Effective: March 18, 2026
Individual Entrepreneur Papanov Alexey Sergeevich (OGRNIP 326784700101440, INN 784001770803) is the data controller responsible for processing personal data in connection with the Underflow service, pursuant to Federal Law No. 152-FZ "On Personal Data." Contact: hello@underflow.music.
"Personal Data" — any information relating directly or indirectly to an identified or identifiable individual (data subject) as defined in Art. 3 of Federal Law No. 152-FZ. "Processing" — any action or set of actions performed on personal data, including collection, recording, systematization, accumulation, storage, clarification, extraction, use, transfer, anonymization, blocking, deletion, and destruction. "Operator" — the Service Provider organizing and carrying out the processing of personal data.
Personal data is processed on the following legal grounds (Art. 6, Federal Law No. 152-FZ): consent of the data subject (provided during registration); performance of a contract to which the data subject is a party (the Public Offer Agreement); obligations of the Operator required by Russian legislation (tax and accounting requirements).
We collect and process the following categories of personal data: email address (for account creation, authentication, and service notifications); hashed password (for authentication); IP address and device identifier (for security and fraud prevention); service usage data (search queries, feature usage statistics — for service improvement); device information (OS version, app version — for compatibility and technical support). Payment data (card number, expiration date, CVV) is processed exclusively by the payment service CloudPayments and is not transmitted to the Operator.
Your music collection, wishlists, tags, and preferences are stored in a local SQLite database on your device. This data is not transmitted to our servers and is not subject to processing under this Policy. You retain full control over this data.
Personal data is processed for the following purposes: providing access to the Service and fulfilling the agreement; processing payments and maintaining accounting records; sending service notifications (changes to terms, updates, technical information); improving service quality based on anonymized usage statistics; ensuring security and preventing fraud; complying with Russian legal requirements.
Personal data is processed using automated means and without automated means. Automated processing includes: collection, recording, systematization, storage, clarification, use, anonymization, and destruction of data.
The Operator shares personal data with the following third parties: CloudPayments (JSC CloudPayments, INN 7708806621) — for payment processing; Google LLC — when the User authenticates via Google OAuth (only email is shared). For website analytics, Plausible Analytics is used — a service that does not use cookies and does not process personal data. The Operator does not sell, share, or disclose personal data to third parties for marketing purposes.
The Service's server infrastructure is located in a jurisdiction that ensures adequate protection of data subjects' rights. When using Google OAuth authentication, data may be transferred to the United States in accordance with Art. 12 of Federal Law No. 152-FZ.
Pursuant to Art. 14–17 of Federal Law No. 152-FZ, you have the right to: obtain information about the processing of your personal data; request correction, blocking, or destruction of personal data if it is incomplete, outdated, inaccurate, unlawfully obtained, or unnecessary for the stated processing purpose; withdraw consent for data processing; file a complaint with Roskomnadzor (https://rkn.gov.ru) or in court; export your local database at any time. To exercise your rights, send a request to hello@underflow.music. Response time: 30 calendar days.
The Operator implements necessary and sufficient organizational and technical measures to protect personal data from unauthorized access, destruction, modification, blocking, copying, distribution, and other unlawful actions: encryption of data transmission channels (HTTPS/TLS); password hashing using modern algorithms; restricted access to personal data; regular server software updates. In the event of an unauthorized or accidental personal data breach, the Operator shall notify the supervisory authority (Roskomnadzor) within 24 hours and the affected data subjects within 72 hours, in accordance with Art. 21(3.1) of Federal Law No. 152-FZ.
Personal data is retained for the duration of the User's account. Upon account deletion, personal data is destroyed within 30 calendar days, except for data whose retention is required by tax or other legislation (retention period — as required by law). Upon withdrawal of consent for processing, the Operator ceases processing and destroys data within 30 days, unless other legal grounds for processing exist.
The website https://underflow.music does not use cookies to track Users. Plausible Analytics is used for analytics — a service that operates without cookies and without collecting personal data. The Underflow application uses local storage (localStorage) on the User's device exclusively for saving settings and authorization sessions.
The Operator reserves the right to amend this Policy. The new version takes effect upon publication at https://underflow.music/privacy.html unless otherwise specified. The User is responsible for monitoring changes. Continued use of the Service constitutes acceptance of the updated Policy.
Individual Entrepreneur Papanov Alexey Sergeevich
OGRNIP: 326784700101440
INN: 784001770803
Email for personal data inquiries: hello@underflow.music
Supervisory authority: Roskomnadzor (https://rkn.gov.ru)