Personal data processing policy
1. Operator and contact
The operator is Danil Ivanovich Patlasov, taxpayer number (INN) 590321596410. Questions about data processing and requests for access, correction, restriction of processing and deletion: help@getonda.ru. Describing the request and giving a way to reply is enough; do not send passwords, sign-in codes or API keys.
2. Website visitor data
When the website is opened, the server receives the IP address, the requested resource, the time, browser information and technical headers. This is needed to deliver the page, for protection and for diagnostics. Emails contain the sender's address, the text and any files the sender attached; they are used to answer and resolve the question.
The website does not ask for payment data. The only form on the website is the waitlist (section 3); other support links open your email program, and a message is sent only by your own action. When you go to the app, the account rules below apply.
3. Waitlist
The “Waitlist” form on getonda.ru processes your email address, optionally your Telegram username, the time and revision of your consent, and the time the address was confirmed and the letter sent. The data is processed with your consent, given by ticking the box in the form, and only for two purposes: to send a letter with a link to confirm the address, and to write once when plan sales open. The Telegram username is only stored with the address: no Telegram messages are sent for the waitlist.
Letters are delivered by SMTP.bz and, when it is unavailable, by Yandex Cloud Postbox. Unconfirmed addresses are deleted after 7 days. Confirmed addresses are kept until you unsubscribe through the link in the letter or withdraw consent with a deletion request to help@getonda.ru: in both cases the waitlist record is deleted completely and no more letters are sent. Deleting an app account also deletes the waitlist record with the same address.
4. App account
For registration and sign-in, the service processes your email, the fact that it was confirmed, and records of consent, sessions, sign-in attempts and access restrictions. To run the service, it processes the accounts you chose, projects, notes, marks, operation history, plan, payment information and limit usage. Personal API keys are stored as hashes; passwords for email or social networks are never requested. If a user connected the Telegram digest before it was turned off, the chat_id they gave may remain in the database; new connections and sending user messages are currently turned off.
Processing is needed to create and maintain the account, carry out user requests, control access, protect against abuse and provide support. When a sign-in code is requested, separate consent to personal data processing is requested. Performance of a paid contract and mandatory legal requirements are the legal grounds where they apply; consent to website statistics is not a condition for using the app.
5. Publications from public sources
For public accounts chosen by users, the service receives account names, avatars, texts, metrics, links and available media of publications. Some publications and their media are saved in a shared corpus and archive, while notes and projects belong to a specific user.
Public availability does not cancel the rights of authors and data subjects. If your materials or data are in the service and you want to dispute the processing, write to the operator with links and the substance of your request. To protect against a request made by someone else, confirmation of your relation to the account or material may be required. The request is considered on its merits within the time limits set by law.
The home page shows images of the interface with sample publications and accounts. Requests about these materials are accepted at the same address.
6. Analytics and cookie choice
Yandex Metrica loads only after you click “Accept” in the analytics settings. Before you choose and after you decline, the website sends no requests to Metrica. You can use the website without analytics. Your choice is stored locally in the browser under the key onda-analytics-consent-v1. If persistent storage is unavailable, the choice is kept for navigation in the current tab through sessionStorage; if neither storage is available, it applies only to the current page.
With your consent, Metrica may process the IP address, browser and device characteristics, browser identifiers in cookies and localStorage, page visits and events: going to plans, going to sign-in, successfully copying a prompt. Onda does not pass email, codes, API keys, user notes or project names in goal parameters. The page address is sent without the fragment and without the query string, except for campaign tags (utm_source, utm_medium, utm_campaign, utm_content, utm_term), which show which of our links brought the visitor. Metrica receives the domain of the website from which you came to getonda.ru (for example, https://yandex.ru/), without the path and query string; it uses it to tell search visits from direct visits. Session recording, click maps and automatic link and form tracking are not turned on.
The “Analytics settings” button at the bottom of the page lets you change your choice. When you decline, the counter is turned off and the Metrica first-party cookies the website can reach are deleted; data already sent is not withdrawn from the recipient by this action. Cookies on third-party domains can be deleted with your browser. The recipient's rules: Yandex privacy policy.
Separately from Metrica, the website itself records where a visitor came from. When a getonda.ru page is opened, the server uses the referring address passed by the browser and the tags in the page address (for example, utm) to determine the type of source: Yandex search, Google search, another search engine, a link from another website or a direct visit. The onda_src cookie stores the source type, the landing page and the date, for the first visit and for the last non-direct visit. For a visit through a link, the cookie also stores its campaign tag. The source website address, the search query, other tag values, identifiers and browsing history are not written to the cookie. The cookie is set for all visitors and does not depend on the analytics choice. It is kept for 30 days from the first visit, is available to getonda.ru and its subdomains, and is deleted with your browser. If you register in the app within this period, this information is saved in the account together with the answer to the optional question “How did you hear about Onda?”, which the app asks after the first sign-in. It is used only for acquisition channel statistics, is not passed to third parties and is deleted together with the account.
The app uses a separate necessary session cookie for sign-in. This counter is not embedded in the personal account. The analytics choice on the landing page does not control the app session.
7. Who takes part in processing
- Hosting and storage infrastructure run the server, the database and the archive. The main server is hosted by HOSTKEY in Moscow; archived media are stored separately in object storage. Encrypted backups are stored in Timeweb Cloud object storage in Russia; the storage has no decryption key.
- YooKassa, a service of NCO YooMoney LLC (OGRN 1127711000031, INN 7750005725), accepts plan payments. To create a payment, Onda passes it the amount, a description of the plan being paid for and an internal order number containing the account identifier; Onda does not pass it the email address. Payments through Prodamus stopped on 30 September 2026; before that date Prodamus received, for the payment link, the account email address, an order number with the account identifier, the selected offer and the price.
- SMTP.bz, a service of individual entrepreneur A. M. Tutaeva, delivers sign-in code letters, plan letters and waitlist letters and receives the recipient's address and the letter content for this. If SMTP.bz does not accept a letter, Yandex Cloud Postbox delivers it and receives the same information.
- Yandex Metrica receives statistics only after the visitor's consent.
- Social platform data providers receive requests for the selected public accounts and publications. The current configuration uses ScraperTech (including under its former name ScraperTag in the code), YouTube Data API, Apify, TikHub and RapidAPI.
- When speech recognition is requested, the video or audio content is processed by Deepgram. Automatic classification of publication captions uses the Jev model through the TypeSafe direct API; YouTube publications are not passed to this layer.
Connecting a chat agent over MCP
Only after your permission through OAuth can the application you chose access Onda on your behalf. The read permission allows it to receive information about your plan and usage, project names, tracked accounts, hits, publication captions, metrics, links, your marks and notes, and finished transcripts. The spending permission separately allows collections and speech recognition within your plan. The purpose of the transfer is to perform the task you chose in the chat, not to give the application all of the user's data.
The explicit parameters of a tool call and its response are passed to the application you connected to Onda yourself (for example, ChatGPT, Claude, Cursor or another MCP client) and to the company that provides that application. It processes the data it receives under its own terms and privacy policy. Data may be transferred outside Russia; connect only an application whose terms you accept. If Onda does not know the application, the permission screen warns that Onda has not checked it and shows the address the response will go to. Mentioning applications does not mean that Onda is published in their directories.
For an explicitly requested collection, the identifier of the public source is passed to the data providers listed above; for an explicitly requested transcript, the media content is passed to Deepgram, as when working through the app or the HTTP API. Reading saved data does not by itself start a collection or speech recognition. Onda does not receive the full chat and does not use tool calls for separate model training.
You can revoke the connection in the app: «Настройки» (Settings) → «Подключённые приложения» (Connected applications) → «Отозвать доступ» (Revoke access). Revoking stops future access but does not delete responses already sent from the chat history: use the chosen platform's tools for that. Deleting an Onda user deletes their connections and stops further access; a request to delete Onda data can be sent to the operator at the address above.
For a tool call, the Onda log stores the type of action, the tracked account or transcription job number if the action concerns one, the time, the result, the duration and the counted usage, but not the other tool parameters, caption texts, transcripts, notes or OAuth tokens. This is needed for access control, usage accounting and diagnostics. The api_requests log is kept under the 90-day rule described in section 8; this is not the period for which an external platform keeps chat history.
Some of the technology services named here are foreign. Therefore no promise is made that all materials are processed exclusively in Russia. The analytics choice on the landing page is not consent to every data transfer inside the app.
Payment takes place on the YooKassa page. Card data and other payment details are entered there; Onda neither receives nor stores them. After payment, YooKassa sends Onda a notification, and Onda requests the payment information from YooKassa: the payment number, its status, the amount, the order number and the payment time, which are needed to match the payment to the account. Until 30 September 2026, payment took place on the Prodamus form, and information about those payments is kept on the same terms. Payment information is kept to grant access, for refunds and for obligations set by law. Onda does not ask for bank card details in emails or in the personal account.
8. Retention and deletion
The end of a plan does not trigger automatic deletion of the account, projects, notes and publications. A request to stop processing or to delete data is sent to the operator; it is considered with regard to the purpose of processing and the obligations set by law. If the law requires certain information to be kept, the operator says so in the reply. Data is not kept longer than the purposes of processing require.
API request history older than 90 days is cleared when the service starts. Expired sessions, outdated sign-in attempts, unconfirmed registrations and unconfirmed waitlist addresses older than 7 days are also cleared during maintenance. These periods do not mean that all technical server logs are deleted automatically at the same moment.
Service measurements of the YouTube feed older than 30 days are deleted when the service starts; this does not describe the retention period of the whole corpus and archive. Saved media have no general automatic age-based cleanup. Deleting an account does not by itself remove a public publication from the shared corpus if it also relates to other users; a demand to delete the material itself is considered separately.
A backup of the service database and settings is made every hour and before every update. The copy is encrypted before it is sent and is kept with a Russian object storage provider: hourly copies for two days, daily copies and copies made before an update for up to 30 days. Deleted information may remain in earlier copies until this period ends. The copies are for restoring the service, not for ordinary use of the data.
9. Rights and protection
You can request information about processing, correction, blocking or deletion of data, withdraw consent and appeal the operator's actions to the competent authority or a court. To fulfil a request, the operator may check that the applicant relates to the account concerned. If an account cannot work without certain data, stopping its processing stops the corresponding function; declining website analytics does not limit it.
HTTPS is used for transfer, access to administrative functions is restricted by authorization, and secrets are not published in client code. These measures are not a promise of absolute security.
10. Changes to the policy
The current published revision is available at getonda.ru/privacy. When the purposes or scope of processing change, the operator updates the document and asks for new consent where required. Simply continuing to visit the website is not considered clicking the analytics consent button.