Privacy policy
1. Who is responsible for your data
The operator of Konspekto (konspek.to) is Kulikov Aleksandr Vladislavovich, self-employed and a payer of Russian tax on professional income, Taxpayer ID (INN) 662608013611, Russia. For questions about the service, personal data, refunds or complaints, contact support@konspek.to.
This policy covers the free closed beta by invitation, including service to users in Spain. The interface language does not by itself determine a user's citizenship or location. Credit purchases and new monetary top-ups are unavailable in this beta. Obligations relating to existing transactions remain in force.
2. Data used and purposes
For accounts and sign-in, we use email addresses, language settings, information about requests for and use of sign-in links, IP addresses and event times. To record expressed consent, we retain its type, the text version, time and IP address. Technical identifiers and request information are used for security and abuse prevention; a hash linked to an account is not guaranteed to be anonymous data.
Book processing uses the submitted PDF, file name, size and checksum, extracted text and structure, detected language, title and author, intermediate processing data, previews, full summaries and Markdown. Order fulfilment uses order status, the chosen result language, technical progress, processing-cost information and credit-accounting operations. Ratings involve the score, selected reason and optional review text. Enquiries involve contact details, message contents and information needed to handle the enquiry.
The purposes are to provide requested access and results, maintain order and credit records, send service emails, protect the service and users, handle enquiries and meet applicable legal obligations. These purposes do not include consent to advertising emails. Do not submit other people's personal data in a book or message unless you have a basis for that disclosure.
For users covered by the GDPR, processing necessary to provide the requested service is based on performance of a contract or steps taken at the user's request before entering into one (Article 6(1)(b)); compliance with a specific legal obligation is based on Article 6(1)(c); service protection and handling claims are based on legitimate interests, subject to users' rights (Article 6(1)(f)). Consent is used for the separate purposes for which it is required and may be withdrawn. A general checkbox does not turn necessary processing into permission to process data for every purpose. Where Russian law applies, the grounds under Article 6 of Federal Law No. 152-FZ are taken into account; separate consent is presented separately from other documents requiring confirmation.
3. AI and recipients
Personal previews and summaries are generated using AI. Users' books and personal summaries are not intended for public publication; we do not use them to train models. A public example is selected separately and is not publication of a user's upload.
The service and data are hosted with AdminVPS in Germany. Service emails are sent through Resend (USA). Cloudflare Turnstile protection processes technical information about requests and browsers; Cloudflare infrastructure is located in the USA and other countries in its global network. Sentry (USA) is used for technical diagnostics; user texts and secrets must not be included in diagnostic messages.
To generate personal previews and summaries, book text is sent to OpenAI (USA) as a processor through the operator's infrastructure. Account details are not included in these requests; however, the book text itself may contain personal data. We do not claim Zero Data Retention, use of OpenRouter or data_collection:deny guarantees for this route. Submit only material that you are entitled to provide for this processing.
The operator is located in Russia and may have administrative access from Russia to data hosted in Germany. Processing includes transfers to the USA and access from Russia. This policy does not claim an adequacy decision for all these destinations, standard contractual clauses concluded with every recipient or Zero Data Retention. User consent alone does not establish a contract with a recipient or replace a necessary legal basis for an international transfer.
4. Cookies and technical information
The app uses necessary session and cross-site request forgery protection (CSRF) cookies for sign-in and secure account use. The sign-in link is valid for 15 minutes. The base session lifetime is 30 days; signing out ends the corresponding session. Cookie expiry is not the deadline for deleting all server-side data. Restricting necessary cookies in your browser may prevent account functionality.
Web statistics use self-hosted Umami on the operator's server in Germany without analytics cookies. Analytics information is used to assess traffic and service performance. This does not mean that all technical requests, raw events and logs are completely anonymous. Google Analytics is not part of this setup.
5. Retention and deletion
Retention depends on the data type and purpose, not on one common period for the entire book and account. Deleting the source PDF does not delete all extracted text, intermediate data, summaries or backups.
The source PDF is subject to deletion at the earlier of 7 days after upload and 24 hours after the first successful full summary. Active processing may delay technical deletion. Our obligation to delete a rejected PDF immediately remains in force.
We retain extracted text and intermediate summaries for no longer than 30 days after the last related order is ready; a preview without a full order for 30 days; and a completed summary while the corresponding order is retained, with deletion available on request. An account with no sign-in for 3 years is subject to deletion with 30 days' advance notice. Records of previous financial transactions are retained for 5 years, usage records and analytics events for 13 months, complaints for 3 years and backups for 30 days. Existing download artefacts remain subject to the previously promised 30-day period and right to recreation. This does not make PDF export available in the current beta. Technical logs remain subject to the obligation of short retention for a few days, for diagnostics and security.
Send account-deletion requests to support@konspek.to. Include the account email and the nature of the request; do not send a password, sign-in link or the entire book. Our previously published deadlines remain binding: account data deletion within 24 hours and deletion from backups within 30 days. Data needed to meet legal obligations or protect rights in a dispute may be retained on the corresponding legal basis and only to the necessary extent. Withdrawal of consent is accepted at the same email address; the 30-day deletion deadline, subject to lawful exceptions, remains in force. Withdrawal does not affect the lawfulness of earlier processing. Cookie expiry does not automatically delete all server-side information.
Markdown results follow the result-retention rules; a download link is not a separate promise of PDF export or availability of export-file recreation as a current beta feature. Rights already arising in relation to existing results remain in force.
6. Rights and enquiries
Within the limits of applicable law, you may request access and a copy of data, rectification, erasure, restriction, portability and object to processing. Where necessary, we may request proportionate identity verification without requiring excessive information. Withdrawing consent does not waive other rights.
GDPR requests are answered without undue delay, generally within one month; if a lawful extension is needed, we explain the reason and new deadline. Any shorter deadline required by applicable law takes priority. You may complain to the competent supervisory authority, including the Agencia Española de Protección de Datos (AEPD) in Spain, and bring proceedings in court. Contacting us does not remove this right.
We take protective measures appropriate to the data and risks; absolute security is not promised. Applicable incident-notification duties are fulfilled. This does not constitute a claim to a specific technical measure, certification or absence of incidents.
7. Changes
The revision date and available policy version are stated upon publication. Changes do not cancel rights and obligations that have already arisen. Material changes are disclosed before they apply to the relevant processing; where new consent is required, it is requested separately.
Revision date: