# Personal data processing policy

> Which personal data Buff Development processes, why, where it is stored and how to delete it.

Document · edition of 4 October 2026

# Personal data processing policy

This is an English translation for convenience. The [Russian version](https://buff.systems/legal/privacy) is the legally binding one.

This policy has been drawn up in accordance with part 2 of Article 18.1 of Federal Law No. 152-FZ of 27.07.2006 “On Personal Data” and sets out how the operator processes the personal data of users of the Buff Development website and web application.

**The operator** is the person whose details are given on the [Contacts](https://buff.systems/en/contact) page. The email address for personal data requests is there too. The operator and the Contractor under the User Agreement are one and the same person.

The terms “service”, “client”, “user”, “organisation”, “organisation owner”, “session”, “plan”, “dedicated capacity”, “separate environment”, “model provider”, “connector”, “integration”, “connection”, “client system” and other terms are used in the meanings in which they are used in the [User Agreement](https://buff.systems/en/legal/terms). The policy is part of the agreement.

## [1. Whose data we process and why](https://buff.systems/en/legal/privacy#1-whose-data-we-process-and-why)

### [1.1. Web application user](https://buff.systems/en/legal/privacy#11-web-application-user)

- **Data:** - email address, login, role in the organisation and organisation identifier;
- password — after registration is confirmed, stored only as an irreversible hash (a transformation from which the password cannot be recovered); before registration is confirmed — only in encrypted form and for no more than one hour from the last sending of the confirmation code, after which the record is deleted automatically;
- information about actions in the service: who created a task, question or research and when, who approved or returned a change; the history of charges;
- the organisation’s audit log: the time, login, session identifier, IP address and browser details of the connection, the action performed, its object and result (including a refusal and its reason) — for every action of a member in the organisation, including sign-in and sign-in attempts. The log is available to the organisation owner and to members to whom the owner has granted the right to view it; records are not changed or deleted individually and are kept for as long as the organisation exists, and after its deletion — for the periods in clause 5.3;
- when signing in through the organisation’s single sign-on (SSO): the user identifier assigned by the organisation’s identity provider, and the email address and name passed by the provider in the sign-in confirmation; in this case the operator does not receive the user’s password. The link between the identifier and the account is kept while the organisation uses single sign-on and is deleted when it is turned off;
- notification and interface settings;
- information about the operator’s actions with the account (blocking, password reset) — for as long as the account exists;
- push notification subscription data (the address of the browser’s push service, encryption keys, browser details and the list of the user’s organisations at the time of subscribing) — only if the user has turned notifications on;
- technical logs of the server and the service — under clause 1.6.
- **Why:** registration and sign-in with confirmation by code, performance of the contract, support, delivery of notifications the user has turned on, security and prevention of abuse.
- **Legal basis:** conclusion and performance of a contract to which the user is a party, including the client’s contract that the user joined as an invitee (clause 3.5 of the agreement; Article 6(1)(5) of Federal Law No. 152-FZ); for security and prevention of abuse — also the operator’s legitimate interests (Article 6(1)(7) of Federal Law No. 152-FZ).
- **Retention:** - for as long as the account exists; at the user’s request the account is deleted within the periods in clause 5.3;
- on termination of the contract without such a request — within 90 days of the date the contract was terminated in respect of the last organisation the user was a member of, and from backups — within the following 90 days;
- data whose retention is required by law — for the period established by law.

### [1.2. Person invited to an organisation](https://buff.systems/en/legal/privacy#12-person-invited-to-an-organisation)

- **Data:** the email address given by the organisation owner, and the login derived from that address when the account is created.
- **Why:** sending the invitation and creating the member’s account. The invitation email tells the invitee the operator’s name, the purpose and legal basis of the processing, the source of the address (the owner of the inviting organisation), their rights under section 5 and a link to this policy (part 3 of Article 18 of Federal Law No. 152-FZ). If the invitation is not accepted, the address is not used for anything other than entries in technical logs (clause 1.6).
- **Legal basis:** the legitimate interests of the operator and of the client who invited the user (Article 6(1)(7) of Federal Law No. 152-FZ); after the invitation is accepted — under clause 1.1.
- **Retention:** until the invitation is accepted; if it is not accepted within 30 days, the account and the address are deleted, and entries about them in technical logs are kept under clause 1.6. After the invitation is accepted — under clause 1.1.

### [1.3. Representative of a client that is a legal entity or sole proprietor](https://buff.systems/en/legal/privacy#13-representative-of-a-client-that-is-a-legal-entity-or-sole-proprietor)

- **Data:** surname, first name, patronymic, position, email address, content of correspondence.
- **Why:** providing company details, closing documents, applications and claims under the contract.
- **Legal basis:** the operator’s legitimate interests related to performance of the contract with the client (Article 6(1)(7) of Federal Law No. 152-FZ); keeping primary documents is an obligation established by law (Article 6(1)(2) of Federal Law No. 152-FZ, Article 29 of Federal Law No. 402-FZ).
- **Retention:** the term of the contract and 5 years after the end of the year in which it was terminated (Article 29 of Federal Law No. 402-FZ).

### [1.4. Sender of a form on the website](https://buff.systems/en/legal/privacy#14-sender-of-a-form-on-the-website)

- **Data:** name, email address and message text (the feedback form); email address, company, team size and comment (a plan request; when sent from the web application — also the login and organisation).
- **Why:** replying to the request, discussing terms.
- **Legal basis:** for a form on the website — consent expressed by submitting the form (a notice to that effect is placed under the form); for a request sent from the web application — conclusion and performance of the contract (Article 6(1)(5) of Federal Law No. 152-FZ).
- **Retention:** 3 years from the date of the request.

### [1.5. Payer](https://buff.systems/en/legal/privacy#15-payer)

- **Data:** amount and date of the payment; the payer’s bank details (for a bank transfer) or the payment information passed on by the payment provider (without the full card number); email address for the cash receipt.
- **Why:** crediting the balance, the cash receipt, refunds.
- **Legal basis:** performance of the contract (Article 6(1)(5) of Federal Law No. 152-FZ); obligations established by Federal Law No. 54-FZ and Federal Law No. 402-FZ (Article 6(1)(2) of Federal Law No. 152-FZ).
- **Retention:** 5 years after the end of the year in which the document was drawn up (Article 29 of Federal Law No. 402-FZ).

The operator does not receive or store full bank card details: card payments go through a payment provider, which passes only the payment confirmation to the operator.

### [1.6. Visitor of the website and web application](https://buff.systems/en/legal/privacy#16-visitor-of-the-website-and-web-application)

- **Data:** technical logs of the server and the service: - IP address, time of the request, browser details;
- on registration, sign-in and session refresh, password recovery and change, invitation, organisation creation, changes to its membership and to members’ access to repositories, saving and deleting a repository token and binding a connector — also the login;
- when any email is sent to the user (a confirmation code for registration, sign-in or password change, password recovery, a notice of a password change or of an attempt to register with this address, an invitation) — also the recipient’s email address.
- **Why:** operation and security of the website and web application, prevention of abuse.
- **Legal basis:** the operator’s legitimate interests (Article 6(1)(7) of Federal Law No. 152-FZ).
- **Retention:** no more than 90 days.

### [1.7. Author of a request to the bot in a client system](https://buff.systems/en/legal/privacy#17-author-of-a-request-to-the-bot-in-a-client-system)

- **Data:** the display name (or login) of the request’s author in the client system, the text of their request, the title, address and identifier of the ticket (task, page), and for a request in a pull request discussion — the repository and branch name. Other information about the author — email address, position, the content of their profile — is not passed to the operator.
- **Why:** doing the work the author asked for and replying in the same discussion; recording in the task draft whose request it was created from, so that the work can be matched to the request.
- **Legal basis:** the legitimate interests of the operator and of the client in whose system the connection works (Article 6(1)(7) of Federal Law No. 152-FZ); the client ensures a lawful basis for such processing and the notification of these persons (clauses 8.6, 8.10, 10.7 of the agreement).
- **Retention:** the request and the materials created from it are kept as the organisation’s working materials and are deleted together with them (clauses 8.7 and 12.5 of the agreement); entries in technical logs — under clause 1.6.

### [1.8. Buff Code user](https://buff.systems/en/legal/privacy#18-buff-code-user)

- **Data:** login, device name (as the operating system of the user’s computer calls it), device identifier and its public key, time of sign-in and of the last request, the selected organisation and project; for each request to the model — the time, the model, the amount of model work and the amount charged. The content of requests and responses is processed as client materials under clause 2.5.
- **Why:** signing in to Buff Code with confirmation in the web application, performance of the contract, accounting for the organisation’s spend, showing development sessions to the user and the organisation owner, the audit log.
- **Legal basis:** performance of a contract to which the user is a party, including the client’s contract that they joined (Article 6(1)(5) of Federal Law No. 152-FZ).
- **Retention:** device information — until the device is revoked; information about requests to the model — as part of development sessions, as the organisation’s working materials (clauses 8.7 and 8.11 of the agreement).

Other content of client systems is not passed to the operator in advance and is not indexed: pages and tickets are read by the connector in the client’s network on request, to the extent of the specific work, and what has been read is processed as client materials under section 2 (clause 8.10 of the agreement). Credentials for client systems are not passed to the operator.

The operator does not take decisions that have legal consequences for the data subject solely on the basis of automated processing of personal data. The operator does not process special categories of personal data or biometric personal data; the service is not intended for persons under 18 (clause 3.2 of the agreement).

## [2. The client’s code and materials](https://buff.systems/en/legal/privacy#2-the-clients-code-and-materials)

2.1. The operator processes repository code, texts of tasks, questions, research and analyses, and attachments to them as the client’s code and working materials under the contract, not as personal data.

The exception is the names and work email addresses of change authors in the repository history: the operator processes them as part of the client’s code to perform the contract with the client on the basis of Article 6(1)(7) of Federal Law No. 152-FZ, for the purposes and to the extent of clause 7.2 of the agreement (clause 8.9 of the agreement).

The client determines what the materials contain; under the agreement, the client undertakes not to include other personal data in them and ensures a lawful basis for processing the authors’ data, including transfer outside the Russian Federation on the chosen plan, and their notification (clause 8.6 of the agreement).

2.2. On plans where work is done through a model provider, the content of repository files (including the change history), texts of tasks, questions, research and analyses, attachments and other materials involved in the work are passed to the model provider and through it to third-party compute suppliers outside the Russian Federation. The model provider and compute suppliers may temporarily store the requests and responses passed to them under their own terms; the operator provides the current terms at the organisation owner’s request (clause 8.3 of the agreement).

On dedicated capacity outside the Russian Federation, the same materials are passed for the duration of the work to a machine rented by the operator from a hosting provider outside the Russian Federation; they are not passed to the model provider and are not kept on the machine after it stops. On dedicated capacity in the Russian jurisdiction and in a separate environment, the materials listed in the first paragraph do not leave the Russian Federation and are not passed to the model provider.

In both cases, transfer outside the Russian Federation is carried out by the operator in compliance with Article 12 of Federal Law No. 152-FZ. The operator does not use client data to train models and selects providers and models that do not use the data passed to them for training (clause 8.3 of the agreement). More on the [Security](https://buff.systems/en/security) page.

2.3. Users’ personal data from section 1 (email addresses, logins, information about who performed an action and when, the history of charges) is not passed to the model provider or compute suppliers; texts of tasks, questions and other client materials are passed under clause 2.2, including information the user has entered in those texts themselves. Together with the materials, the organisation identifier and the name of the development project are passed — they are part of the paths to the code and the mirror addresses. If no organisation identifier is given at registration, it is derived from the login (for example, “login-org”), and then on plans under clause 2.2 the login becomes known to the model provider (on dedicated capacity outside the Russian Federation — to the machine’s hosting provider) as part of the identifier. The identifier is never derived from the email address; to avoid this, give your own organisation identifier at registration.

2.4. The operator processes requests to the bot from connected client systems and the materials read for them (texts of tickets and knowledge base pages) as client materials under the rules of this section: they are involved in the work and, on plans where work is done through a model provider, are passed under clause 2.2. The display name of the request’s author is included in the text of the task draft created from the request and is passed as part of it; in other cases — questions and research — the work is recorded against the connection, not against the author of the request.

2.5. The operator processes development sessions — Buff Code’s requests to the model and the responses to them, which the operator keeps in full (clause 8.11 of the agreement) — as client materials under the rules of this section: on plans where work is done through a model provider, the requests are passed under clause 2.2, including information the user entered in the text themselves or passed to the model in files and tool results. A session is visible to the user who ran it and to the organisation owner; viewing someone else’s session and exporting it are recorded in the organisation’s audit log.

## [3. Where and how data is stored](https://buff.systems/en/legal/privacy#3-where-and-how-data-is-stored)

3.1. The operator processes personal data by a mixed method: in the web application and on servers — using automation tools, and correspondence and documents under clauses 1.3–1.5 — also without them. Actions with data: collection, recording, systematisation, accumulation, storage, clarification (updating, changing), retrieval, use, transfer (provision, access), blocking, deletion, destruction.

3.2. Users’ personal data and repository mirrors are stored on servers used by the operator and located in the Russian Federation. Collection, recording, systematisation, accumulation, storage, clarification and retrieval of the personal data of citizens of the Russian Federation are carried out using databases located in the territory of the Russian Federation (part 5 of Article 18 of Federal Law No. 152-FZ).

3.3. The operator has appointed a person responsible for organising the processing of personal data (Article 22.1 of Federal Law No. 152-FZ); requests to that person are sent to the address on the [Contacts](https://buff.systems/en/contact) page. The operator takes measures to protect personal data (Article 19 of Federal Law No. 152-FZ):

- connections to the website and web application are protected by encryption (TLS);
- passwords are stored as an irreversible hash; sign-in is confirmed by a code sent by email;
- repository access tokens are stored encrypted (AES-256-GCM), with the encryption key kept separately from the database; when connecting through a connector, the token is not passed to the operator at all;
- staff are not given access to client materials without a request from the client, except in the cases listed in clause 8.5 of the agreement: technical operations on storage without viewing the content; investigating an incident and checking a breach of the terms — with notice to the organisation owner; legal requirements. On request, access is granted narrowly and revoked once the request is closed;
- backups are stored in the Russian Federation.

3.4. The operator notifies Roskomnadzor of an incident that led to unlawful or accidental transfer (provision, dissemination, access) of personal data and a violation of data subjects’ rights within the periods established by part 3.1 of Article 21 of Federal Law No. 152-FZ (of the fact — within 24 hours, of the results of the investigation — within 72 hours), and notifies the organisation owner and, if the incident affected the data of persons outside organisations, those persons themselves — no later than 72 hours from the moment it learned of the incident, describing the data affected and the measures taken.

3.5. The operator does not sell personal data and does not pass it to third parties for their own purposes. Emails are sent from the operator’s own mail server; third-party email services are not used. Data may be passed — on the operator’s instruction, or to independent operators processing it under the law:

- to the hosting provider of the servers in the Russian Federation — on the operator’s instruction (part 3 of Article 6 of Federal Law No. 152-FZ) for hosting the servers, with an obligation to maintain confidentiality and protective measures;
- depending on the plan (section 2) — to the model provider, compute suppliers and a hosting provider outside the Russian Federation — only the names and addresses of change authors as part of the client’s code, the display names of request authors as part of task drafts (clauses 1.7, 2.4), and the organisation identifier (including the login, if the identifier is derived from it — clause 2.3) and the project name — in the manner of section 2;
- to the push service of the user’s browser — to deliver notifications the user has turned on; the content of notifications is encrypted and not accessible to the push service, and no personal data is passed to it;
- to the payment provider and the bank — to accept payments and make refunds;
- to the fiscal data operator — for cash receipts;
- to an electronic document exchange operator — at the client’s choice;
- to government authorities — in cases provided for by law.

## [4. Cookies and the browser’s local storage](https://buff.systems/en/legal/privacy#4-cookies-and-the-browsers-local-storage)

4.1. The website and web application do not use cookies and do not pass information about visits to third-party analytics or advertising services.

The operator runs its own website visit counter. It is hosted on the operator’s servers, sets no cookies and does not store the IP address: visitors are told apart by a value computed from the address, the browser and the domain using an irreversible transformation whose key changes daily — it can be used neither to identify a visitor nor to link their visits on different days. The page address, referral source, device type, browser, language and country are collected.

4.2. The web application stores in the browser’s local storage (localStorage) the user’s session information (the `buff.session` key — sign-in tokens, login and list of organisations), the chosen theme and display settings; for the duration of sign-in, the code verification identifier and the email address are kept in session storage (sessionStorage) and erased when the tab is closed. Without this information the application cannot work — you would have to sign in again.

The website stores only the chosen theme and a mark that the notice under clause 4.3 has been read.

This data does not leave the user’s browser, except for the session token, which is passed to the service when connecting and running commands. Session information is deleted on signing out of the account, the rest — when the browser data is cleared.

4.3. A notice at the bottom of the website’s pages tells about this use of local storage. Consent is not requested: this information is not passed to the operator (except for the session token, without which the application cannot work) and is not used for tracking.

4.4. The operator keeps statistics on the use of the service: which actions were performed in the application, which screens were opened, how long a response took, whether there was a refusal, and the fact that emails and notifications were sent. For registered users such a record contains the login and the organisation — they are needed to answer support requests and to understand which features are used. The content of tasks, questions, code and correspondence does not get into these statistics, and the IP address and browser details are not stored in them.

## [5. Rights of the personal data subject](https://buff.systems/en/legal/privacy#5-rights-of-the-personal-data-subject)

5.1. Any person whose personal data the operator processes (a personal data subject) has the right to receive information about the processing of their personal data, to demand that it be clarified, blocked or destroyed, to withdraw consent where processing is based on consent (Articles 14, 20, 21 of Federal Law No. 152-FZ), and to appeal against the operator’s actions or inaction to Roskomnadzor or in court (Article 17 of Federal Law No. 152-FZ).

5.2. A request is sent to the email address given on the [Contacts](https://buff.systems/en/contact) page:

- a user — from the email address of their account;
- a representative of a client that is a legal entity or sole proprietor — from the address provided under clause 3.3 of the agreement;
- a form sender and a payer — from the address given in the form or for the receipt;
- in other cases (including change authors in the repository history), and also if it is impossible to send the request from that address — by any means that allows the personal data subject to be identified (part 3 of Article 14 of Federal Law No. 152-FZ); the operator may ask for proof of identity.

The operator replies within 10 business days of the date the request is received; the period may be extended by no more than 5 business days with notice of the reasons.

5.3. A user can change their password themselves in the web application’s settings; on a password change, the other sessions are ended.

A user requests deletion of their own account by a request under clause 5.2; the operator deletes the account within 30 days, and from backups — within 90 days, except for data whose retention is required by law. The account of a member who is not an organisation owner is deleted at their request in this manner.

- If the user is the sole owner of the organisation and the client for it is the user personally as an individual, a request to delete the account means termination of the contract in respect of that organisation (clause 12.4 of the agreement): together with the account, the organisation’s materials are deleted in the manner of clause 8.7 of the agreement, and the unspent balance is refunded under clause 5.7 of the agreement.
- If the client for the organisation is a legal entity or sole proprietor, the sole owner’s account is deleted after the owner role is transferred to another user at the client’s request (clause 14.2 of the agreement); if there are other owners — in the general manner.
- Deletion of the organisation’s data (repository mirrors, tasks, materials) is requested by the organisation owner in the manner of clause 8.7 of the agreement.

5.4. Withdrawal of consent to the processing of data given in a form on the website does not affect processing carried out before the withdrawal and does not concern data processed to perform the contract. The data given in the form is destroyed within 30 days of the date the withdrawal of consent is received (part 5 of Article 21 of Federal Law No. 152-FZ).

## [6. Changes to the policy](https://buff.systems/en/legal/privacy#6-changes-to-the-policy)

6.1. The operator may change the policy. A new edition is published at the address of this page, stating the date it takes effect, no less than 10 days before that date; publication constitutes notice of the changes.

6.2. The current edition of the policy is always available at the address of this page; the date of the edition is shown above the page title.

Other documents: [User agreement (public offer)](https://buff.systems/en/legal/terms), [Mobile app privacy](https://buff.systems/en/legal/mobile-privacy), [Payment and refund terms](https://buff.systems/en/legal/payment)