Personal Data Processing Policy

Version of September 23, 2026

This is an English translation of the policy published in Russian at https://licenses.the-done.app/legal/ru/personal-data. In case of any discrepancy, the Russian version prevails.

This Policy is published pursuant to Article 18.1(1)(2) and 18.1(2) of Russian Federal Law No. 152-FZ of 27 July 2006 on Personal Data (the "Law") and sets out how personal data is processed and protected.

1. General Provisions

1.1. The personal data operator is SOFTMUS Limited Liability Company (OOO «SOFTMUS»), INN 3900002327, OGRN 1223900010784, address: ul. Minusinskaya, 22, 263, Kaliningrad, Kaliningrad Region, 236005, Russia (the "Operator").

1.2. The Policy applies to all personal data the Operator receives through the websites https://the-done.app and https://licenses.the-done.app, including the Customer Portal (the "Website"), when concluding and performing license agreements for the "Done" software (the "Software"), when the Software is activated and used, and when people contact support.

1.3. Processing is carried out in accordance with the Constitution of the Russian Federation, the Law, Federal Law No. 149-FZ of 27 July 2006 on Information, Information Technologies and Protection of Information, the Civil and Tax Codes of the Russian Federation and other regulations. Terms are used as defined in the Law.

1.4. The Operator follows the principles of lawfulness, purpose limitation and data minimization: only the data necessary for the stated purposes is processed, to the extent and for the time those purposes require.

1.5. Questions about personal data processing and data subject requests are accepted at hello@the-done.app and at the Operator's postal address given in clause 1.1.

2. Data Subjects and Personal Data Processed

2.1. The Operator processes the personal data of the following categories of data subjects.

Buyers and users of licenses (individuals, sole proprietors, representatives of legal entities):

e-mail address;
login and password hash — if sign-in to the Customer Portal with a login and password is enabled;
interface language, Customer Portal sign-in dates;
purchased licenses and license keys, their terms;
payment details: date, amount, currency, method and status of payment, the transaction number in the payment service, discounts applied;
records of acceptance of the offer and consent to personal data processing, with the versions of the documents;
technical data about Software activations: license key, installation identifier, server host name, versions of Nextcloud, the Software and PHP, activation label, IP address from which the activation was made.

Persons contacting support or submitting claims — e-mail address, other contact details and the information provided in the request.

Website visitors — technical data automatically sent by the browser: IP address, browser and device details, date and time of the request, the page requested.

2.2. The Operator does not process special categories of personal data (racial or ethnic origin, political opinions, religious beliefs, health, intimate life) or biometric personal data.

2.3. Bank card details are not transferred to or processed by the Operator: payment data is entered on the secure pages of the Robokassa payment service.

2.4. The Operator is not the operator of the data users keep in the Software in their own Nextcloud installations (employees, projects, working time, finances). Such data is stored on the user's servers, is not transferred to the Operator, and its processing is organized and secured by the user as the operator.

3. Purposes, Legal Grounds and Retention

Purpose	Personal data	Legal ground	Retention
Concluding and performing the license agreement: accepting payment, sending keys, Customer Portal access, providing updates, activating the Software	E-mail, login, licenses, payments and activations	Art. 6(1)(5) of the Law (performance of a contract to which the data subject is a party)	The term of the agreement and 3 years after it ends (limitation period)
Sending receipts, accounting and tax records	E-mail, payment details	Art. 6(1)(2) of the Law, Law 54-FZ, the Tax Code, Law 402-FZ on Accounting	At least 5 years after the end of the reporting year
Handling requests, claims and refund requests	E-mail, content of the request	Art. 6(1)(5) of the Law; consent of a data subject who is not a party to the agreement	3 years from closing the request
Service notifications about the license and account security	E-mail, interface language	Art. 6(1)(5) of the Law	The term of the agreement
Evidence of acceptance of the offer and consents	Versions of documents accepted, date	Art. 6(1)(5) of the Law	The term of the agreement and 3 years after it ends
Keeping the Website running and secure, preventing abuse	IP address, technical request data	Art. 6(1)(7) of the Law (legitimate interest of the Operator)	Up to 12 months

3.1. The Operator does not send marketing e-mails. If it starts doing so, marketing e-mails will only be sent with the data subject's prior separate consent under Article 18 of Federal Law No. 38-FZ of 13 March 2006 on Advertising, with an opt-out in every e-mail.

3.2. When the purposes of processing are achieved or are no longer necessary, personal data is destroyed or anonymized within 30 days, unless another retention period is established by law or contract.

4. Processing Procedure and Conditions

4.1. The Operator processes personal data using automated means, including collection, recording, systematization, accumulation, storage, clarification (updating, changing), retrieval, use, transfer (provision, access), blocking, deletion and destruction. Decisions producing legal effects for a data subject are not made solely on the basis of automated processing.

4.2. The collection, recording, systematization, accumulation, storage, clarification and retrieval of personal data of citizens of the Russian Federation are carried out using databases located in the Russian Federation (Article 18(5) of the Law).

4.3. The Operator transfers personal data to third parties only to the extent necessary for the relevant purpose:

the Robokassa payment service — to process payments and issue receipts: the amount and description of the payment, the e-mail address for the receipt; the service acts as an independent operator of the payer's data;
the hosting provider hosting the Website and the database in the Russian Federation — under a data storage assignment;
the e-mail delivery service — to deliver service e-mails: the recipient's address and the content of the message;
government authorities — in the cases and in the manner prescribed by the laws of the Russian Federation.

4.4. Persons processing personal data on the Operator's behalf undertake to comply with the principles and rules of processing set by the Law and to ensure the confidentiality and security of personal data. The assignment defines the list of actions with the data, the purposes of processing and the protection requirements.

4.5. The Operator does not transfer personal data across borders.

4.6. The Operator does not disseminate personal data, sell it or share it with third parties for marketing purposes.

5. Security Measures

5.1. The Operator takes the legal, organizational and technical measures provided for in Articles 18.1 and 19 of the Law, including:

a person responsible for organizing personal data processing has been appointed; internal regulations on personal data processing and protection have been adopted;
the Website database is encrypted: each record is protected by authenticated encryption, and the encryption key is stored separately from the data;
connections to the Website are protected by HTTPS (TLS); passwords, one-time links and session tokens are stored only as cryptographic hashes;
employees' access to personal data is restricted and role-based according to their duties; actions in the administration panel are logged;
rate limits protect sign-in and payment forms against guessing and abuse;
backups are kept with the same level of protection as the main database;
internal compliance checks are carried out, and the harm that may be caused to data subjects in the event of a violation of the Law is assessed.

5.2. If an unlawful or accidental transfer (provision, dissemination, access) of personal data that violates the rights of data subjects is detected, the Operator notifies Roskomnadzor within 24 hours and of the results of its internal investigation within 72 hours (Article 21(3.1) of the Law).

6. Cookies and Browser Data

6.1. The Website stores in the browser only the data it needs to work: the Customer Portal session token and interface settings (language, theme). This data is not used to track visitors on other websites.

6.2. Third-party web analytics, advertising trackers and third-party cookies are not used on the Website.

6.3. Users can block browser storage in their browser settings; in that case, signing in to the Customer Portal will not be possible.

7. Rights of Data Subjects

7.1. A data subject has the right to:

receive information about the processing of their personal data provided for in Article 14(7) of the Law;
demand that their personal data be clarified, blocked or destroyed if it is incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose;
withdraw consent to processing — for processing based on consent;
appeal the Operator's actions or inaction to the Federal Service for Supervision of Communications, Information Technology and Mass Media (Roskomnadzor) or in court.

7.2. Requests are sent to hello@the-done.app or to the Operator's postal address and must contain the information required by Article 14(3) of the Law: details of the identity document of the data subject or their representative, information confirming the data subject's relationship with the Operator (for example, the e-mail address used for the purchase), and the signature of the data subject or their representative. A request sent from an e-mail address registered with the Operator is deemed to come from the data subject.

7.3. The Operator responds within 10 business days of receiving a request. This period may be extended by no more than 5 business days with a reasoned notice to the data subject.

7.4. When consent is withdrawn, the Operator stops processing and destroys the personal data within 30 days of receiving the withdrawal, except for data whose processing continues on other legal grounds (in particular, storing payment records).

8. Final Provisions

8.1. The Policy is reviewed as necessary, including when the law or the processing procedure changes. A new version takes effect upon publication unless it provides otherwise.

8.2. The current version of the Policy is always available at https://licenses.the-done.app/legal/en/personal-data.

8.3. Other rights and obligations of the Operator and data subjects are determined by the laws of the Russian Federation.

Operator: OOO «SOFTMUS», INN 3900002327, KPP 390001001, OGRN 1223900010784
Address: ul. Minusinskaya, 22, 263, Kaliningrad, Kaliningrad Region, 236005, Russia
E-mail: hello@the-done.app · Phone: +7 950 676-22-39