Privacy Policy
This Policy explains how minibi processes personal data. It is intended to satisfy Articles 12–14 of the EU General Data Protection Regulation where the GDPR applies and must be supplemented with jurisdiction-specific notices before launching in additional countries.
1. Controller and representatives
Controller: Mikhail Shatunov
Country: Russian Federation
Address: [required before launch]
Privacy contact: minibils2026@gmail.com
EU GDPR representative: [required before EU launch]
2. Data we process
- Account and identity: phone number, name, email, credentials, eligibility confirmations, and user identifiers.
- Profile and business: photos, biography, qualifications, locations, schedules, products, services, prices, and availability.
- Activity and transactions: bookings, orders, subscriptions, payments, refunds, support, and communications.
- Content: posts, stories, images, video, audio, chat, reviews, reports, and metadata.
- Device and security: IP address, device, operating system, app version, language, push token, logs, events, cookies, and similar identifiers.
- Location and inferences: precise location only with device permission, approximate location where necessary, and preferences inferred from interactions.
minibi is not designed to collect special-category data unless a supported feature and valid legal basis are expressly provided. Free text, images, or chats may contain sensitive information incidentally; access is restricted and such information is deleted or redacted unless lawful processing and retention are required.
2.1 Data obtained from other sources
We may receive data from Professionals or Customers involved in a booking or conversation, users publishing content or reviews, devices and operating systems, technical providers, fraud-prevention services, user-selected public sources, and authorities. Where Article 14 GDPR applies, we provide the required information within the applicable period unless a lawful exemption applies.
3. Purposes and legal bases
| Purpose | Main data | Legal basis where GDPR applies |
|---|---|---|
| Accounts, profiles, bookings, orders, chat, and support | Account, profile, activity, content | Contract or pre-contract steps, Article 6(1)(b) |
| Payments, records, authorities, and legal claims | Identity, transactions, communications | Legal obligation and legitimate interests, Articles 6(1)(c) and (f) |
| Security, fraud prevention, moderation, and continuity | Logs, devices, content, reports | Legitimate interests, Article 6(1)(f) |
| Search, ranking, and basic recommendations | Profile, approximate location, interactions | Contract or legitimate interests, Articles 6(1)(b) and (f) |
| Precise location and optional device features | Location, tokens, permissions | Consent, Article 6(1)(a) |
| Optional electronic marketing or advertising personalisation | Contact details, preferences, interactions | Separate consent, Article 6(1)(a), unless a narrow legal exception applies |
Data marked as required is necessary to provide the requested service. Marketing, precise location, and non-essential device storage are optional; refusing them does not prevent use of core features.
4. Recipients and public information
Data may be disclosed as necessary to users involved in bookings or orders; hosting, content delivery, authentication, messaging, notification, payment, support, security, and analytics providers; advisers; and competent authorities. Processors acting for us must meet Article 28 GDPR requirements where applicable.
Profiles, catalogues, and content selected as public can be viewed by other users and may be indexed where the feature states this clearly.
5. International transfers
The controller and systems may be located in the Russian Federation, for which the European Commission has not adopted a general adequacy decision. Transfers from the EEA must therefore use an Article 46 safeguard, normally Standard Contractual Clauses, supported by a transfer impact assessment and supplementary technical and organisational measures.
Transfer basis: [SCC module, TIA, and supplementary measures required before EU launch]. Regular transfers must not rely on Article 49 derogations. A redacted copy of applicable safeguards may be requested from the privacy contact.
6. Retention
- Account data: [retention period required].
- Contracts and transaction records: [retention period required].
- Security and technical logs: [retention period required].
After the applicable period, data is deleted or anonymised. Protected backups are overwritten according to the documented backup cycle.
7. Your rights
Where applicable, you may request access, correction, erasure, restriction, portability, or objection, and may withdraw consent at any time without affecting earlier processing. You may always object to direct marketing.
Send requests to the privacy contact. We normally respond within one month under the GDPR and may request information needed to verify identity. You may complain to the supervisory authority in the country where you live or work, or where an alleged infringement occurred.
8. Ranking and automated decisions
minibi may rank professionals, content, products, or services using relevance, approximate location, availability, profile quality, interactions, popularity, and trust signals. These factors affect ordering but do not normally produce legal or similarly significant effects. If such automated decisions are introduced, we will first explain the logic, consequences, human review, and challenge rights.
9. Security, children, and cookies
We use risk-appropriate measures including encryption in transit, access controls, logging, backups, vulnerability management, and incident procedures. No system is risk-free.
The service is not independently directed to children who cannot validly enter the contract. We do not knowingly use behavioural advertising for children.
The website uses essential cookies without consent. Analytics, advertising, or other non-essential identifiers are used only after a free, specific, and revocable choice where required. See the Cookie Policy.
10. Changes
We will publish a new revision date and give advance notice of material changes. If a new purpose requires consent, we will request it separately.