reportkey
reportkey

Personal Data Processing Policy

This English translation is provided for convenience. The authoritative version is the Russian original available at /rules.php.

Revision date: 2026-03-31

This Personal Data Processing Policy defines the procedure for processing and protecting the personal data of users of the Reportkey service hosted on the sites reportkey.net, reportkey.ru, their subdomains, and related user domains.

1. Personal Data Operator

Operator: Individual Entrepreneur Pavel Alekseevich Maltsev.

INN: 662332553857. OGRNIP: 309662307500044.

Contact for personal data processing matters: info@reportkey.net.

2. What data is processed

The operator may process the following categories of personal data:

  • email address;
  • phone number, if the user provides it in the service interface or payment data;
  • account and project identifiers in the service;
  • IP address, user agent, technical authorization and security events;
  • data on payments, tariffs, balance, and issued invoices;
  • email addresses of recipients of guest reports and other materials sent by the user;
  • cookies and local device identifiers required for the site and analytics to function;
  • data that the user connects from external advertising, analytics, and marketing systems as part of using the service.

3. Purposes of processing

  • user registration and execution of the user agreement;
  • providing access to the personal account, reports, and integrations;
  • processing payments, refunds, accounting, and tax operations;
  • technical support, error diagnostics, account protection, and abuse prevention;
  • sending service emails, notifications, confirmation links, and guest reports;
  • analytics of site usage, marketing communications, and service improvement;
  • compliance with obligations established by the legislation of the Russian Federation.

4. Legal bases for processing

  • conclusion and execution of the user agreement and other contracts with the user;
  • consent of the personal data subject, expressed during registration, submission of a form, or continued use of the site to the extent permitted by the applicable cookie notice model;
  • performance of operator obligations established by the legislation of the Russian Federation.

5. Sources of data

Personal data is received directly from the user upon registration, payment, form submission, integration setup, work with reports, and use of the site, as well as from external systems connected by the user and from technical service logs.

6. Transfer of data to third parties and processors

To operate the service, the operator uses third-party services and infrastructure that may receive personal data or technical identifiers to the extent necessary to perform their function:

  • Yandex Metrika for web analytics;
  • VK retargeting for the operator's marketing campaigns;
  • Carrot quest for CRM, messaging, and communication automation;
  • Dadata for form hints and data validation;
  • hosting providers, data centers, email and payment services that support Reportkey.

7. Cookies, analytics, and marketing tools

The site uses cookies, web analytics, and marketing tools. This is necessary for authorization, account protection, preservation of language and technical settings, identification of the traffic source, interface improvement, and evaluation of the effectiveness of advertising campaigns.

The site may use:

  • session/auth cookies for account login and session protection;
  • identifiers of analytics systems, including Yandex Metrika and other services connected by the operator.

Account access and external sign-in

A new user may enter the Reportkey cabinet before email confirmation. Until the email is confirmed, external sharing, guest links, scheduled delivery, exports outside the authenticated cabinet, API tokens, and account-control actions remain locked. Private setup, payment, and report preparation remain available.

Reportkey supports email and password, Yandex ID, and VK ID as sign-in methods. External sign-in identities are stored separately from datasource integrations and do not replace, overwrite, or delete tokens used to collect data and generate reports.

When a sign-in provider returns profile data, Reportkey may store an email snapshot, stable provider identifier, provider login, first name, last name, display name, avatar link, contact phone snapshot, and sanitized provider metadata. Provider contact phone is contact data only and is not used as ownership proof, recovery proof, merge proof, or step-up proof.

Authentication audit events may include event type and result, masked email, provider name, provider subject hash, IP address, device-cookie state, user-agent class, and sanitized technical metadata. Raw OAuth tokens, authorization codes, provider secrets, and passwords are not stored in auth identity or auth audit records.

If a provider email matches an existing Reportkey account, accounts are not merged automatically. Reportkey requires proof for the exact existing account, such as password sign-in, a confirmation link sent to the matched email, or an already authenticated active session for that account.

8. Actions with personal data

The operator has the right to collect, record, systematize, accumulate, store, clarify, extract, use, transfer to a limited circle of processors, anonymize, block, delete, and destroy personal data.

9. Storage periods

Personal data is stored no longer than required by the processing purposes or the legislation of the Russian Federation.

  • account and project data is stored during the term of the relationship with the user and thereafter within the periods required to comply with the law, protect the operator's rights, and resolve disputes;
  • security and technical diagnostic logs are stored for a period reasonably necessary for incident investigation and security;
  • payment data and accounting documents are stored within the periods established by applicable law;
  • after the processing purposes are achieved, the data is subject to deletion, anonymization, or blocking, unless otherwise provided by law.

10. Rights of the personal data subject

The user has the right to:

  • obtain information about the processing of his or her personal data;
  • require clarification, blocking, or deletion of the data if it is incomplete, outdated, inaccurate, or processed unlawfully;
  • withdraw consent to the processing of personal data in applicable cases;
  • require the cessation of processing if there are no other legal grounds for its continuation;
  • send a request to the operator at info@reportkey.net.

The request must allow identification of the user and describe the requirement in substance. The operator reviews requests and responds within the time limits established by the legislation of the Russian Federation.

11. Protection measures

The operator takes legal, organizational, and technical measures to protect personal data, including access separation, session protection, logging of security events, backup, control of access to infrastructure, and monitoring of technical errors.

12. Changes to the policy

The operator has the right to update this Policy. The current version is posted on this page. Continued use of the site after the publication of a new version means that the user has familiarized himself or herself with the updated Policy to the extent that it does not contradict the legislation of the Russian Federation.