ReamReam
install

Privacy Policy

Updated: August 11, 2026

1. General

This privacy policy (the "Policy") is drawn up in accordance with Russian Federal Law No. 152-FZ "On Personal Data" and describes how personal data is processed and protected by the operator: Sole proprietor Marina Petrovna Bush, OGRNIP 326774600014081, INN 772154254274, phone: +7 916 565-31-76, email: support@ream.design (the "Operator").

The Policy applies to all information the Operator may receive about visitors of https://ream.design and its subdomains (the "Site") and users of the Ream Desktop application (the "Service").

By using the Site and the Service you confirm that you have read this Policy. In case of any discrepancy between the English and Russian versions, the Russian version prevails.

2. Data we process

  • name (nickname) provided at registration;
  • email address;
  • profile picture (avatar), if uploaded;
  • authentication data: the cryptographic hash of the password and, when signing in via an external provider, the user's identifier at that provider and the access tokens it issued;
  • Service usage data (feature-call counters linked to the account), including the internal account identifier used in product usage statistics;
  • the content of support requests and messages sent through the feedback form, together with the application version they were sent from;
  • records of the consent given to personal data processing: date and time, version and language of the consent text, IP address and browser user-agent at the moment it was given;
  • technical data automatically recorded by server infrastructure: IP address, browser user-agent, date and time of access;
  • strictly necessary cookies (authentication session).

The Operator does not process special categories of personal data or biometric data. The profile picture is used solely for display in the interface and is not used to identify a person.

3. Purposes of processing

  • registration, authentication and account management;
  • providing Service features, including usage-limit accounting;
  • sending transactional messages (email verification codes, account notifications);
  • responding to support requests;
  • recording and evidencing the fact that consent to personal data processing was obtained;
  • performing the contract when paid features are purchased;
  • complying with obligations imposed on the Operator by Russian law.

The Operator does not use personal data for advertising without separate consent and does not share it with third parties for marketing purposes.

4. Legal grounds

  • consent of the data subject;
  • necessity to perform a contract to which the data subject is a party;
  • necessity to comply with obligations imposed on the Operator by Russian law.

5. How data is processed

Personal data is collected through the Site's forms (registration, sign-in) and in the course of using the Service, and is processed by automated means.

Recording, systematisation, accumulation, storage, clarification and retrieval of personal data of Russian citizens is performed using databases located in the Russian Federation.

No decisions producing legal consequences for the user are made solely on the basis of automated processing.

6. Sharing with third parties

The Operator engages the following categories of processors that keep the Service running:

  • a hosting provider with infrastructure located in the Russian Federation (database storage and backend operation);
  • a transactional email delivery service (only the recipient's email address is shared, to deliver service messages);
  • a payment service — when paid features are purchased (the payment is processed on the payment service's side; the Operator does not receive or store full card details).

Personal data is not shared with any other third parties, except where required by Russian law (upon request of authorised state bodies).

7. Retention

  • account data — until the account is deleted or consent is withdrawn;
  • server logs (IP address, user-agent) — kept in a bounded volume: the oldest entries are automatically discarded as new ones arrive;
  • consent records — for the duration of processing and three years after it ends (to evidence the lawfulness of processing in case of a claim);
  • data required by law (e.g. accounting records) — for the periods established by law.

When the purposes of processing are achieved or consent is withdrawn, personal data is destroyed within 30 days unless the law requires otherwise.

8. Cookies

The Site uses strictly necessary cookies (authentication session) and — only with the user's separate consent requested via the banner — analytics cookies and metrics to collect Site and product usage statistics. No advertising cookies are used.

9. Your rights

You have the right to:

  • obtain information about the processing of your personal data;
  • request correction, blocking or deletion of personal data that is incomplete, outdated, inaccurate or unlawfully obtained;
  • withdraw your consent to processing;
  • lodge a complaint with Roskomnadzor or a court.

Requests can be sent to support@ream.design or by post to the Operator's address. The Operator responds within 10 business days. Withdrawal of consent results in deletion of the account and termination of processing, except for data whose retention is required by law.

10. Security measures

  • data between the browser, the application and the servers is transferred over encrypted channels only (TLS);
  • passwords are stored as cryptographic hashes only;
  • selected database fields are stored encrypted;
  • access to personal data is restricted to what is necessary for the purposes listed in this Policy.

11. Final provisions

The Operator may amend this Policy. The current version is always available at https://ream.design/en/privacy. Continued use of the Site and the Service after changes are published constitutes acknowledgement of the new version.

Questions about this Policy: support@ream.design.