ"), Federal Law No. 149-FZ "On Information, Information Technologies and Protection of Information" of 27.07.2006 and other applicable regulations of the Russian Federation.

1.4. This Policy applies to all users of the Service, including bloggers, business representatives, website visitors, people contacting support and other persons whose data may be processed when the Service is used.

1.5. Using the Service means the user has read this Policy. If the user does not agree with the Policy in the applicable part, they must stop using the Service.

1.6. Accepting the Terms of Use does not in itself constitute general consent to any processing of personal data. Personal data needed to conclude and perform the Terms of Use is processed on the basis of clause 5, part 1, Article 6 of 152-FZ without separate consent; where the data subject's consent is required for specific purposes, the Operator requests it separately.

2. Legal grounds for processing

2.1. The Operator processes personal data only where there are legal grounds provided for by the law of the Russian Federation.

2.2. Processing of personal data needed to register a user, create and maintain an account, authenticate, provide the Service's functionality, organise collaborations, exchange messages between users, process subscription payments, send mandatory service notifications, handle requests and perform the Terms of Use is carried out on the basis of clause 5, part 1, Article 6 of 152-FZ, as processing necessary to conclude and perform a contract to which the data subject is a party, or to take steps at their request before concluding a contract.

2.3. Separate consent of the data subject is requested where processing is not necessary to conclude or perform the contract, or where such consent is expressly required by law. In particular, separate consent may be requested for:

• sending informational and advertising materials;
• subscribing to push notifications that are not strictly necessary for the Service to work;
• using analytics and marketing cookies, if such technologies are introduced and applicable law requires prior consent;
• processing additional information voluntarily provided by the user for purposes that are not required to use the core functionality of the Service.

2.4. Personal data may also be processed on other grounds provided for by 152-FZ, including:

• to fulfil obligations imposed on the Operator by law;
• to process personal data made publicly available by the data subject;
• to exercise the rights and legitimate interests of the Operator or third parties, provided the data subject's rights and freedoms are not infringed;
• to establish, exercise or defend legal claims.

2.5. The data subject's consent may be given by ticking the relevant box in the interface, subscribing to a specific type of mailing, allowing push notifications, choosing cookie settings or other actions that clearly express the user's will. The user may withdraw consent at any time in the way stated when it was obtained, through the Service settings, in the browser settings or by contacting the Operator. Withdrawal of consent does not affect the lawfulness of processing carried out before it.

2.6. The full texts of the consents given by users are available at:

• Consent to the processing of personal data;
• Consent to receive informational and advertising materials.

3. Data we collect

3.1. Data provided by the user

On registration, the following may be processed: first and last name; email address; password, which is stored only in hashed form without the Operator having access to its plain value.

When filling in a Blogger profile, the following may be processed: city of residence; biography; content topics and preferred categories; experience; profile photo (avatar).

When filling in a Business profile, the following may be processed: venue name and description; category and subcategory of activity; city; logo, cover image, gallery photos; social media and website links; contact details, including the contact person's name, phone number and Telegram username.

When adding locations, the following may be processed: name and address; phone number; opening hours; photos.

When a Blogger links social accounts, the following may be processed: username and link to the profile on a social network or other online platform; number of followers; engagement metrics; the account ownership confirmation code temporarily placed by the user in the social media profile.

Photos uploaded by the user (avatar, logo, portfolio, venue photos) are used for display in the Service interface and in the Service's marketing materials in accordance with clause 14.3 of the Terms of Use. These photos are not subject to biometric processing within the meaning of Article 11 of 152-FZ.

3.2. Data collected automatically

The Operator may process the date and time of the last login; the date of registration and email confirmation; language and interface preferences; Service usage statistics, including information on collaborations, ratings, reviews and offer views; subscription payment history; technical information on push notification subscriptions; IP address, browser and device data, session information, event logs, cookies and other similar technical data needed for the Service to work correctly and securely.

3.3. Data from public sources

To build a Blogger's profile statistics, the Operator may obtain data that the user has made publicly available in public social media profiles, including the number of followers and accounts followed, number of posts, public bio, avatar and aggregated engagement metrics. Such data is collected only from publicly accessible profiles. These statistics are shown in the Blogger's profile and are available to Businesses when choosing collaboration participants.

The Operator does not control how personal data is processed on external platforms, including social networks and other online platforms, and is not responsible for the actions of the owners of those platforms beyond the processing carried out by the Operator itself. Users are advised to read the privacy policies and terms of use of such resources themselves.

The user may limit the collection of data from social networks by changing the privacy settings of the relevant platform or by contacting the Operator at support@invitn.com.

3.4. Third-party data

When using the feature to invite members to a Business Team, the user may enter the email address of the person being invited. The user sending the invitation warrants that they have a lawful basis for transferring that email address to the Operator and have notified the invitee of the transfer where required by law. The Operator uses the address only to send the invitation and deletes it if the invitation is declined or expires.

4. Purposes of processing

4.1. The Operator processes personal data for the following purposes:

• registering and authenticating users;
• operating the Service, including creating and displaying profiles, offers, collaborations and messages;
• providing Businesses with information about Bloggers to choose collaboration participants;
• providing Bloggers with information about venues and offers to choose suitable collaborations;
• processing payments and managing subscriptions;
• sending service notifications, push notifications and emails;
• moderating content, handling requests and helping to resolve disagreements between users, interacting with public authorities, and preparing, filing and defending claims in court, pre-trial and out-of-court proceedings;
• building ratings and displaying the results of interactions on the platform;
• improving the quality of the Service based on aggregated and, where applicable, anonymised statistics;
• promoting the Service, including showing Platform participants and their Offers on the Service's public pages, in the Administration's official social media accounts and in presentation and other marketing materials;
• automated and/or selective review of chat messages to ensure the security of the Service and Users, prevent violations and circumvention of plan limits, and handle complaints;
• fulfilling obligations provided for by law.

4.2. Where a specific purpose of processing requires the data subject's consent, such processing is carried out only after that consent has been obtained.

5. Data storage and protection

5.1. User passwords are stored only in hashed form using modern cryptographic algorithms. The Operator has no technical means of recovering a user's password.

5.2. Authentication may use cryptographically signed temporary tokens and other technical means of session protection.

5.3. The Operator takes the necessary legal, organisational and technical measures to protect personal data from unlawful or accidental access, destruction, modification, blocking, copying, distribution, provision and other unlawful actions, in accordance with 152-FZ and related regulations.

5.4. Database servers, applications and object file storage are located in the Russian Federation.

5.5. Files, including images and other materials, may be stored in cloud infrastructure in the Russian Federation using information security tools and encryption in transit.

6. Retention periods

6.1. Personal data is kept no longer than required by the purposes of processing, the terms of the contract, the term of the consent, legal requirements or the need to protect the Operator's rights and legitimate interests.

6.2. In particular, the Operator may apply the following indicative retention periods:

• account data — for the life of the account and 30 calendar days after a deletion request is received;
• payment data — 5 years from the date of the transaction, as required by tax and accounting law;
• chat messages — for the life of the accounts of the participants, unless longer storage is needed to resolve a dispute or comply with the law;
• collaboration data and reviews — for the life of the account and 1 year after its deletion to resolve possible disputes;
• social media data — until the user removes the link, changes the visibility settings, deletes the account or the processing is no longer needed;
• authentication and security logs — 1 year, unless a different period is required to investigate incidents or comply with the law.

6.3. When retention periods expire or the purposes of processing no longer need to be achieved, personal data is destroyed or anonymised unless otherwise provided by the law of the Russian Federation.

7. Transfer of data to third parties

7.1. The Operator transfers or gives access to personal data in the following cases:

• to other users of the Service — to the extent needed for the platform to work and for Bloggers and Businesses to interact. Public profile information, including name, avatar, city, description, social accounts, activity metrics, rating and other data the user has placed in the public part of the profile, may be visible to other users. A Business's contact details, including phone and Telegram, are disclosed only within the Service's logic and, as a rule, within active collaborations or other targeted interaction;
• to the payment system operator — to the extent needed to process subscription payments. The Operator does not store bank card data unless expressly stated otherwise in the Service interface and the documents of the relevant payment partner;
• to infrastructure providers and other processors — to the extent needed to host applications and databases, store files, deliver content, send service messages and keep the Service running. Contracts or other binding documents providing for confidentiality and personal data protection are concluded with such parties;
• to public authorities and other authorised persons — in the cases and manner provided for by the law of the Russian Federation.

7.2. The Operator does not sell personal data and does not transfer it to third parties for their own advertising or marketing purposes without the data subject's separate consent.

7.3. When a user goes to external platforms, including social networks, messengers, partner websites and other third-party resources, personal data may be processed by those parties under their own rules. The Operator does not control such processing beyond its own activities.

8. Data localisation

8.1. Personal data of citizens of the Russian Federation is collected, recorded, systematised, accumulated, stored, updated and retrieved using databases located in the Russian Federation, in accordance with part 5, Article 18 of 152-FZ.

8.2. The Service's main servers, including the application server, databases, object storage and other key infrastructure components, are located in the Russian Federation.

8.3. Personal data is not transferred across borders, except where such a transfer becomes necessary to use a specific feature of the Service, is permitted by the law of the Russian Federation and is carried out on an appropriate legal basis, including the data subject's consent where required.

9. Data deletion

9.1. The user may request deletion of their account and personal data by writing to support@invitn.com.

9.2. On receiving a deletion request, the Operator:

• stops processing personal data for the purposes of operating the Service to the extent such processing is no longer needed;
• deactivates the account so that the profile is no longer shown in the Service, unless otherwise required to protect the rights and legitimate interests of the Operator or other users;
• deletes or anonymises personal data within 30 calendar days, unless a different period is set by law or needed to fulfil obligations and resolve disputes.

9.3. Data that must be kept by law, including payment and other accounting information, is kept for the period required by law to the extent needed to meet mandatory requirements.

9.4. When consent to personal data processing is withdrawn, the Operator stops processing based on that consent and ensures deletion or cessation of processing within the time limits set by law, except where processing is permitted on another legal basis.

10. User rights

10.1. As a personal data subject, the user has the right to:

• receive information about the processing of their personal data, including the list of data processed, purposes, periods, legal grounds and information on the persons to whom the data is transferred;
• demand that personal data be updated, blocked or destroyed if it is incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose of processing;
• withdraw consent to personal data processing where processing is based on consent;
• refuse to receive advertising and informational-advertising materials;
• appeal against the Operator's actions or inaction to Roskomnadzor or in court;
• exercise other rights provided for by the law of the Russian Federation.

10.2. To exercise their rights, the user may send a request to support@invitn.com stating their full name and the email address linked to the account. The Operator may request additional information to confirm the identity and authority of the requester. A response is sent within the time limits set by the law of the Russian Federation.

11. Cookies and local storage

11.1. The Service uses cookies, localStorage and other similar technologies to make the website work and to save user settings.

11.2. The Service may use the following categories of cookies and similar technologies:

• technical or strictly necessary — to maintain the authentication session, store access tokens, ensure security, route requests and make the interface work correctly;
• functional — to save user preferences, including language, theme, the state of certain interface elements and other selected settings;
• analytics — to obtain aggregated information on how the Service works, its performance and the use of specific features;
• marketing — to assess the effectiveness of advertising campaigns and personalise marketing communications.

11.3. As of the date this version was approved, the Operator mainly uses technical and functional cookies. Analytics and marketing cookies are used only once they are actually introduced and, where required by applicable law, after the user's prior consent is obtained through a banner, cookie centre or other interface.

11.4. The user may change cookie settings at any time through the cookie management tool, if available on the website, and through the browser or device settings. Disabling technical cookies and localStorage may make some features of the Service unavailable.

12. Push notifications

12.1. The Service may use Web Push technology to send notifications.

12.2. Subscribing to push notifications is voluntary and is activated only by an explicit user action in the browser or other software interface.

12.3. The user may turn off push notifications in the browser or device settings at any time.

12.4. Push notifications may use technical subscription identifiers and other data needed to deliver notifications. Such data is processed to the extent needed for the technology to work.

13. Email communications

13.1. The Operator may send the following types of emails:

• service messages from addresses used for technical and mandatory notifications, including verification codes, access recovery, security messages, notifications about payments, subscriptions, account changes and other events directly related to performing the contract and operating the Service;
• informational messages about news and updates of the Service;
• support team replies to user requests.

13.2. Service messages are not advertising and may be sent without separate consent if they are needed to perform the contract, keep the account secure, provide the Service's functionality or comply with the law.

13.3. Informational and advertising materials, including news, offers, promotions and other marketing messages, are sent only with the user's prior consent, unless otherwise expressly permitted by the law of the Russian Federation.

13.4. The user may opt out of informational and advertising messages at any time by using the unsubscribe link in the relevant message, changing the settings in the Service or writing to support@invitn.com. After receiving the opt-out, the Operator stops sending such messages within a reasonable time.

14. Incident notification

14.1. If unlawful or accidental transfer, provision, distribution, loss or another incident involving personal data is established, the Operator acts in accordance with the law of the Russian Federation, including notifying Roskomnadzor in the cases set by law and taking measures to eliminate the consequences of the incident.

14.2. If an incident may pose significant risks to users' rights and legitimate interests, the Operator may additionally notify the affected users by email, through the Service interface or by other available means.

15. Changes to the Policy

15.1. The Operator may amend this Policy.

15.2. The current version of the Policy is published at invitn.ru/legal/privacy with the date of the last update.

15.3. The Operator may notify users by email, through a notice in the Service or by other available means before they take effect of material changes affecting the scope of data processed, the purposes of processing, the categories of recipients, the use of cookies or previously given consents.

15.4. Continued use of the Service after the changes take effect means acceptance of the new version of the Policy to the extent processing is carried out on a contractual or other lawful basis. If separate user consent is required for further processing in the changed scope, such processing is carried out only after that consent is obtained.

16. Contact information

16.1. For questions about personal data processing, the user may contact the Operator at support@invitn.com.

16.2. Operator details:

Individual Entrepreneur Anastasiia Olegovna Mugina

OGRNIP: 326730000054792

INN (Taxpayer ID): 732710989912

Date of registration in the EGRIP: 18.08.2026

Address: Russian Federation, Ulyanovsk Region, Ulyanovsk

16.3. The authority responsible for protecting the rights of personal data subjects is the Federal Service for Supervision of Communications, Information Technology and Mass Media (Roskomnadzor), rkn.gov.ru.