Personal Data Processing Policy

1.1. This Personal Data Processing Policy (hereinafter referred to as the "Policy") defines the procedures for processing and protecting personal data of users of the "Tonus" service (hereinafter referred to as the "Service"), available at tonusmeal.ru and via the Telegram bot @tonusmealbot.

1.2. The personal data operator is HYPERSTACK LLC (OGRN 1267700054181, INN 9728169930, address: 117335, Moscow, Nakhimovsky Prospekt, 63, bldg. 1, apt. 29), hereinafter referred to as the "Operator".

1.3. This Policy has been developed in accordance with Federal Law No. 152-FZ dated July 27, 2006 "On Personal Data" (hereinafter referred to as FZ-152).

1.4. This Policy describes the processing and is not itself a consent. The user gives consent to personal data processing in a separate document — the Consent to Personal Data Processing — by a separate checkbox at registration. Consent to the processing of health data is given separately from it (Section 8).

1.5. The person responsible for organizing personal data processing is the General Director of the Operator. For questions regarding personal data processing, please contact: support@tonusmeal.ru.

2.1. The Operator processes the following categories of personal data:

3.1. Personal data is processed for the following purposes:

4.1. Personal data is processed on the following legal grounds:

• Consent of the data subject (clause 1, part 1, Article 6 of FZ-152)
• Performance of a contract to which the data subject is a party (clause 5, part 1, Article 6 of FZ-152)

4.2. Processing of special categories of personal data (health data, physical parameters, allergies, wearable device data) is carried out based on the written consent of the data subject (clause 1, part 2, Article 10 of FZ-152).

5.1. Personal data is processed using the following methods:

• Collection, recording, systematization, accumulation, storage
• Clarification (updating, modification)
• Extraction, use, transfer (provision, access)
• Anonymization, blocking, deletion, destruction

5.2. Processing is carried out using automated means.

5.3. Personal data is stored in encrypted form on secure servers located in the Russian Federation.

6.1. The Operator does not sell or transfer personal data to third parties for commercial purposes.

6.2. Personal data may be transferred to the following categories of recipients solely for the purposes of Service operation:

6.3. Personal data may be provided to government authorities in cases provided for by the legislation of the Russian Federation.

6.4. The extension performs search queries and cart actions on delivery service websites within the user's own session. These services receive them as the user's own actions and process them under their own rules. The Operator does not transfer the user's personal data to delivery services.

Important: The Service does not make purchases on behalf of the user. Bank card data is not collected or stored by the Operator.

7.1. In the course of Service operation, personal data may be transferred to foreign jurisdictions in the following cases:

7.2. Primary processing and storage of all personal data of Russian Federation citizens is carried out on servers located in the Russian Federation, in accordance with part 5, Article 18 of FZ-152.

7.3. Cross-border transfer is carried out only to countries that ensure adequate protection of personal data subjects' rights, or with the consent of the data subject.

8.1. Special categories of personal data processed by the Service include: health information (height, weight, allergies, dietary restrictions), physical activity and sleep data from wearable devices.

8.6. Health data storage: Activity, sleep, workout, and body composition data is stored on the Operator's secure servers in the Russian Federation. When a wearable device is disconnected or an account is deleted, the accumulated data is deleted within 30 days; when consent is withdrawn, immediately (clauses 12.3, 12.4).

8.7. Withdrawal of consent: The user may stop the processing of health data at any time by:

• Withdrawing consent for processing special categories of personal data in the Service settings
• Disconnecting the device in the Service settings
• Revoking permissions in Apple Health or Health Connect settings on the device
• Uninstalling the "Tonus Health Sync" app

9.1. The Service is not intended for independent use by persons under 14 years of age.

9.2. Data of minor family members (name, date of birth, height, weight, allergies, nutrition preferences) is entered by the parent user (legal representative) within the "Family" feature.

9.3. By entering data of minors, the user confirms that they are the legal representative of said person and gives consent to the processing of their personal data for the purposes specified in Section 3 of this Policy.

9.4. The legal representative may at any time request deletion of the minor's personal data by contacting support@tonusmeal.ru.

10.1. The Operator takes necessary organizational and technical measures to protect personal data from unauthorized or accidental access, destruction, modification, blocking, copying, or distribution.

10.2. Protection measures include:

• Data encryption during transmission and storage (TLS 1.2+)
• Restricted access to personal data
• Use of secure communication channels
• Regular data backups
• Storage of all personal data on servers located in the Russian Federation

10.3. When the mobile app is used, biometric data (Face ID / Touch ID) is processed exclusively on the user's device through iOS Secure Enclave (Apple) or Android StrongBox. The Service receives only a binary "access granted / denied" outcome and never has access to the biometric templates themselves. Biometric data is never transmitted to Tonus servers and never leaves the user's device.

11.1. The user has the right to:

• Obtain information about the processing of their personal data (Article 14 of FZ-152)
• Request clarification, blocking, or destruction of personal data (Article 14 of FZ-152)
• Withdraw consent to personal data processing (part 2, Article 9 of FZ-152)
• Withdraw consent to processing of special categories of personal data separately from general consent
• Delete their account and all associated data
• Appeal the Operator's actions to Roskomnadzor or through judicial proceedings

11.2. To exercise their rights, the user may:

• Use the account deletion command in the Telegram bot
• Manage consents in the personal account settings on the website
• Disconnect a device in the Service settings
• Contact support: support@tonusmeal.ru

12.1. Personal data is processed until:

• The user deletes their account
• Consent to processing is withdrawn
• The purposes of processing are achieved

12.2. Upon account deletion, personal data is destroyed within 30 days.

12.3. Upon withdrawal of consent to process special categories of personal data, health data is destroyed within 30 days. The general account and other personal data are retained.

12.4. When the user disconnects a wearable device (or the device provider revokes access), accumulated activity, sleep, workout and body composition data is automatically deleted after 30 days. Reconnecting within this period keeps the accumulated history.

12.5. Quality improvement program materials (clause 14.7): the store page code and screenshot are kept for 30 days, the text description of the failure for 180 days, and the network request log for 30 days. After consent is withdrawn, no new materials are collected, and collected ones are deleted when these periods expire.

12.6. Search results from delivery services, delivery terms and the extension's step log are kept together with the order history until the account is deleted.

12.7. Uploaded receipts — the file and the recognized lines — are kept until the user deletes the receipt or the account.

13.1. The Service website uses cookies and browser local storage for signing in to the personal account and saving user preferences.

13.2. Delivery service cookies remain in the user's browser. The Operator neither receives nor stores them: the extension uses the already open session the same way the browser itself does (Section 14).

14.1. The extension is installed voluntarily by the user. While the browser holds a valid token received from the personal account (clause 14.9), the extension polls the Operator for tasks every thirty seconds and carries them out, including when the personal account page is closed. Tasks arise only from actions of members of the user's account: placing an order, recalculating it, or checking sign-in to a delivery service.

14.2. The extension runs only on the delivery service websites listed in its manifest and on tonusmeal.ru; it does not run on other websites. To do its work it opens store pages in its own tabs and windows and closes them when the task is finished. While working, it blocks images, video, fonts, and third-party analytics and ads on those pages. The extension injects its own scripts into delivery service pages: they read search results and the cart, press buttons, and watch the store server's responses to cart actions. For some stores the scripts also tell the page that it is visible on screen and decline its geolocation request.

14.3. The extension acts in the user's delivery service account, within their already open session:

• searches for items from the shopping list;
• empties the store cart before assembling it and before calculating delivery terms — including items the user put there themselves;
• adds the items of the cart chosen in the Service, and, to calculate delivery terms, an inexpensive auxiliary item that may remain in the cart until the next assembly;
• selects a delivery slot, method or mode to find out its cost and timing.

The extension does not place or pay for orders and does not change account details, the delivery address or payment methods in the delivery service. The user places the order.

14.4. The following data is transmitted to the Operator by the extension:

• search queries derived from the user's shopping list;
• product card data from store search result pages: name, price and what it is quoted for, weight or volume, availability, product link;
• cart totals and delivery terms: goods total, discount, assembly and delivery fees, minimum order amount, free delivery threshold, delivery time or slot, and the store's own words if it declined (closed, item unavailable, delivery paused);
• the outcome of adding items to the cart: what was added and in what quantity;
• sign-in status in the delivery service for this browser (signed in, signed out, delivery address required);
• the task step log: step name, duration, outcome, the section of the store website and the reason for failure — without page contents;
• the browser data listed in Section 2: installation identifier, operating system, browser, extension version, computer name.

The Operator does not disclose this data to third parties beyond the cases listed in Section 6.

14.5. When the user presses the check button in the Delivery services section, the extension reads the user's store profile: name, delivery address and loyalty card number. This is shown to the user so they can see which address and card the store prices against. It is passed only to the open personal account page in the same browser and kept in its local storage (localStorage); it is never sent to the Operator's servers.

14.6. The extension does not read or transmit to the Operator any logins, passwords, payment details, browsing history, or content of websites unrelated to delivery services. At the user's request, the extension may read the user's purchase history in a delivery service to build a map of the user's preferences. Delivery service cookies are not transmitted to the Operator; to search for products, the extension may use certain service identifiers that the delivery service keeps in the user's browser — only in requests to that same service. Authentication in a store remains between the user and the store.

14.7. Quality improvement program. Applies only to an account whose owner or administrator has consented to it in the privacy settings of the personal account. Consent covers the browsers of all account members, and any member may withdraw it. Under the program, the Operator additionally receives:

• when a step fails during a run that an account member started in “with evidence” mode — the store page code and a screenshot before the action and after the failure, together with the tab visibility state. Name, address, phone, email, card number and coordinates are redacted in the browser before sending;
• the number of elements matched by each extension selector and an anonymized fingerprint of the page markup — without its content;
• if enabled by support — a log of the store page's network requests: type, method, address, response code and timing, without request bodies, headers or cookies. Personal address parameters (phone, email, tokens, coordinates) are redacted.

Redaction is automatic and may be incomplete; participation is therefore voluntary, and declining it does not affect the Service. Retention periods are set out in clause 12.5.

14.8. In an account with several members, the list of delivery services and the browser that executes orders are account settings. An order of any member may be executed by another member's browser, in that member's delivery service accounts, with their delivery address and loyalty card. A member can opt out by choosing another browser in the Delivery services section or by uninstalling the extension.

14.9. To call the Operator's API, the extension receives a short-lived access token from the personal account page. The token is kept in the browser's memory (storage.session) and is discarded when the browser closes; the refresh token is never passed to the extension.

14.10. The user may stop this processing at any time: leave the quality improvement program, disable the delivery service in the personal account, revoke site access permissions in the browser settings, or uninstall the extension.

15.1. The Operator reserves the right to make changes to this Policy.

15.2. In case of significant changes, users are notified via the Telegram bot and/or email.

15.3. The current version of the Policy is posted on this page.

Operator: HYPERSTACK LLC

OGRN: 1267700054181, INN: 9728169930

Address: 117335, Moscow, Nakhimovsky Prospekt, 63, bldg. 1, apt. 29

Person responsible for organizing personal data processing: General Director

For questions regarding personal data processing, please contact: