Personal data processing policy
Version of 2026-10-22
This English text is a translation provided for convenience. The Russian version is the legally binding text and prevails in case of any discrepancy.
This Policy is prepared under Federal Law No. 152-FZ of 27.07.2006 "On Personal Data" ("Law 152-FZ"), including Art. 18.1(2), and describes which personal data is processed when using the evusbstudio.com website (the "Site") and the EV USB Studio software (the "Software"), for what purpose, on what legal basis and for how long, and the rights of data subjects.
1. Operator
| Operator | Individual entrepreneur Mark Maksimovich Stankevich |
| INN (tax ID) | 671405767801 |
| OGRNIP (state reg. No.) | 319673300003092 |
| Registered by | Interdistrict Inspectorate of the Federal Tax Service No. 5 for the Smolensk Region, 31.01.2019 |
| Address | Смоленская обл., Смоленский р-н, д. Гнездово |
| support@evusbstudio.com |
The person responsible for organizing personal data processing is the Operator personally. Personal data enquiries: support@evusbstudio.com.
The Operator is entered in the register of personal data operators. Registration number in the register of operators: 67-25-007564.
2. Terms
The terms "personal data", "processing", "operator", "data subject", "destruction" and "depersonalization" have the meaning given in Art. 3 of Law 152-FZ. "User" means a person using the Site or the Software. "Account", "Subscription", "Activation Code" and "Device" have the meaning given in the License agreement.
3. Processing principles
- processing is lawful and fair and only for purposes defined in advance;
- only data needed for those purposes is processed, without excess;
- databases processed for incompatible purposes are not combined;
- data is kept accurate; inaccurate data is corrected or deleted;
- data is kept no longer than required by the purposes or by law, and is then destroyed.
4. Data subjects
Site visitors; Software users; Account and Activation Code holders; subscribers; Gift Subscription buyers and recipients; people contacting support; newsletter recipients. The Site and the Software are intended for persons who have reached the age of 18; minors use them with the consent of a legal representative.
5. Purposes, data, legal bases and retention
For each purpose below we list the data, the legal basis (Art. 6(1) of Law 152-FZ), the actions, the retention period and destruction. Processing is automated.
5.1. Registering and maintaining the Account
| Data | e-mail address; password hash (bcrypt, the password itself is not stored); hashes of e-mail verification and password reset codes; Device identifier (a one-way hash of the computer’s hardware ID), computer name (host name), platform (Windows/macOS) |
| Legal basis | performance of a contract to which the subject is a party (Art. 6(1)(5)); the subject’s consent (Art. 6(1)(1)) |
| Actions | collection, recording, systematization, accumulation, storage, correction, retrieval, use, blocking, deletion, destruction |
| Retention | until the Account is deleted; code hashes — until the code is used or expires; Device data — 30 days after signing out on that Device or removing the Device; when the Account is deleted, Device data is deleted immediately and the e-mail address is not kept in the account record (not even as a hash); an Account whose e-mail is not confirmed within 48 hours of registration is deleted automatically together with all its data |
| Destruction | deletion from the database within 30 days after the purpose is achieved or the retention period expires (Art. 21(4) of Law 152-FZ) |
5.2. Providing the license, Subscription and Activation Codes
| Data | e-mail address; Device identifier, computer name, platform; Subscription or Activation Code status; payment records (amount, date, status, Robokassa invoice number); when the first month is paid with a promo code - one-way hashes (HMAC with a secret key) of the e-mail address and the Device identifiers, so that a promo code can be used once per person; the e-mail address cannot be recovered from them. The Operator never receives bank card data — only Robokassa LLC processes it |
| Legal basis | performance of a contract (Art. 6(1)(5)) |
| Actions | collection, recording, systematization, accumulation, storage, correction, retrieval, use, blocking, deletion, destruction |
| Retention | for the lifetime of the Account, Subscription or Activation Code; promo code hashes - until the Account is deleted, deleted immediately when it is; payment records — see 5.3 |
| Destruction | deletion from the database within 30 days after the purpose is achieved or the retention period expires (Art. 21(4) of Law 152-FZ) |
5.3. Payments, fiscal receipts, tax accounting
| Data | e-mail address for the receipt; payment records (amount, date, status, Robokassa invoice number) |
| Legal basis | performance of a contract (Art. 6(1)(5)); legal obligations under Federal Law No. 54-FZ and the Tax Code (Art. 6(1)(2)) |
| Actions | collection, recording, storage, use, transfer (provision) to Robokassa LLC, deletion, destruction |
| Retention | for the retention period of tax records set by tax law (5 years); payment records of a deleted Account are deleted 5 years after the payment; unfinished payment attempts (e-mail address, promo code) are deleted after 90 days |
| Destruction | deletion from the database within 30 days after the purpose is achieved or the retention period expires (Art. 21(4) of Law 152-FZ) |
5.4. Recording acceptance of documents and consents
| Data | date and time, IP address, versions of accepted documents; marketing consent flag with date and document version |
| Legal basis | performance of a contract (Art. 6(1)(5)); for the marketing flag — consent (Art. 6(1)(1); Art. 18 of Federal Law No. 38-FZ "On Advertising") |
| Actions | collection, recording, storage, retrieval, use, deletion, destruction |
| Retention | for the lifetime of the Account and 3 years after its deletion (limitation period, Art. 196 of the Civil Code) |
| Destruction | deletion from the database within 30 days after the purpose is achieved or the retention period expires (Art. 21(4) of Law 152-FZ) |
5.5. Security of the Site, the Software and Accounts
| Data | IP addresses (rate limiting, brute-force protection); security log entries (date, Account identifier, event type, and for certain events the IP address) |
| Legal basis | performance of a contract (Art. 6(1)(5)) — providing the service securely and protecting the User’s Account; exercise of the Operator’s rights and legitimate interests in protecting the service (Art. 6(1)(7)) |
| Actions | collection, recording, storage, use, deletion, destruction |
| Retention | IP addresses in rate-limit tables — up to 30 days; security log — for the lifetime of the Account and 3 years after its deletion |
| Destruction | deletion from the database within 30 days after the purpose is achieved or the retention period expires (Art. 21(4) of Law 152-FZ) |
5.6. User support
| Data | e-mail address; message contents and attached files |
| Legal basis | the subject’s consent expressed by sending a message (Art. 6(1)(1)); performance of a contract (Art. 6(1)(5)) — for Account, Subscription and payment requests |
| Actions | collection, recording, storage, use, deletion, destruction |
| Retention | until the request is resolved and no longer than 3 years after the last message |
| Destruction | deletion from the database within 30 days after the purpose is achieved or the retention period expires (Art. 21(4) of Law 152-FZ) |
5.7. Marketing e-mails
| Data | e-mail address |
| Legal basis | the subject’s consent (Art. 6(1)(1); Art. 18(1) of Federal Law No. 38-FZ "On Advertising") |
| Actions | collection, recording, storage, use, deletion, destruction |
| Retention | until consent is withdrawn or the Account is deleted; records of which Account a given newsletter was sent to (to answer delivery questions) — 90 days after the newsletter is sent. Consent can be withdrawn via the "Unsubscribe" link in every newsletter (works without signing in) or by writing to support@evusbstudio.com |
| Destruction | mailing stops immediately after withdrawal; the consent flag is removed within 30 days |
5.8. Web analytics (Yandex Metrika)
| Data | Yandex Metrika cookies, IP address, browser and device information, pages viewed, clicks, session recording (Webvisor). Metrika is not loaded on personal cabinet pages or on the "Engine Sound" page for signed-in users |
| Legal basis | the subject’s consent (Art. 6(1)(1)) given by clicking "Accept all" in the cookie notice |
| Actions | collection, recording, storage, use as aggregated reports; processed by Yandex LLC on behalf of the Operator |
| Retention | until consent is withdrawn; cookie lifetimes are listed in the Cookie policy; data in the service is kept within the periods set by the Yandex Metrika terms |
| Destruction | to withdraw, see the Cookie policy; after withdrawal Metrika is not loaded |
5.9. Software usage statistics (content popularity rating)
| Data | names of the catalog items written to the USB drive and the sound install mode (lock chime / Boombox); Software version; platform; a random installation identifier of the Software (different from the Device identifier and not linked to the Account); IP address. On the server this identifier and the IP address are stored only as hashes with a secret salt, in a separate database not linked to the Account |
| Legal basis | exercise of the Operator’s rights and legitimate interests (Art. 6(1)(7)) — building the content popularity rating |
| Actions | collection, recording, storage, use in aggregate, deletion, destruction |
| Retention | write events (with the installation identifier hash) — up to 45 days; the IP address hash — only in rate-limit counters, deleted after the limit window expires (up to 2 days) at the next daily cleanup; the aggregate popularity counters contain no identifiers |
| Destruction | automatic deletion when the periods above expire |
5.10. Gift Subscription
| Data | Buyer: name, e-mail address, payment records (see 5.3). Recipient: name and e-mail address entered by the Buyer. Also: the greeting text, the delivery date, the chosen letter design, the Gift Code, the delivery and activation dates, the identifier of the Account in which the Gift Code was activated |
| Legal basis | Buyer — performance of a contract to which they are a party (Art. 6(1)(5)) and consent (Art. 6(1)(1)); Recipient — performance of a contract under which they are the beneficiary (Art. 6(1)(5); a contract for the benefit of a third party, Art. 430 of the Civil Code). The Recipient’s data is used only to send them the gift e-mail and to activate the gift; no marketing e-mails are sent to the Recipient without their separate consent |
| Actions | collection, recording, storage, use, deletion, anonymisation, destruction |
| Retention | the greeting text — 30 days after the e-mail is delivered; an unpaid gift order — 90 days; the Buyer’s and Recipient’s names and e-mail addresses — until the Gift Code is activated or its activation period expires and then 3 years (limitation period, Art. 196 of the Civil Code); payment records — see 5.3 |
| Destruction | automatic deletion (greeting text, unpaid orders) and anonymisation (names and addresses) when the periods above expire |
5.11. "Invite a friend" programme
| Data | the Account’s personal invite code; for the invited person — which Account invited them, the date and the fact of the first Subscription payment; the inviter sees in the Personal account and in the notification e-mail only a partially hidden e-mail address of the invited person (first characters and the domain, e.g. iv***@mail.ru) and the Subscription date |
| Legal basis | performance of a contract (Art. 6(1)(5)) — the programme terms in section 14 of the Subscription rules |
| Actions | collection, recording, storage, use, provision (of the partially hidden address) to the inviter, deletion, destruction |
| Retention | until the invited or inviting Account is deleted; records of credited bonuses — for the lifetime of the Account and 3 years after its deletion |
| Destruction | deletion from the database within 30 days after the purpose is achieved or the retention period expires (Art. 21(4) of Law 152-FZ) |
Geolocation on the "Engine Sound" page
To make the sound follow the speed, the "Engine Sound" page asks for access to the device’s geolocation after Start is pressed; the browser asks the User for permission. Coordinates, speed and location accuracy are processed only in the browser on the User’s device, in memory and only while the sound is on. They are not sent to the Operator’s server or to third parties and are not recorded or stored by the Operator, so the Operator does not process them as personal data. Geolocation stops with the "Engine off" button or when the page is closed or left. Permission can be revoked in the browser settings (site permissions for evusbstudio.com). Without permission the test mode with a virtual pedal is available. To check the right to start a sound, the server receives only the chosen sound’s identifier and the Account session; the chosen sound is saved in the browser (see the Cookie policy).
6. Software usage statistics
When the User writes catalog items to a USB drive, the Software sends the names of those items and the sound install mode (lock chime / Boombox), the Software version, the platform and a random installation identifier of the Software (different from the Device identifier and not linked to the Account). On the server this identifier and the IP address are stored only as hashes with a secret salt, in a separate database not linked to the Account. This is pseudonymised data; it is used in aggregate for the content popularity rating on the basis of the Operator’s legitimate interest (Art. 6(1)(7) of Law 152-FZ); retention periods are in 5.9. With the visitor consent ("Accept all" in the cookie bar) the Site also uses a unique-visitor counter (the ev_uv cookie) that contains no identifier — see the Cookie policy.
7. Recipients and processors
The Operator does not sell personal data and discloses it only to the following parties to the extent needed for the purposes above:
- Beget LLC — hosting of the Site, the Software back end and databases, sending e-mails (servers located in the Russian Federation);
- Robokassa LLC — payment acceptance, recurring Subscription charges, fiscal receipts under Law 54-FZ; bank card data is processed only by Robokassa LLC;
- Yandex LLC — the Yandex Metrika service, only with consent to analytics cookies;
- fiscal data operators and tax authorities — as required by Law 54-FZ; public authorities — where required by law.
Google Analytics and other foreign analytics services are not used on the Site.
8. Localization and cross-border transfer
Recording, systematization, accumulation, storage, correction and retrieval of personal data of Russian citizens are carried out using databases located in the Russian Federation (Art. 18(5) of Law 152-FZ). The Operator does not transfer personal data across borders.
9. Cookies
The Site uses necessary cookies, and Yandex Metrika cookies only after "Accept all" is clicked. The list of cookies, their lifetimes and how to change your choice are in the Cookie policy.
10. Security measures
- data between the browser, the Software and the server is transferred only over HTTPS (TLS);
- passwords are stored as bcrypt hashes, verification and reset codes as hashes, the Device identifier as a one-way hash;
- access to databases and admin functions is restricted and protected;
- rate limiting and brute-force protection;
- regular backups;
- the Operator notifies Roskomnadzor of incidents involving unlawful disclosure of personal data within the periods set by Art. 21(3.1) of Law 152-FZ.
Destruction of personal data is documented as required by the rules approved by Roskomnadzor.
11. Your rights
The data subject has the right to:
- obtain information about the processing of their personal data (Art. 14 of Law 152-FZ);
- demand correction, blocking or destruction of data that is incomplete, outdated, inaccurate, unlawfully obtained or not needed for the stated purpose;
- withdraw consent to processing;
- demand that processing for marketing stops (Art. 15 of Law 152-FZ);
- appeal against the Operator’s actions to Roskomnadzor or a court (Art. 17 of Law 152-FZ).
The Operator does not take decisions producing legal effects for the subject based solely on automated processing.
12. How to make a request
Send your request to support@evusbstudio.com. The request must allow us to identify you and confirm your relationship with the Operator — for example, by sending it from the Account e-mail address or stating that address and payment details. Information about the processing of personal data is provided within 10 working days of receiving the request; this period may be extended by no more than 5 working days with a reasoned notice stating the reasons. Incomplete, inaccurate or outdated data is corrected, and data that was unlawfully obtained or is not necessary for the stated purpose is destroyed, within 7 working days of receiving the confirming information (Arts. 14, 20, 21 of Law 152-FZ).
13. Withdrawing consent
Consent is withdrawn with the "Delete account" button in the personal cabinet or in the Software (Settings → Account), or by writing to support@evusbstudio.com; marketing consent can also be withdrawn via the "Unsubscribe" link in any e-mail. After withdrawal the Operator stops processing and destroys the data within 30 days of receipt (Art. 21(5) of Law 152-FZ), unless otherwise provided by law. The Operator may continue processing without consent where Art. 6(1)(2)-(11) of Law 152-FZ applies (for example, keeping payment records under tax law). When the Account is deleted, Device data is deleted immediately and the e-mail address is not kept in the account record (not even as a hash); the Account log (acceptance of documents, security events) is deleted 3 years after the Account is deleted, and payment records 5 years after the payment. Withdrawing consent to processing of Account data means deleting the Account and canceling the Subscription.
14. Changes to this Policy
The Operator may change this Policy. A new version is published on this page with its version date and applies from publication unless stated otherwise.