Privacy Policy
Effective date: 31.07.2026
Published pursuant to Article 18.1(1)(2) of Russian Federal Law No. 152-FZ of 27.07.2006 "On Personal Data".
The Russian version is the legally binding one. This translation is provided for convenience.
1. Operator
| Operator | Individual entrepreneur Aigiz Iskuzhin |
| INN | 024803896842 |
| OGRNIP | 326028000044859 |
| OKVED | 62.01 "Computer software development" |
| Roskomnadzor operator registry | No. 2-26-056967 |
| Contact | legal@pir2pir.ru |
Official channels: Telegram bot @pir2pirbot, documentation at https://docs.pir2pir.ru, personal data requests at legal@pir2pir.ru.
2. Relationship to School 21
Pir2Pir is an independent service built by a member of the community. The Operator is not ANO «Школа 21» (School 21), is not affiliated with it and does not act on its behalf. Using Pir2Pir is not part of the educational process.
The Operator does not inherit School 21's legal basis and processes personal data under its own Consent, granted by the subject directly.
3. Principles
- Minimisation. Only data needed for account confirmation, participant matching and notification delivery is processed.
- Purpose limitation. Data is not used for purposes outside the Consent.
- Separate consents. Processing for advertising or transfer to commercial services requires separate consent and is not performed at present.
- Transparency. The data processed is listed in Consent, section 3.
4. Data processed
The full list is in section 3 of the Consent. In brief:
| Category | Source |
|---|---|
| School 21 login and student email | provided by the subject, confirmed by emailed code |
Name, telegram_user_id, @username, profile photo | Telegram, when connecting the bot |
| Campus, wave, education form, level, points, projects | School 21 public API |
| Chat messages and attachments | created by the participant |
| Internal identifiers and request logs | generated by the service |
| The login of an unregistered student and the address derived from it | supplied by a participant; the login's existence is checked against the School 21 public API |
5. Legal basis
Consent of the data subject — Article 6(1)(1) of 152-FZ. No other basis is used.
6. Third-party data
The Operator keeps no directory of participants, offers no search for people, and collects no information about School 21 students who have not registered with the service. Other participants' profiles are disclosed only to those who registered themselves and granted Consent, and only after both have agreed to talk.
The single exception is the invitation sent, at a participant's request, to a School 21 student who is not registered with the service. In that case the Operator processes that person's login, the email address derived from it, the text of the invitation and a record of delivery.
That data comes not from the subject but from the participant who supplied the login. The message being sent also serves as notice to the subject: it states who is asking, what is processed about them, where it came from and how to stop it. The opt-out link in the message takes effect immediately, permanently and across all channels. No account is created for such a person, no profile is built, and no further information about them is requested or retained.
The conditions and limits are set out in section 6.2 of the Consent.
7. Retention
| Data | Period |
|---|---|
| Account and profile | until consent is withdrawn or the account is deleted |
| Verification codes | 10 minutes; the record of the request up to 24 hours, to rate-limit |
| Chat messages and attachments | 30 days after a conversation ends, then the content is deleted |
| Request logs | at most 90 days |
| Invitations to unregistered students | 12 months, then deleted |
| Opt-outs from invitations | indefinitely — the record of the refusal is what makes it enforceable |
| Data whose retention is required by law | for the statutory period |
Once a conversation ends — because either participant closed it, or because it went inactive — message text and attachments are deleted after 30 days. The record that a review happened is kept, since it belongs to the participants' study history, but its content is not recoverable.
After withdrawal, data is destroyed within 30 days.
7.1. Notifications
Chat content does not leave the Operator's infrastructure. A new-message notification containing a short excerpt is delivered only to the web application.
Telegram and any other connected messenger are told only that an event occurred — that a reviewer was found, or that a request to talk was received. No excerpt, full message text, attachment or chat content is sent to a messenger.
8. Security
Organisational and technical measures proportionate to the processing: restricted infrastructure access, TLS in transit, time-limited access tokens, and service logs that contain neither message contents nor verification codes.
9. Rights
The subject may obtain information about the processing; require correction, blocking or destruction of data that is incomplete, outdated, inaccurate or unlawfully obtained; withdraw consent at any time; and appeal to Roskomnadzor or in court.
Requests go to legal@pir2pir.ru and are answered within the statutory period — no more than 30 days.
10. Changes
The current version is published at https://docs.pir2pir.ru. Changes affecting the data processed or the purposes are announced through the Telegram bot.