Riadov Systemsprocess automation
ENUAPLRU

Privacy Policy

Version 2.2 of · Riadov Systems Vladyslav Riadov

This version is no longer current. Current version: https://riadov.systems/privacy/

Permanent address of this version: https://riadov.systems/privacy/2-2/

1. Controller and what this document is

This Privacy Policy (the “Policy”) explains what personal data Riadov Systems processes, why and on what legal basis, to whom it is disclosed, how long it is kept and what rights you have. This is information we are required to provide to you (Art. 13 GDPR), not consent: you do not need to accept it, and accepting the Terms of Service is not consent to data processing. We ask for consent separately only where it is required (section 6).

The controller of personal data is:

  • Riadov Systems Vladyslav Riadov
  • NIP: 6972395549 · REGON: 526790012
  • Address: ul. Jana Ostroroga 1a/28, 64-100 Leszno, Polska
  • E-mail: support@riadov.systems
  • Telegram: @Riadov_Systems
  • Phone, WhatsApp and Viber: +48 888 577 884

Personal data is processed in accordance with EU Regulation 2016/679 (GDPR) and the applicable law of the Republic of Poland.

The terms “Services”, “Service”, “Riadov Pay”, “Dashboard”, “Subscription” and “Annex” have the meaning given in the Terms of Service.

2. What the Policy covers

  • The riadov.systems website — information about the Services, contacts and an enquiry form.
  • Enquiry forms in our ads — on Facebook and Instagram (Meta instant forms).
  • The riadov.app showcase — the riadov.app home page and its language versions with a list of our products, as well as the landing pages of our products lot-check.riadov.app and smart-feed.riadov.app with their language versions.
  • The Services of Riadov Systems and the pay.riadov.systems Dashboard — the Telegram bots of the Services listed in the Terms (section 4) and the Riadov Pay page that the bot opens in Telegram: plans, payment and subscription.
  • Custom development, hosting and support — our correspondence with you about orders.
  • Support — Telegram @Riadov_Systems, WhatsApp and Viber +48 888 577 884, support@riadov.systems.

This Policy is a general one. Each Service also has its own Privacy Policy — an Annex listed in the Terms (section 4); it is shown by the Service’s bot, and the Dashboard and the payment page link to it. It contains the full list of the Service’s data, its recipients, retention periods and the commands with which you exercise your rights. Riadov Pay and the bots of the Services are parts of Riadov Systems, not third parties.

What the Policy does not cover. Systems that we have developed or host for other companies (in particular on the riadov.app domain) process their users’ data on behalf of those companies. The controller of such data is the company that provides the service to you; we process it only on that company’s instructions and under our contract with it (template: Data Processing Agreement). Ask that company about your rights in such a system; if you contact us, we will forward your request to it. An address on riadov.app does not in itself mean that Riadov Systems is the controller.

3. What data we process

Website visits. When you visit the website, request logs are processed — IP address, time, the address of the requested page, the address of the page you came from (referer) and technical browser data (user-agent). Requests to the website pass through the Cloudflare network (section 7) and then reach our server.

In your browser’s storage (localStorage), the website stores your choice on the cookie banner (rs-consent) and, if you have switched the theme, the light or dark theme (rs-theme). The website’s fonts are loaded from our server, not from third-party servers.

Analytics and advertising — only after “Accept”. Until you click “Accept” on the cookie banner, and also after “Necessary only”, the website does not load Google and Meta scripts, and nothing is sent from the website to these companies. After “Accept”, the following run on the website:

  • Google Analytics 4 — Google receives data about the pages opened and about clicks on contact links (Telegram, WhatsApp, Viber, e-mail), your browser identifier from a cookie, the page address and the referring page address, data about your browser, system and screen, and your IP address; Google determines your approximate location from the IP address.
  • Meta Pixel — Meta receives data about the page being opened and about a click on a contact link, your browser identifier from a cookie, the page address, browser data and your IP address. If you are logged in to Facebook or Instagram in that browser, Meta may link this data to your Meta account. We use it to measure advertising and to show ads to people who have already visited the website.

On the riadov.app showcase and on the landing pages of our products lot-check.riadov.app and smart-feed.riadov.app, after “Accept” only Google Analytics 4 runs, and only for the pages opened, without Meta Pixel. The names of the cookies, their lifetimes and how to withdraw consent are set out in the Cookie Policy.

Enquiry form. When you submit an enquiry from the website, we receive your name (if you provided it), a contact for our reply — Telegram, WhatsApp, Viber or e-mail — the description of the task (if you added one), the website language and the address of the page from which the enquiry was sent. Without a contact we cannot reply; the name and the task description are optional.

Enquiry form in Facebook and Instagram ads. When you submit an enquiry through the form in our ad (a Meta instant form), we receive your name, a contact for our reply — phone number, Telegram, WhatsApp or Viber — your answers to the form’s questions (for example, how many technicians your service has), the name of the ad and the form, and the time of the enquiry. Meta may prefill your name and phone number from your Facebook or Instagram account — you can change them before submitting. We see the enquiry in Meta’s leads center, and it may be forwarded to the personal Telegram bot of Riadov Systems’ owner — just like an enquiry from the website form. Without a contact we cannot reply; the other questions help us prepare the reply.

Account in the Service’s bot and in the Dashboard. The Service’s bot stores your Telegram ID, username and name from Telegram (if any), language, the dates the account was created and of your last interaction with the bot, as well as the data without which the Service’s functions do not work (listed in the Service’s Policy). The Dashboard stores your Telegram ID within the Service, the Dashboard language, the time of your last login to the Dashboard and the Stripe customer identifier; payment data — section 4. Without a Telegram ID the Service cannot recognise you, so it cannot be used without one.

After the account is deleted, a fingerprint of your Telegram ID computed with a secret key and the date of deletion are kept — to prove that the deletion was carried out and to repeat it if the database has to be restored from a backup. The Telegram ID itself is not kept. The fingerprint is a pseudonym, not anonymous data: whoever holds the key can check whether it belongs to a specific Telegram ID.

Support and orders. When you write to us in Telegram, WhatsApp, Viber or by e-mail — your correspondence with us and your contact details. If you request an invoice — the data you send for it: company name or your name, address and, for a company, tax number. If, for custom development, you give us access to your systems or data, we process them only for your order, on your instructions and on terms separately agreed with you — the Development and Hosting Terms and the Data Processing Agreement (section 2).

4. Payments and Stripe

Payment is made through the Stripe payment service (Stripe, Inc. / Stripe Payments Europe, Ltd.) on a secure Stripe page — not on the website and not in the Dashboard. You enter your bank card details, e-mail and whatever else Stripe asks for to make the payment on the Stripe page: they are processed by Stripe in accordance with its privacy policy — stripe.com/privacy. Riadov Systems has no access to full bank card details.

You pay for the Services in the Dashboard. Riadov Pay stores:

  • the chosen plan, the dates of payment and of completion of Setup;
  • the subscription status — plan, number of add-ons, billing period, cancellation flag, the date from which a renewal has not been paid;
  • unfinished payment sessions;
  • payments — type, amount, currency, status, payment identifiers in Stripe;
  • consents before payment — type, the version number of the Terms of Service and the version number of the Service Terms you accepted, the version of the checkbox text, the payment session identifier and the time.

We do not collect or store payer data — name, address, tax number — during payment. Stripe receives from us only technical payment data: the Service, the plan and the type of payment, our internal customer identifier, the version numbers of the Terms and of the checkbox text, and the language of the payment page.

Development, hosting and support are paid for by a method agreed with you separately (Terms of Service, section 7).

Invoices are issued at your request through support: we use the data you send for an invoice only for the invoice and for accounting, and enter it manually into the inFakt accounting service (section 7). There is currently no automatic transfer of payment data to inFakt; if we introduce it, this will be stated in a new version of this Policy.

5. Purposes of processing

  • to provide the Services, maintain your account and communicate with you in the language you choose
  • to reply to enquiries from the website and from the forms in our ads, and to messages, and to agree and carry out orders
  • to accept payments, manage subscriptions and show their status in the Dashboard
  • accounting, tax obligations and invoices on request
  • to prove which Terms you accepted and that you requested the service to begin before payment
  • to handle complaints, withdrawals from the contract and possible claims
  • to prove that your deletion request has been carried out and to repeat the deletion after a backup is restored
  • security and stable operation of the website and the Services, fraud prevention, investigation of failures
  • after “Accept” on the cookie banner — analysis of website visits (Google Analytics), measurement of advertising and showing ads to people who have already visited the website (Meta Pixel)

6. Legal bases

  • performance of a contract and steps taken at your request before entering into it — Art. 6(1)(b) GDPR: replying to enquiries from the website or from a form in our ads and to your messages, the account in the bot and the Dashboard, provision of the Services, payments and subscriptions, correspondence about orders;
  • compliance with legal obligations — Art. 6(1)(c) GDPR: records of payments and invoices — accounting and tax obligations; handling complaints and withdrawals from the contract;
  • legitimate interest of the controller — Art. 6(1)(f) GDPR: website request logs and technical logs of the Services, security and fraud prevention; keeping evidence of the accepted Terms and of the request to begin the service, and defence against possible claims; the fingerprint after account deletion;
  • your consent — Art. 6(1)(a) GDPR: only the “Accept” button on the cookie banner (Google Analytics and Meta Pixel).

The checkbox before payment is acceptance of the Terms and a request to begin the service immediately, i.e. part of the contract, not consent to data processing. By submitting an enquiry from the website or from a form in our ads you do not give consent either: we process it in order to respond to your request.

You do not have to give consent to cookies — the website works the same way. You can withdraw it at any time with the “Cookie settings” button at the bottom of every page of the website. Withdrawal does not affect the lawfulness of processing before it.

You may object to processing based on legitimate interest (section 9).

7. Recipients

  • Telegram (Telegram Messenger Inc., Telegram FZ-LLC) — the platform through which the bots of the Services, the Dashboard, support in Telegram and the owner's personal bot that receives enquiries from the website form (and may receive enquiries from the forms in our ads) operate. Telegram processes data as a separate controller under its own policy: telegram.org/privacy.
  • Stripe (Stripe, Inc. / Stripe Payments Europe, Ltd.) — payment processing (section 4): stripe.com/privacy.
  • Cloudflare (Cloudflare, Inc.) — a delivery and protection network: requests to riadov.systems, riadov.app (including the landing pages lot-check.riadov.app and smart-feed.riadov.app) and pay.riadov.systems pass through it, and it processes the IP address and technical request data.
  • Hosting provider — our servers are physically located in the European Union (Germany).
  • Google (Google Ireland Limited) — Google Analytics 4, only after “Accept” (section 3).
  • Meta (Meta Platforms Ireland Limited) — Meta Pixel, only after “Accept” (section 3), and the enquiry forms in our Facebook and Instagram ads (section 3): Meta stores the enquiry data and passes it to us on our behalf as a processor, and prefills the form with data from your account as a separate controller under its own policy: facebook.com/privacy/policy.
  • WhatsApp and Viber (WhatsApp Ireland Limited, Viber Media S.à r.l.) — if you write to us in these messengers: the correspondence passes through them, and they process data as separate controllers under their own policies.
  • inFakt — an accounting service, only when you request an invoice: the data you sent for it (an accountant may have access).
  • Anthropic (Anthropic Ireland, Limited / Anthropic PBC) — artificial intelligence development tools (Claude), which we use under Anthropic’s commercial terms with a data processing agreement: help with code and investigating failures. Personal data reach them only to the minimum extent needed to investigate a specific failure (for example, an excerpt of a technical log with a Telegram ID); processing takes place in the USA on the basis of standard contractual clauses. Other artificial intelligence development tools do not receive personal data.
  • Other recipients of a particular Service — in the Service’s Policy.

Some of these recipients may process data outside the European Economic Area. In that case the transfer takes place on the grounds provided for in the GDPR — in particular on the basis of a European Commission adequacy decision or standard contractual clauses.

Riadov Pay and the bots of the Services exchange with each other the payment status, plan, limits and time of last activity and, at your request, a copy of your data or its deletion.

Riadov Systems does not sell personal data.

8. Retention periods

  • Account in the Service’s bot and in the Dashboard — until you delete it, or until 365 consecutive days pass without your interaction with the bot and the Dashboard and without an active subscription: the account is then deleted automatically, in the bot and in the Dashboard together. The Service’s bot warns you 30 days and 7 days before such deletion.
  • Records of payments and of consents before payment — after the account is deleted, they remain without a link to your account for as long as tax law requires: books and related documents are kept until the limitation period for the tax liability expires — 5 years from the end of the year in which the tax payment deadline passed. The tax payment deadline for a payment passes in the following year, so we keep a payment record until 31 December of the sixth year after the year of payment inclusive (a payment made in 2026 — until 31 December 2032), and a consent record under the same rule, counted from the year of the last payment that relies on it. If the running of the limitation period is suspended or interrupted (for example, because of tax proceedings), the records are kept until it expires. After this period we delete them.
  • Fingerprint after account deletion — 730 days from deletion: it is only a fingerprint without the Telegram ID and a date, needed to prove the deletion and to repeat it after a backup is restored.
  • Data in Stripe — your customer profile in Stripe is deleted together with the account; Stripe keeps payment records under its own policy.
  • Backups of databases and files on our server — the 7 most recent daily backups: each day the oldest backup is replaced with a new one, and deleted data disappears once the last backup containing it is removed in this way. If part of the backup process fails, we keep the last successful backup of that part until the failure is fixed. There is currently no separate backup server; when one is added, we will add its provider and the retention period of backups on it to this Policy in a new version. If the database has to be restored from a backup, we repeat the deletions already carried out before reopening the Service.
  • Technical logs of the bots and Riadov Pay — up to 30 days (log files are also limited to three of 5 MB each). The website’s request logs (nginx) are rotated daily: files are compressed and deleted after 30 days. The container logs on the server are limited by size only — three files of 5 MB each, after which the oldest entries are overwritten.
  • Enquiry from the website form — the enquiry (name, if you give it, contact and task description) is passed to the personal Telegram bot of Riadov Systems’ owner; the website, the enquiry-forwarding service and the bot itself do not store it or write it to any log — the message in the owner’s chat is kept for 12 months thanks to Telegram’s auto-delete timer, after which it deletes itself.
  • Enquiry from a form in our ads — kept in Meta’s leads center for the periods set by Meta; if it is forwarded to the owner’s personal Telegram bot, the message in the chat is kept for 12 months, like an enquiry from the website form.
  • Queue of deletion requests and other temporary tasks — 30 days after the task is completed; an unfinished request stays in the queue until it is carried out.
  • Cookie banner choice and theme (rs-consent, rs-theme) — in your browser, until you clear the website data.
  • Google and Meta cookies (only after “Accept”) — in your browser: Google Analytics cookies — up to 2 years, Meta cookies — up to 90 days (Cookie Policy, section 2).

Enquiries and correspondence are kept while the communication or order continues and, after that, for as long as necessary to comply with legal and tax obligations and to defend against possible claims.

9. Your rights

Under the GDPR you have the right to:

  • access your personal data and obtain a copy of it
  • request its rectification
  • request its erasure
  • restrict its processing
  • object to processing based on legitimate interest
  • receive your data in a format suitable for transfer (right to data portability)
  • withdraw consent at any time
  • lodge a complaint with a supervisory authority

In the Services, you obtain a copy of your data and delete your account using the commands of the Service’s bot — they are named in the Service’s Policy. The copy also includes your data in Riadov Pay. Deleting the account deletes the account in the bot and in the Dashboard together, cancels an active subscription and deletes payment data, except for records of payments and consents, which remain without a link to your account (section 8). If Riadov Pay is temporarily unavailable, the bot queues the request and completes the deletion automatically.

Send other requests — in particular regarding the website, enquiries and correspondence — to support: support@riadov.systems or Telegram @Riadov_Systems. We reply within one month; in complex cases this period may be extended, and we will inform you of this within that month. To avoid disclosing someone else’s data, we may ask you to confirm that the request is really from you — usually by writing from the same Telegram account or e-mail address.

In Poland, the supervisory authority is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), uodo.gov.pl. You may also contact the supervisory authority of the country where you live or work.

We do not take decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you.

10. Logs

The website keeps request logs (section 3) for the operation and security of the website. The bots of the Services and Riadov Pay keep technical logs of system events: the bot’s logs may contain your Telegram ID; the Riadov Pay logs do not contain personal data. Logs are used solely for the security and stable operation of the website and the Services and for investigating failures.

11. Data security

The controller applies appropriate technical and organisational measures to protect personal data against unauthorised access, loss and destruction. Data is transmitted between the browser and the website, the Dashboard and the Services over the secure HTTPS protocol.

12. Age

The Services are intended for persons aged 18 and over. Persons under 18 must not use the Services.

13. Changes to the Policy

Riadov Systems may change this Policy, in particular when the set of data, recipients or retention periods changes. Each new version has a new number and date, shown below the heading of this page. The current version is always published on this page. We send one notice of a new version in the Service’s bot — with the number and date of the version, a link to its full text and the date from which it applies; you do not need to confirm anything.