Skip to content
Tydy

Personal Data Processing Policy

Effective: Updated:

This Policy describes how the Operator organizes processing of personal data in connection with the Tydy service at tydy.dev.

Contents
  1. 1. Operator (controller)
  2. 2. Definitions
  3. 3. Principles
  4. 4. Data subjects
  5. 5. Purposes and scope
  6. 6. Composition of personal data
  7. 7. Processing actions
  8. 8. Legal grounds
  9. 9. Confidentiality and access
  10. 10. Third parties and cross-border processing
  11. 11. Retention
  12. 12. Rights of data subjects
  13. 13. Security measures
  14. 14. Updates

1. Operator (controller) #

Personal data is processed by Komishan Nikita Danilovich (Комишан Никита Данилович), a self-employed individual (самозанятый), INN 231142994315 (the “Operator”).

Privacy contact: privacy@tydy.dev. Related contacts: support@tydy.dev, legal@tydy.dev, security@tydy.dev. The Operator uses email only and does not publish a postal address for personal-data correspondence.

2. Definitions #

“Personal data” means any information relating to an identified or identifiable natural person processed in connection with the Service.

“Processing” means any operation performed on personal data, including collection, recording, organization, storage, adaptation, retrieval, use, disclosure, restriction, erasure, or destruction.

“Service” means the Tydy SaaS product available at tydy.dev, including optional Telegram integrations, AI proposal and Inbox review workflows, MCP access, and billing.

3. Principles #

The Operator processes personal data lawfully, fairly, and for stated purposes; collects data that is adequate and not excessive for those purposes; seeks accuracy; limits retention; and applies security measures appropriate to the risks.

The Operator does not claim certifications, seals, or regulatory approvals that have not been independently obtained for the Service.

4. Data subjects #

Data subjects may include account holders, workspace members and invitees, individuals whose information appears in Customer Content (including Telegram messages in configured chats), payment payers, and persons who contact the Operator by email.

5. Purposes and scope #

Processing supports account administration, workspace collaboration, authorization (including denying access without confirming private existence where appropriate), Telegram ingestion only for configured integrations, AI proposal generation and human Inbox review, MCP OAuth/PAT authentication with scopes intersecting RBAC and hashed token storage, YooKassa billing in RUB for Free/Pro/Team and optional Pro trials, security logging, and customer support.

Message content is treated as conversational input to project-state changes, not as an automatic one-message-one-task pipeline.

6. Composition of personal data #

Typical data elements include identifiers and contact details; authentication and session data; role and permission data; task and project content; Telegram message and media metadata delivered via integration; AI proposal and review records; MCP connection and scope metadata; billing status, auto-renewal state, provider payment-method metadata (not full card credentials), and payment references; and technical logs.

Browser locale and theme preferences may be stored in localStorage on the device. Site analytics via Yandex.Metrika (and related Yandex cookies/identifiers) are described in the Cookie Policy.

7. Processing actions #

The Operator may collect, record, systematize, accumulate, store, clarify, retrieve, use, transfer (including to processors and as required by law), anonymize where feasible, block, delete, and destroy personal data.

Automated decision-making that produces legal or similarly significant effects solely by AI without human involvement is not the design of the Inbox review path: below thresholds, proposals await human action; business rules govern application.

9. Confidentiality and access #

Access to personal data within the Operator’s systems is limited to what is needed to operate and support the Service. Workspace members see Customer Content according to RBAC. MCP clients receive only what scopes and RBAC jointly allow.

Necessary cookies used for authentication and CSRF protection are described in the Cookie Policy (flowtask_session, flowtask_csrf, tydy_remember_device).

10. Third parties and cross-border processing #

Personal data may be disclosed to hosting and infrastructure providers, email delivery providers, YooKassa for payments, and authorities when legally compelled. Telegram and MCP client vendors process data under their own roles when you use those products.

Infrastructure may be located outside the data subject’s country. Using the Service implies awareness that such transfers may occur to provide tydy.dev.

11. Retention #

Retention periods follow the need to provide the Service, statutory accounting and tax retention for the self-employed Operator, dispute resolution, and security monitoring. Backups may persist for a limited additional period after deletion requests are processed in primary systems.

12. Rights of data subjects #

Subject to applicable law, you may request information about processing, access, correction, deletion, restriction, withdrawal of consent, and complaint to a supervisory authority. Submit requests to privacy@tydy.dev. The Operator may verify identity and respond within statutory timelines.

Exercising rights must not unlawfully infringe others’ rights or the Operator’s ability to defend legal claims.

13. Security measures #

Measures include authentication controls, CSRF protection, hashed session and MCP token secrets, workspace scoping, logging and abuse controls, and least-privilege operational access. No absolute security guarantee is offered.

14. Updates #

This Policy may be updated by publishing a new version on tydy.dev with revised effectiveDate and updatedDate. Material changes will be communicated as required by law.