1. General provisions
1.1. This Policy explains what personal data are processed during registration and use of the BF Designer software, the Telegram bot @bfdesigner_bot (for those who have linked it) and the websites license.blenderfamily.com and pay.blenderfamily.com (the Payment Page), why, on what legal basis, where the data are stored, to whom they are transferred and for how long, and what rights the person to whom the data relate has.
1.2. Personal data operator: Individual Entrepreneur Andrey Vladimirovich Shkil (INN 561017656972, OGRNIP 325565800076010, Orenburg; hereinafter "the Operator"). Contact for personal data matters: legal@blenderfamily.com and the Telegram bot @bfdesigner_bot. The person responsible for organizing the processing of personal data is the Operator personally.
1.3. The Policy does not need to be accepted: it is published so that anyone can read it. A link to it is provided in the software at registration, in the Bot and on the website.
1.4. The Operator processes data lawfully and fairly, only for purposes specified in advance and only to the extent necessary for those purposes.
1.5. The terms "personal data", "processing", "operator", "cross-border transfer" and others have the meaning given to them in Federal Law No. 152-FZ "On Personal Data" (hereinafter "the Law").
2. Whose data are processed
- users of the software who have registered an account by phone number, including those who have not completed registration;
- users who have linked Telegram to their account;
- buyers of tokens and subscriptions;
- people who contact support, report an error or make a suggestion;
- buyers on the Payment Page pay.blenderfamily.com;
- visitors to the pages of the websites license.blenderfamily.com and pay.blenderfamily.com.
3. Legal bases for processing: contract, law, consent
3.1. Contract. Data without which the contract with the user (the License Agreement and the Offer) cannot be performed — the mobile phone number, license key, hardware fingerprint, Telegram ID (if the user has linked Telegram), e-mail for the cash receipt, the e-mail provided in the software (for service notices, if provided), payment, consent to auto-renewal and its cancellation, token debits, prompts and job parameters (for handling requests and disputed charges), conversation history in the Bot (for continuing the conversation) — are processed without separate consent, on the basis of clause 5 of Part 1 of Article 6 of the Law.
3.2. Law. The phone number is also processed because user authorization by subscriber number is expressly provided for by Part 10 of Article 8 of Federal Law No. 149-FZ, and payment data are retained because tax legislation requires it (clause 2 of Part 1 of Article 6 of the Law).
3.3. Consent. Separate consent is obtained only for optional processing: telemetry and crash reports (the document "Consent to Optional Processing of Personal Data"), and also for marketing messages (the document "Consent to Receive Marketing Messages").
3.4. Refusing or withdrawing consent takes nothing away: the license key keeps working, and the software and AI services remain fully available. The Operator does not make use of the software conditional on consent to processing that is not needed for it.
4. What data, why, on what legal basis and for how long
| Where collected | What data | Purpose | Legal basis | Retention period |
|---|---|---|---|---|
| Software: registration and login | Mobile phone number, registration date, issued license key and its term, Operator's note | Creating the account, login on a new device, issuing and extending the license key, keeping records of license keys and balances, changing the number | Contract, law (Part 10 of Article 8 of Federal Law No. 149-FZ) | While the account is active + 1 year |
| Software: verification codes | Phone number, time the code was sent, IP address, number of attempts | Confirming the number, protection against call and SMS abuse | The Operator's legitimate interest (clause 7 of Part 1 of Article 6 of the Law) | 90 days |
| Software: e-mail (optional) | E-mail, if the user has provided it at registration or in the settings | Service notices: project closure, changes to documents, claims, support replies — contract; marketing and informational messages — only if separately ticked (the document "Consent to Receive Marketing Messages") — consent | Contract; for marketing — consent | While the account is active + 1 year or until the user deletes the e-mail |
| Software: login log | Account, fingerprint of the new device, date and time of login, IP address | Notification of login from a new device, handling disputed logins | Contract | 1 year |
| Bot: linking Telegram | Telegram ID, username, name from the Telegram profile, date of linking | Notifications, support and generations in the Bot for users who have linked Telegram | Contract | While Telegram is linked + 1 year |
| Server: licenses and devices | License key, hardware fingerprint, dates of activation and checks, software version, log of device resets | Verifying the license key, limiting use to two devices, assisting with support (the Operator sees the date of the last check in the account card); aggregate usage statistics not linked to a user (clause 7.3) | Contract; for statistics — clause 9 of Part 1 of Article 6 of the Law (statistical purposes with anonymization) | While the account is active + 1 year |
| Server: start license protection | Hardware fingerprint, hash of the phone number, date the start license was issued | Preventing the start license from being obtained more than once | Contract; after its termination — the Operator's legitimate interest | 3 years |
| Payment Page: personal links | Link hash, account, phone number with the middle digits masked, license key, time of creation and expiry | Showing for which account the order is being placed | Contract | Up to 24 hours after the link expires (the link is valid for 30 minutes) |
| Server: payments, tokens, cost of generations | Account, e-mail for the cash receipt (entered on the Payment Page), amount, Robokassa payment number, number and dates of token credits, model, date and cost of jobs | Settlements, cash receipts, charge reminders, refunds, tax accounting; keeping the token Balance | Contract, law | 5 years; token Balance records — for as long as the account exists, but not less than 5 years |
| Server: auto-renewal | Consent to auto-renewal (date and time, IP address, plan, amount, frequency, version of the text, number of the first payment), records of cancellations | Automatic charges and evidence of consent and of its cancellation | Contract, law | 5 years |
| Server: generations | Job references (images, video, audio) | Performing the generation | Contract | 2 hours after the job is completed; for a stuck job — 24 hours |
| Server: generations | Prompt and parameters of the job (for images, the prompt is not stored) | Handling requests and disputed charges | Contract | 30 days |
| Server: generations | Finished output | Delivery and re-delivery if the connection is interrupted | Contract | 2 hours |
| Bot (users who have linked Telegram): generations | Images attached to a generation card | Performing the generation | Contract | 2 hours |
| Bot (users who have linked Telegram): conversations with language models | The user's messages and the model's replies | Continuing the conversation | Contract | 30 days from the last message |
| Server: telemetry | License key, hardware fingerprint, area of the software in use, session length, feature counters | Improving the software | Consent | 1 year |
| Server: crash reports linked to the license key | License key, hardware fingerprint, version, error text (file paths and the Windows user name are stripped by the software before sending) | Fixing errors with the ability to contact the user | Consent | 1 year |
| Support, error reports, suggestions | Text of the request, attachments, account or Telegram ID, e-mail for the reply | Responding to the request | Contract | 6 months after the request is closed |
| Document acceptance log | Account (phone number) or license key, document and version, date and time of acceptance and of withdrawal, source (Software, Bot, Payment Page); for the Software and the Payment Page — IP address and browser or software details, payment number, version of the checkbox text | Confirming the conclusion of the contract, the user's age and the receipt of consents | Contract, law | While the account is active + 3 years |
| Web server logs | IP address, time, request URL | Server security | The Operator's legitimate interest (clause 7 of Part 1 of Article 6 of the Law) | 90 days |
| Mailings | E-mail (from the software or from the Payment Page — only if separately ticked), Telegram ID of users who have linked Telegram | News and offers | Consent | Until consent is withdrawn |
5. What the Operator does not collect
5.1. Projects, media files, voice recordings in "Feedback", notes and software settings are stored only on the user's computer and are not sent to the server. The Operator has no access to them. The exception is what the user themselves sends to cloud AI services: prompts, references, voice requests and audio for transcription (Section 8). If project synchronization is introduced in the future, it will be enabled only by a separate choice of the user, and the Policy will be supplemented.
5.2. The Operator does not process special categories of personal data or biometric data. Images of people and voice recordings that the user includes in a request to an AI model are processed only to fulfil that request and are not used to establish anyone's identity. Including personal data in requests is prohibited (see clause 9.3).
5.3. Local AI models run on the user's computer; the data the user processes in them are not transferred to the Operator.
5.4. Downloading of models and helper programs. Helper programs (FFmpeg, llama.cpp, stable-diffusion.cpp, ONNX Runtime, DirectML) are downloaded by the software from the Operator's server; the user's IP address is recorded in the web server log (row "Web server logs", 90 days) and is not linked to the account. The fallback source for some of them is github.com and nuget.org. If Windows does not yet have the Microsoft Edge WebView2 component, the software installer downloads it from Microsoft's servers — that website sees the IP address under Microsoft's rules. Models are downloaded by the software directly from huggingface.co: that website sees the user's IP address under its own rules, and the Operator receives no data about the download. In the same way, the software directly accesses third-party services that the user has connected themselves (for example, Google Calendar): their data and the user's credentials for them are not transferred to the Operator.
5.5. Anonymized crash reports. If the user has not given consent to telemetry, the software sends only a technical report upon a crash, without the license key, fingerprint, account or other identifiers; file paths and the user name are stripped before sending, and the IP address is not stored with the report. Such a report does not relate to a specific person and does not constitute personal data. Sending can be disabled in the software settings.
6. Hardware fingerprint
The hardware fingerprint is computed by the software from the computer's hardware identifiers (disk serial number, network card MAC address, operating system installation identifier), and the result is hashed using the SHA-256 algorithm. On Windows, the serial number of the system volume (drive C:), the MAC address of the physical network adapter and the Windows installation identifier (MachineGuid) are used; in the macOS version, once it is released, the computer's hardware identifier (UUID) and the MAC address of the network card; the Policy will be supplemented before its release. If any of the sources cannot be read, it is skipped. Only the hash is transferred to and stored on the Server; the identifiers themselves are not transferred and cannot be recovered from the hash. The fingerprint is needed so that a license key works on no more than two devices and so that the start license cannot be obtained more than once. The Operator treats the fingerprint, taken together with the license key and the account, as personal data.
7. What the Operator does with the data
7.1. The Operator collects, records, systematizes, accumulates, stores, updates, retrieves, uses, transfers (provides, grants access to), blocks, deletes and destroys personal data. Processing is automated.
7.2. The Operator does not make decisions that produce legal effects for the user on the basis of solely automated processing.
7.3. Aggregate statistics. From the license key verification data and job records that the Operator processes in any case for the performance of the contract, the Operator computes only aggregate indicators: the number of users who launched the software per day, week and month; the number of users online; the distribution of software versions; the number of generations by model. The indicators are anonymized and do not make it possible to single out a specific user; no separate data are collected for them (clause 9 of Part 1 of Article 6 of the Law).
8. To whom data are transferred
8.1. Hosting. The Operator's database and server are located in Russia, with the hosting provider Timeweb (TIMEWEB.CLOUD LLC, INN 7810945525). When data of Russian citizens are collected, their recording, systematization, accumulation, storage, updating and retrieval are carried out using databases located in Russia (Part 5 of Article 18 of the Law).
8.2. AI services. When the user starts a cloud generation, the content of the request (text, settings, uploaded images, voice requests and audio for transcription) is transferred to the aggregator RouterAI (Inter LLC, INN 7017351722; backup channel — the Timeweb AI service (TIMEWEB.CLOUD LLC, Russia)) and, through it, to the provider of the selected model. Model providers' servers may be located outside Russia. The aggregator's rules prohibit transmitting personal data through it, so the Offer (clause 8.4) prohibits the user from including it in requests. The Operator transfers only the request itself: neither the Telegram ID, nor the e-mail, nor the license key, nor any other user identifier is transferred to the aggregator or to model providers — they see only the Operator's account. In a conversation with a language model, the entire conversation within the model's limit is transferred anew with each response. The cross-border transfer of the content of requests is carried out by the Operator (Section 9). The terms of certain Providers allow the content of requests to be used to improve their models; such Providers are marked on the page license.blenderfamily.com/legal/models. The Operator is seeking, through the aggregator, to have such use switched off and, until it is, asks users not to include personal data in requests to those models.
8.3. Telegram. For users who have linked Telegram to their account, notifications, support and delivery of generation outputs in the Bot operate through the Telegram messenger, which is a foreign service. In addition, support requests from all users — from the software, at support@blenderfamily.com and from the Bot — are forwarded to a private support group in Telegram that only the Operator can access. The text of the request, its attachments and the request number are sent to the group; the phone number, the e-mail for the reply and the user's account are not transferred to the group — the Operator finds them by the request number in the Operator's panel and replies from there.
8.4. Payments. Payments are accepted by ROBOKASSA LLC (INN 5047063929, OGRN 1055009302215), a bank payment agent (payment aggregator) of its partner credit institutions. Bank card details are entered on Robokassa's side; the Operator neither receives nor stores them. The amount, the order description, the internal order number and the e-mail for the cash receipt are transferred to Robokassa; the phone number, the Telegram ID and the license key are not transferred to Robokassa. The Operator receives the payment number and status from it. Cash receipts are generated by Robokassa as a payment agent (the "Robocheki" service), which transmits the settlement details to the tax authority through a fiscal data operator; this is required by Federal Law No. 54-FZ. For auto-renewal, the Operator stores only the number of the first payment in Robokassa.
8.5. E-mails. Reminders about charges and service e-mails are sent from noreply@blenderfamily.com through the Timeweb e-mail service (TIMEWEB.CLOUD LLC, Russia).
8.6. The phone verification code — by a call with a code or by SMS — is delivered on the Operator's instructions by the Russian service SIGMA messaging (Media Technology LLC, INN 7816547697); the phone number and the code are transferred to it. The service acts under a contract containing the terms of the instruction (Part 3 of Article 6 of the Law) and may not use the number for its own purposes.
8.7. Data may be disclosed to government authorities upon their lawful request.
8.8. The Operator does not sell personal data and does not transfer them to third parties for advertising purposes.
9. Cross-border transfer
9.1. Cross-border transfer occurs in three cases: during cloud generation (clause 8.2); when Telegram is used — for users who have linked Telegram (clause 8.3); when a support request is forwarded to the support group in Telegram — for everyone who contacts support, to the extent of the text and attachments of the request (clause 8.3). The phone number and e-mail are not transferred outside Russia.
9.2. Countries to which data may be transferred, as of the date of this version: the United Arab Emirates (Telegram FZ-LLC); the United States, Germany, Singapore and the People's Republic of China, as the countries of the Model Providers (OpenAI, Anthropic, Google, xAI, Krea, Recraft, Fish Audio, Black Forest Labs Inc. — United States; Black Forest Labs GmbH — Germany; BytePlus and Kling AI, which distribute the ByteDance and Kuaishou models — Singapore; ByteDance, Kuaishou — People's Republic of China). The current list of models, Providers and their countries is available at license.blenderfamily.com/legal/models. Before connecting a Provider from a country not included in the notification, the Operator supplements the notification to Roskomnadzor and this Policy. Notifications of intent to carry out cross-border transfer were sent to Roskomnadzor on 25.09.2026 (application No. 100436627) and on 26.09.2026 (application No. 100437644 — Singapore).
9.3. The user is prohibited from including personal data in requests — their own or other people's: recognizable faces in photos and videos, voice recordings, names, contact details, documents (Offer, clause 8.4). A reminder is shown in the software before the first cloud generation and next to the reference field. If the user breaches this prohibition, such data is processed only to fulfil the request (clause 5.2).
10. How data are protected
- the server is accessible from the internet only via the secure HTTPS protocol; all other ports are closed by a firewall;
- login to the server is possible only with cryptographic keys; password login is disabled, and repeated attempts are blocked;
- secrets and the database are accessible only to a service account;
- login to the admin panel requires a password with confirmation by code, and the number of attempts is limited;
- backups are stored with restricted access rights;
- web server logs are deleted after 90 days, and generation and conversation data are deleted automatically according to the periods in Section 4;
- the software sends the server a hardware fingerprint rather than the computer's identifiers themselves; the Windows user name is stripped from crash reports before sending;
- verification codes (call or SMS) are one-time and valid for 30 minutes; the number of entry attempts and the number of codes sent per number, device and IP address are limited.
11. User rights
11.1. The user has the right to:
- obtain information about which of their data are processed, why and how;
- require their data to be updated, blocked or deleted if the data are incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose;
- withdraw consent to optional processing and to marketing messages;
- appeal against the Operator's actions to Roskomnadzor or in court.
11.2. Requests are accepted at legal@blenderfamily.com, from the Support section of the software and via the Bot. The Operator responds within 10 working days; this period may be extended by a further 5 working days, with the reasons stated.
11.3. Withdrawal of consent is possible using the toggle in the software settings, the "Unsubscribe" link in an e-mail, a button in the Bot (if Telegram is linked), or by e-mail. After withdrawal, the Operator stops the relevant processing and deletes those data within 30 days. The license key and access to the software do not depend on this.
11.4. Deletion of data needed for the contract (phone number, license key, fingerprint, account) means termination of the contract: without these data the Operator cannot verify the license key or grant access. The Telegram link and the e-mail can be deleted separately, without terminating the contract. Payment data are retained for the tax record-keeping periods even after the account is deleted.
12. Age of Users
12.1. Only persons who have reached 18 years of age may use the software, the Bot and AI services. Age is confirmed by the user when accepting the License Agreement; the Operator does not request or store separate documents proving age.
12.2. If the Operator becomes aware — from the user, their legal representative or otherwise — that a user is under 18, the Operator cancels the license key and deletes that user's data within 30 days, except for payment data, which are retained for the tax record-keeping periods. This can be reported to legal@blenderfamily.com.
13. Data breaches
13.1. If the Operator discovers an unlawful transfer, provision or dissemination of, or access to, personal data, the Operator:
- within 24 hours notifies Roskomnadzor of the incident, its presumed causes, the harm caused, the measures taken and the contact person;
- within 72 hours informs Roskomnadzor of the results of the internal investigation and of the persons responsible, if they have been identified;
- notifies affected users in the software and, for users who have linked Telegram, also in the Bot.
13.2. The internal incident response procedure is approved by the Operator separately.
14. Cookies
The pages of the websites license.blenderfamily.com and pay.blenderfamily.com do not use web analytics and do not set cookies. The payment page temporarily keeps the personal payment link in the browser tab's memory (sessionStorage) until the tab is closed. The Robokassa payment form, on its own domain, sets its own cookies under Robokassa's rules. If this changes, the Policy will be supplemented before such use begins.
15. Changes to the Policy
The Operator publishes new versions of the Policy at license.blenderfamily.com/legal/, stating their date; previous versions remain available. The Operator gives notice of material changes in the Bot and in the software.
16. Operator details
Individual Entrepreneur Andrey Vladimirovich Shkil
INN 561017656972 · OGRNIP 325565800076010
Registered on 5 August 2025 by the Interdistrict Inspectorate of the Federal Tax Service of Russia No. 10 for the Orenburg Region
Location: Orenburg
E-mail for personal data matters: legal@blenderfamily.com · Phone: +7 995 350 76 91
Support: the Support section of the software, e-mail support@blenderfamily.com, Telegram bot @bfdesigner_bot
The Operator is included in the register of personal data operators: registration number 56-26-023381, Roskomnadzor Order No. 91 of 30.09.2026 (notification of 25.09.2026, application No. 100436576). Notifications of intent to carry out cross-border transfer were sent on 25.09.2026 (application No. 100436627) and on 26.09.2026 (application No. 100437644).