PRIVACY POLICY/(POLICY ON THE PROCESSING OF PERSONAL DATA)

1. General Provisions

1.1. This Privacy Policy (the “Policy”) sets out the procedures for processing and protecting personal data when using the website tloa.app (the “Website”), the TLOA progressive web application at web.tloa.app and the TLOA mobile application for iOS and Android (together, the “Application”; the Website and Application are collectively referred to as the “Services”).

1.2. The personal data operator is Individual Entrepreneur Oksana Vladimirovna Vezhina, OGRNIP 324470400023858, INN 470516487295 (the “Operator”).

1.3. Personal data is processed in accordance with the legislation of the Russian Federation, including Federal Law No. 152-FZ of 27 July 2006 “On Personal Data”.

1.4. This Policy is publicly available at https://tloa.app/privacy. Under the Federal Law, an operator collecting personal data online must provide unrestricted access to its personal data processing policy on the relevant webpages.

1.5. The Services are intended for individuals aged 18 or over. The Application is not intended for use by individuals under 18.

1.6. During registration, the User separately:

• accepts the User Agreement;

• gives consent to the processing of personal data.

The Privacy Policy is made available to the User for review through a separate link.

Consent to personal data processing is obtained separately from acceptance of the User Agreement. This separation is consistent with Article 9 of Federal Law No. 152-FZ as amended with effect from 1 September 2025.

1.7. The Operator records the information necessary to demonstrate that the User has given consent, including the User’s identifier, the date and time, the IP address, the type of consent and the version of the relevant document.

1.8. Consent to recurring payments is not part of registration and is obtained separately when the relevant payment arrangement is enabled.

2. Personal Data Processed

2.1. The following data may be processed during registration and account administration:

• name;

• email address;

• information necessary to authenticate the User, including a securely stored password hash;

• account identifier;

• records of consents given.

2.2. The following data may be processed when using TLOA’s features:

• the User’s intentions;

• beliefs and other texts created by the User;

• test answers and results;

• exercise results;

• information about progress through the programme;

• checklists;

• user settings;

• data associated with the Application’s virtual features;

• voice recordings created by the User through the relevant feature.

2.3. TLOA does not use voice recordings to establish or verify the User’s identity. Accordingly, the Operator does not treat them as biometric personal data within the meaning of Article 11 of Federal Law No. 152-FZ. Under that Article, information is classified as biometric personal data where the operator uses an individual’s physiological or biological characteristics specifically to establish their identity.

2.4. TLOA does not request information about race or ethnicity, political views, religious or philosophical beliefs, or intimate life. The optional questionnaire asks about subjective wellbeing, including anxiety and bodily tension when thinking about an intention. Answers and results are stored in the account to display the questionnaire results. TLOA is intended for self-development and wellbeing; the questionnaire is not intended for medical diagnosis.

2.5. Free-text fields for intentions, beliefs and other user entries are intended for ordinary user-generated text. Users should not include special categories of personal data in these fields unless the relevant feature is specifically designed for that purpose.

2.6. If TLOA introduces a feature that specifically requires the processing of a category of personal data for which separate consent is necessary, that consent will be requested immediately before the User uses the relevant feature.

2.7. The following technical information necessary for the operation and security of the Services may be processed automatically:

• IP address;

• date and time of access to the Services;

• browser and operating system information;

• technical error logs and security event logs;

• session data and technical cookies;

• push notification settings, technical device and app installation identifiers, notification registration tokens, platform information and versions of the application, operating system and embedded software components, and diagnostic information about their operation.

2.8. In connection with payments, the Operator may receive information from Prodamus that is necessary to record payments and provide access, such as:

• payment status;

• transaction identifier;

• selected plan;

• transaction amount and date;

• subscription status.

The Operator does not store full payment card details.

3. Data Not Collected by TLOA V1

3.1. TLOA V1 does not intentionally collect:

• precise geolocation;

• contacts from the device’s address book;

• third-party social media account data for registration;

• Google or Apple account data for registration;

• full payment card details;

• biometric data for identity verification.

3.2. TLOA V1 does not include an AI chat feature through which the User can submit free-form messages.

The “Help” section contains predefined questions and pre-written answers. User queries are not sent to an external artificial intelligence provider, and no AI chat history is created or stored.

3.3. Google Analytics and Yandex Metrica are not used to analyse user behaviour within the TLOA V1 Application

4. Purposes of Personal Data Processing

The Operator processes personal data for the following purposes:

4.1. Registration and account management, including account creation, authentication and account access recovery.

4.2. Providing TLOA’s features, including storing and displaying the User’s intentions, beliefs, test and exercise results, progress, checklists, settings and voice recordings.

4.3. Performing the User Agreement and providing the User with paid or free features.

4.4. Processing subscription and payment information to the extent necessary to provide paid access and interact with Prodamus.

4.5. Sending necessary service communications, including messages relating to registration, account security, subscriptions, changes to material terms and account deletion.

4.6. Sending push notifications, provided that the User has allowed them on their device or in their browser.

4.7. Handling User enquiries sent to info@tloa.app.

4.8. Ensuring the security of the Services, identifying technical errors, unauthorised access, misuse and information security incidents.

4.9. Complying with the legislation of the Russian Federation, including accounting and tax obligations and responding to lawful requests from public authorities.

4.10. Maintaining evidence of the User’s consents and other legally significant actions.

5. Legal Grounds for Processing

5.1. Personal data is processed on the following grounds:

• the User’s consent to personal data processing;

• the necessity of performing a contract with the User;

• compliance with obligations established by the legislation of the Russian Federation;

• other grounds expressly provided for by Federal Law No. 152-FZ.

5.2. The User may withdraw consent in the cases and in the manner provided for by law and through the relevant options available in the Services.

5.3. Withdrawal of consent does not require the deletion of data that the Operator is required or entitled to continue processing on another lawful basis.

6. Data Storage Location and Infrastructure

6.1. TLOA V1 uses a single Russian server infrastructure, a backend located in Russia and a primary database located in Russia.

6.2. The primary TLOA account database, user content, user files and voice recordings are hosted in infrastructure located within the Russian Federation. The processing of technical data by external notification services is described in Section 7.2.

6.3. Backups of the primary TLOA database and user files are also stored in Russian infrastructure.

6.4. TLOA V1 does not include:

• an EU hub;

• allocation of Users between Russian and EU hubs;

• country selection for determining where data is stored;

• IP-based routing to assign a data storage region;

• automatic migration of data between Russian and foreign infrastructure.

As a general rule, since 1 July 2025, recording, systematising, accumulating, storing, modifying and retrieving personal data of Russian citizens using databases outside the Russian Federation in the course of collecting such data has not been permitted.

7. Disclosure of Data to Third Parties

7.1. The Operator does not sell Users’ personal data.

7.2. Personal data may be disclosed only to the extent necessary to operate the Services or comply with legal requirements, including disclosure to:

• the Prodamus payment service, in connection with payments and subscriptions;

• providers of server and technical infrastructure located in Russia, for hosting and operating the Services;

• providers of technical email and push notification services, for message delivery. The mobile application uses Firebase Cloud Messaging (Google) and, on iOS, Apple Push Notification service (APNs). These services process technical identifiers and notification tokens; embedded Firebase components also process technical metadata and diagnostic information to operate, maintain quality and analyse the use of those components. Firebase uses Google’s global infrastructure, so this technical data may be processed outside the Russian Federation. Further information: https://firebase.google.com/support/privacy;

• public authorities, where there is a legal basis for such disclosure.

7.3. Parties engaged to process personal data on the Operator’s behalf must process it only within the scope of the relevant instructions and ensure appropriate data protection.

7.4. User messages are not sent to an external AI provider to generate responses, as TLOA V1 does not include an AI chat feature.

8. User Rights

The User has the right to:

8.1. Obtain information about the processing of their personal data.

8.2. Download data associated with their account using the “Download all data” feature.

8.3. Update the editable information in their profile.

8.4. Request the correction, blocking or destruction of personal data that is incomplete, outdated, inaccurate, unlawfully obtained or unnecessary for the stated processing purpose.

8.5. Delete their account using the “Delete account” feature.

8.6. Withdraw applicable consents to personal data processing.

8.7. Manage push notifications through the Application, browser or device settings.

8.8. Contact the Operator at info@tloa.app.

8.9. Receive a response to a request concerning their personal data within the time limits established by law. As a general rule, information requested by a data subject is provided within 10 working days. This period may be extended by no more than 5 working days, provided that a notice explaining the reasons for the extension is sent.

9. Data Deletion and Retention Periods

9.1. Personal data is retained for no longer than necessary to achieve the purposes for which it is processed, unless a different retention period is established by the legislation of the Russian Federation.

9.2. Account data and user-generated content are retained for the duration of the User’s use of TLOA, unless a different retention period is required for a particular processing purpose.

9.3. The User may delete their account through the relevant feature in the Application.

When an account is deleted, the associated user data and files, including voice recordings, are deleted, except for information that the Operator is required or entitled to retain under the legislation of the Russian Federation.

9.4. Payment information, accounting documents, evidence of consent and other data subject to a legally required or reasonably necessary retention period may be retained after account deletion, solely to the extent appropriate for the relevant purpose.

9.5. Once a processing purpose has been achieved or consent has been withdrawn, data for which there is no other lawful basis for retention is destroyed within the time limits established by law. In particular, in the relevant circumstances, the law provides for a period of up to 30 days for destroying data after the processing purpose has been achieved or consent has been withdrawn.

9.6. Inactive accounts. If the User does not log in to TLOA for 12 consecutive months:

• a warning is sent to their registered email address 30 calendar days before the scheduled deletion;

• if the User logs in before the deletion date, the current inactivity period ends and a new period is calculated from their subsequent activity;

• if the User does not return, the account and associated user data are deleted once 12 consecutive months of inactivity have elapsed, subject to the exceptions provided for by law.

9.7. After data is deleted from the primary system, its copies in backups are no longer used and are deleted or overwritten as part of the regular backup rotation cycle.

10. Personal Data Security

10.1. The Operator takes legal, organisational and technical measures to protect personal data against unlawful or accidental access, modification, destruction, blocking, copying, disclosure, dissemination and other unlawful actions. This obligation is expressly established by Article 19 of Federal Law No. 152-FZ.

10.2. In particular, the following measures are implemented or provided for in TLOA:

• transmission of data over secure HTTPS/TLS connections;

• secure password hashing;

• storage of secrets and access keys outside the source code;

• restrictions on administrative access;

• protection of the database against public access;

• backups and recovery capabilities;

• logging of significant actions involving personal data;

• tools for detecting and investigating information security incidents.

10.3. The User must keep their account credentials confidential and must not disclose them to third parties.

11. Cookies and Technical Technologies

11.1. The Website and Application may use technical cookies and similar technologies necessary for:

• authentication;

• maintaining sessions;

• ensuring security;

• retaining technical settings;

• the proper operation of the Services.

11.2. Google Analytics and Yandex Metrica are not used to analyse user behaviour within TLOA V1.

11.3. If optional analytics technologies are introduced on the marketing Website in the future, information about them will be included in the current version of this Policy. Where required by law, such technologies will be used only after obtaining the User’s necessary consent.

12. Service Emails and Push Notifications

12.1. The Operator may send the User necessary communications relating to the use of the Services, including messages concerning:

• registration and account security;

• account access recovery;

• subscription and payment status;

• changes to legal documents where notification is necessary;

• the upcoming deletion of an inactive account;

• other significant events directly related to the operation of the Services.

12.2. These communications are not advertising mailings.

12.3. Push notifications are used for notifications supported by TLOA’s features. The User may manage permission to receive them through their browser or device settings.

13. Changes to This Policy

13.1. The Operator may update this Policy if there are changes to legislation, TLOA’s functionality, the categories of personal data processed or the procedures for processing such data.

13.2. The current version of this Policy is published at https://tloa.app/privacy.

13.3. The Policy specifies the effective date of the relevant version and the date it was last updated.

13.4. If a change in processing procedures requires new consent from the User, the relevant processing will take place only after that consent has been obtained.

13.5. In the event of material changes, the Operator may notify the User through the TLOA interface and/or at their registered email address.

14. Contact Details

For enquiries concerning the processing and protection of personal data, the exercise of data subject rights, or the correction or deletion of data, the User may contact:

Individual Entrepreneur Oksana Vladimirovna Vezhina
Primary State Registration Number of the Individual Entrepreneur (OGRNIP): 324470400023858
Taxpayer Identification Number (INN): 470516487295
Registered address: Apt. 53, 1 Shvedsky Proezd, Gatchina, Gatchinsky District, Leningrad Region, 188300, Russian Federation
Email: info@tloa.app

The User may also seek protection of their rights by contacting Roskomnadzor or bringing a claim before a court in accordance with the procedures established by the legislation of the Russian Federation.