Privacy policy

In short

• The extension sends nothing on its own - only when you press a button in the panel.
• The text of requests from the extension is not stored on the server. Chat dialogs in the dashboard are kept so you can continue them and are deleted automatically - see the periods below.
• You decide what to send in a request, and you are responsible for other people’s data in it.
• We don’t sell data or show ads. Analytics on https://roteless.ru is turned on only with your consent.

Whose data and what

• Dashboard and extension users: email, name (if given), password hash, settings, consent records, Service usage and payment data.
• Website visitors: cookies, IP address and visit data - if they agreed to analytics.
• People mentioned in users’ requests: whatever the user sent in the request. The Operator does not review this data and uses it only to fulfil the request.

Purposes and legal grounds

• Registration, sign-in, running the extension and chat, counting limits - to perform the offer agreement (Art. 6(1)(5) of 152-FZ) and based on your consent.
• Accepting payments, granting subscriptions and tokens, refunds, receipts - to perform the agreement and meet tax law requirements.
• Answering requests and claims - to perform the agreement and the law.
• Preventing abuse and finding bugs using technical logs - the Operator’s legitimate interest in running the Service securely (Art. 6(1)(7) of 152-FZ).
• Website analytics - only based on consent in the cookie banner.

What is stored in the browser

The extension’s local storage keeps the access token you pasted in the settings and a cache of your workspace’s buttons. This data does not leave your browser, except the token, which is sent to the server for authorization. It is deleted together with the extension.

Cookies and site analytics

The site https://roteless.ru stores your cookie choice in a cookie so it doesn’t ask again; it is kept for a year.

If you click “Accept all”, the site loads Yandex Metrica (Yandex LLC). It sets its own cookies and collects visit data: the cookie ID, IP address and approximate location from it, page URLs, referrer, clicks, scrolling and mouse movements (Webvisor), device and browser type. This is personal data, so Metrica runs only with your consent. It helps us understand how visitors use the site and improve it. Processing also follows Yandex’s terms: yandex.ru/legal/metrica_termsofuse.

If you choose “Necessary only”, Metrica is not loaded. You can withdraw consent via the “Cookies” link at the bottom of the site; Metrica’s cookies are then deleted. Metrica runs only on the site - the extension and the dashboard don’t use it.

What the extension sends to the server

Only after your action in the panel does the extension send to api.roteless.ru:

• the text and structure of the selected page fragment;
• a snapshot of the selected screen area, if you chose snapshot mode;
• images and files from the selected fragment;
• your question and the current dialog history in the panel;
• when filling in a form - the names and descriptions of its fields;
• after filling in a form - the site domain and the number of filled fields.

Sharing with model suppliers and cross-border transfer

To get an answer, the server forwards the request data to the supplier of the model selected in the button or in the chat. Own models run on the key you connected, under your agreement with the supplier.

Service models run through FLEYLI LLC (the Polza AI service, INN 0272928204, OGRN 1240200040453, Russia). It forwards the request to the developer of the selected model - Anthropic, OpenAI, Google, xAI, DeepSeek and others. The developers process data on servers outside the Russian Federation, including in the USA and China - countries that do not ensure adequate protection of data subjects’ rights. The account ID, email and payment data are not part of the request. Data is transferred only on your action - pressing a button or sending a chat message.

Roteless acts as a technical intermediary and does not review request content. Do not send health data or other special categories of personal data, biometrics, card payment data, or other people’s data without a lawful basis.

Other recipients

• YooKassa (NCO YooMoney LLC) - accepting payments and refunds. You enter card details on the YooKassa page; the Operator does not receive them and gets only the payment status and amount.
• An email service - sending sign-up confirmation emails.
• Selectel JSC - running the server and the database in the Russian Federation.
• Government authorities - only where required by law.

What is stored on the server and for how long

• Account - email, name, password hash, settings, the date and version of the accepted documents and consent. Kept while the account exists.
• Extension tokens - only the token hash, label and last-used date.
• Dashboard chat dialogs - messages, model answers and the text of attached documents. A dialog is deleted automatically after 7 days without new messages (30 days with a subscription) and in any case 90 days after its last change. Chat images are kept for 24 hours, original documents for 7 days. You can delete a dialog yourself at any time.
• Button run statistics - which button was pressed, by whom, when, duration, token count and status, without request or answer text. Deleted automatically after 180 days.
• Limit accounting - how many tokens were used per day or month, without text. Deleted automatically after 62 days.
• Subscription - the workspace plan and its validity period.
• Payments and balance - amount, date, status and YooKassa payment ID, top-up history, remaining purchased tokens and the personal daily limit. Kept while the account exists, and after deletion for the period needed for tax accounting and dispute resolution.
• Images generated in the extension - deleted automatically after 1 hour.
• Activity log - changes to buttons, tokens and settings in the workspace, the last 500 entries.
• Technical logs - IP address, request URL and browser; needed to prevent abuse and find bugs, kept for a limited time.

How data is protected

Data is transmitted only over HTTPS. Passwords are stored as hashes, own-model access keys are encrypted (AES-256-GCM). Access to workspace data is limited by members’ roles; only the Operator has access to the server and the database.

Your rights

To exercise these rights, write to extension.roteless@gmail.com from the address on the account. We reply within 10 working days; in exceptional cases this may be extended by 5 more working days with an explanation.

• Find out what data about you is processed and get a copy.
• Ask to correct, block or delete data that is incomplete, outdated or processed unlawfully.
• Withdraw consent to data processing. After that the Operator stops processing and deletes the data within 30 days, except data that must be kept by law (such as payment records). The account cannot be used after consent is withdrawn.
• Delete a token in the dashboard, remove the extension, delete the account and its data.
• Complain about the Operator to Roskomnadzor (rkn.gov.ru) or a court.

Changes

When the policy changes, we update the date at the top of the page. We announce material changes by email or in the dashboard.