Version dated 5 September 2026.
This Policy defines the procedure for processing personal data of users of the PersAI service and other individuals whose data is received by the controller in connection with the use of the website, applications, the PersAI Browser Bridge browser extension, feedback forms, payments, support, and other service-related processes.
1. Data Controller
The personal data controller is:
- Individual Entrepreneur Karnaukh Alexey Sergeevich
- Tax ID (INN): 615010297306
- Primary State Registration Number for Individual Entrepreneurs (OGRNIP): 317619600160244
- Location: Rostov Region, Rostov-on-Don, Russian Federation
- Email for personal data inquiries: support@persai.dev
The controller publishes this Policy and ensures unrestricted access to it on the pages where personal data is collected.
2. Categories of Data Subjects
The controller may process personal data of the following categories of data subjects:
- PersAI users and account holders;
- users of the PersAI Browser Bridge browser extension;
- persons contacting support, legal, and privacy channels;
- representatives of clients, partners, and counterparties;
- recipients of informational and marketing messages, where separate consent is required.
3. What Data May Be Processed
Depending on the PersAI usage scenario, the following data may be processed:
- identification and profile data: first name, last name, email, language, country, account identifiers;
- service usage data: login history, tariff information, subscription status, limits, and in-app actions;
- user content: messages, files, documents, media, memory notes, prompts, and generated results;
- browser-bridge data, when the user has installed PersAI Browser Bridge and allowed access to a site: page URL, page title, visible page text / DOM snapshot, interactive element labels, a screenshot of the visible tab, and a local device / browser-session identifier;
- technical data: IP address, cookies, session ID, user agent, device information, security logs, diagnostic events;
- payment and billing data: payment status, payment identifiers, tariff data, transaction history, but not full bank card details where such details are processed by a payment provider;
- communication data: support request content, emails, responses, attachments, and message delivery metadata.
Special categories of personal data and biometric personal data must not be submitted to PersAI unless expressly provided for by a separate written agreement or mandatory law.
The extension does not export browser cookies or saved logins. Cookies and logins remain in the user's Chrome profile / session window.
4. Purposes and Legal Grounds for Processing
| Purpose of Processing | Categories of Data | Legal Basis |
|---|---|---|
| Registration, account login, and access administration | name, email, account identifiers, technical data | conclusion and performance of a contract, actions initiated by the data subject |
| Providing PersAI features: chat, memory, files, documents, media generation, integrations | user content, profile and technical data | performance of a contract, legitimate interest in operating the service |
| Operating PersAI Browser Bridge so the assistant can read and act on a site the user has allowed | browser-bridge data, user content, technical data | performance of a contract, actions initiated by the data subject |
| Payment, subscription, accounting, and tax records | payment identifiers, tariff information, contact details | performance of a contract, compliance with legal obligations |
| Support, handling requests, claims, and personal data subject requests | contact details, correspondence, related technical data | performance of a contract, compliance with legal obligations |
| Informational and marketing messages | email, subscription identifiers, and communication preferences | separate consent of the data subject where required |
| Security, abuse prevention, and incident investigation | technical data, event logs, account identifiers | controller’s legitimate interest, compliance with legal obligations |
5. Methods and Principles of Processing
The controller may collect, record, systematize, accumulate, store, clarify, extract, use, transfer, anonymize, block, delete, and destroy personal data, both by automated means and without the use of automation.
The controller processes only the data necessary to achieve the stated purposes and does not permit excessive processing.
6. Use of Cookies and Technical Identifiers
PersAI uses cookies and similar technical identifiers for:
- user authentication and session maintenance;
- saving interface settings, including language and country;
- abuse prevention, security, and service stability;
- correct request routing and result delivery.
The PersAI Browser Bridge extension stores a local device / session mapping in the browser's local extension storage on the user's computer. This mapping is not a website cookie and is not an export of the browser cookie jar.
If separate consent is required for certain types of analytics, marketing, or advertising technologies, such consent must be requested separately. The extension does not collect analytics or advertising identifiers.
7. Transfer of Data to Third Parties and Processing by Order
For PersAI to operate, the controller may transfer personal data to or entrust processing to third parties to the extent necessary to achieve the processing purposes, including:
- identification and authorization providers, including Clerk;
- payment providers, including CloudPayments;
- email and notification delivery services, including Postmark;
- AI and document providers, including OpenAI, Anthropic, Gamma, and PDFMonkey;
- cloud and infrastructure providers, including storage and computing services.
Page snapshots, screenshots, and browser-action results collected by PersAI Browser Bridge are first transferred only to PersAI (the signed-in persai.dev web application and the PersAI backend). The extension does not send that data directly to the providers listed above. Once stored as user content of the PersAI account, the same processors may process it to the extent technically necessary to fulfill the assistant request.
The controller requires such parties to maintain confidentiality and security and to process data only within the agreed scope and for the specified purposes.
PersAI does not sell personal data.
8. Cross-Border Transfer of Personal Data
When certain technology providers are used, some data may be processed or stored outside the Russian Federation. If cross-border transfer of personal data is required to fulfill a user request, operate an integration, generate an AI result, or deliver a document, the controller carries out such transfer on lawful grounds and in compliance with applicable legal requirements.
By uploading content to PersAI and initiating the relevant function, including a browser action through PersAI Browser Bridge, the user understands that some data may be processed by such providers to the extent technically necessary to fulfill the request.
9. Retention Periods
Personal data is retained no longer than required for the purposes of processing and mandatory legal retention periods.
General retention guidelines:
- account data and usage history — for the duration of the account and a reasonable period after closure for rights protection, security, and dispute resolution;
- browser-bridge page snapshots, screenshots, and action results stored as PersAI user content — under the same rules as other user content of the account;
- local extension storage (device / session mapping) — on the user's computer until the mapping is cleared or the extension is uninstalled;
- payment and accounting data — for the periods established by the laws of the Russian Federation;
- support requests and legally significant correspondence — for the duration of request handling and thereafter within limitation periods or other mandatory periods;
- data for marketing messages — until consent is withdrawn or the relevant processing purpose ends;
- technical logs and security events — for the period necessary to ensure protection and service stability.
Once the purposes of processing are achieved, or other lawful grounds arise, the data is to be deleted, anonymized, or destroyed if further retention is not required by law.
Uninstalling the extension deletes the local device / session mapping. It does not by itself delete PersAI account content already stored on PersAI servers.
10. Personal Data Protection Measures
The controller takes the legal, organizational, and technical measures necessary and sufficient to protect personal data, including:
- access control and role-based restrictions;
- authentication and account protection measures;
- logging of access events and administrator actions;
- backup, secure transmission channels, and incident monitoring;
- contractual and organizational measures when engaging providers and contractors.
11. Rights of the Data Subject
The data subject has the right to:
- receive information about the processing of their personal data;
- request correction, blocking, or deletion of data if it is incomplete, outdated, inaccurate, unlawfully obtained, or no longer necessary for the stated purpose;
- withdraw consent to personal data processing in cases where processing is based on consent;
- opt out of marketing and promotional messages;
- appeal the controller’s actions or omissions to the competent authority or a court.
The user may deny or revoke a site-access permission granted to PersAI Browser Bridge in Chrome. Denying site access stops new collection from that site. It does not delete data already stored in the PersAI account.
12. How to Submit Requests
To exercise their rights, the data subject may send a request to support@persai.dev. The request should preferably include:
- full name or other information allowing identification of the requester;
- the email address of the account or another identifier linked to the request;
- the substance of the request;
- a reply contact address.
The controller may request reasonable additional information to verify the requester’s identity and protect data from unlawful disclosure.
13. Changes to the Policy
The controller may amend this Policy. The current version takes effect upon publication on the website unless a different effective date is stated in the Policy itself.
14. PersAI Browser Bridge (Chrome extension)
This section applies specifically to the PersAI Browser Bridge browser extension. It supplements the rest of this Policy and is the disclosure of collection, processing, storage, and transfer of user data for that extension.
Collection
The extension may collect data only when the user is signed in to PersAI and the assistant requests a browser action on a website for which the user has granted access:
- page URL;
- page title;
- visible page text / DOM snapshot;
- interactive element labels;
- a screenshot of the visible tab;
- a local device / browser-session identifier and window/tab mapping needed to reuse the same session window on this computer.
The extension does not collect analytics, advertising identifiers, or payment-card data. Browser cookies and saved logins remain in the user's Chrome profile / session window and are not collected, copied, or exported by the extension.
Site access is requested per origin at the time of use through Chrome permission prompts and in-product disclosure. The extension does not receive access to all websites at installation.
Processing
Collected page data is processed solely so the user's PersAI assistant can read and act on the allowed page (snapshot, navigation, and in-page actions the user has permitted). Local identifiers are processed only to keep one browser session on this device.
The extension does not load remote code. It runs only the files shipped in the installed package.
Storage
- On the user's computer, in the browser's local extension storage (
chrome.storage.local): device / session mapping and session-window state. This store is not a cookie jar and is not uploaded as cookies. - On PersAI servers: page snapshots, screenshots, and action results are stored as ordinary user content of the user's PersAI account (chat / turn data), under the retention rules in section 9.
Transfer
Page data and screenshots are transferred only to PersAI: the signed-in persai.dev web application and the PersAI backend. The extension does not sell this data and does not transfer it to unrelated third parties.
After the data is stored as PersAI user content, the processors listed in section 7 may process it to the extent technically necessary to fulfill the assistant request, including AI providers. The extension itself does not send data to those providers.
In-product disclosures and Chrome permission prompts state that site access is optional and requested per site.