BF Designer Personal Data Processing Policy

1. General provisions

1.1. This Policy explains what personal data are processed during registration and use of the BF Designer software, the Telegram bot @bfdesigner_bot (for those who have linked it) and the websites license.blenderfamily.com and pay.blenderfamily.com (sign-in by phone number and payment), why, on what legal basis, where the data are stored, to whom they are transferred and for how long, and what rights the person to whom the data relate has.

1.2. Personal data operator: Individual Entrepreneur Andrey Vladimirovich Shkil (INN 561017656972, OGRNIP 325565800076010, Orenburg; hereinafter "the Operator"). Contact for personal data matters: legal@blenderfamily.com, phone +7 995 350-76-91. The person responsible for organizing the processing of personal data is the Operator personally.

1.3. The Policy does not need to be accepted: it is published so that anyone can read it. A link to it is provided in the software at registration, in the Bot and on the website.

1.4. The Operator processes data lawfully and fairly, only for purposes specified in advance and only to the extent necessary for those purposes.

1.5. The terms "personal data", "processing", "operator", "cross-border transfer" and others have the meaning given to them in Federal Law No. 152-FZ "On Personal Data" (hereinafter "the Law").

2. Whose data are processed

users who have registered an account by phone number in the software or on pay.blenderfamily.com, including those who have not completed registration;
users who have linked Telegram to their account;
buyers of tokens and the Pro plan;
people who contact support, report an error or make a suggestion;
buyers on the Payment Page pay.blenderfamily.com;
visitors to the pages of the websites license.blenderfamily.com and pay.blenderfamily.com.

3. Legal bases for processing: contract, law, consent

3.1. Contract. Data without which the contract with the user (the License Agreement and the Offer) cannot be performed — the mobile phone number, license key, hardware fingerprint, Telegram ID (if the user has linked Telegram), e-mail for the cash receipt, the e-mail provided in the software (for service notices, if provided), payment, consent to auto-renewal and its cancellation, token debits, prompts and job parameters (for handling requests and disputed charges), conversation history in the Bot (for continuing the conversation) — are processed without separate consent, on the basis of clause 5 of Part 1 of Article 6 of the Law.

3.2. Law. The phone number is also processed because user authorization by subscriber number is expressly provided for by Part 10 of Article 8 of Federal Law No. 149-FZ, and payment data are retained because tax legislation requires it (clause 2 of Part 1 of Article 6 of the Law).

3.3. Consent. Separate consent is obtained only for optional processing: telemetry and crash reports (the document "Consent to Optional Processing of Personal Data"), and also for marketing messages (the document "Consent to Receive Marketing Messages").

3.4. Refusing or withdrawing consent takes nothing away: the license key keeps working, and the software and AI services remain fully available. The Operator does not make use of the software conditional on consent to processing that is not needed for it.

4. What data, why, on what legal basis and for how long

Where collected	What data	Purpose	Legal basis	Retention period
Software and website: registration and login	Mobile phone number (account identifier), registration date, issued license key, plan and Pro term, Operator's note	Creating the account, login in the software and on the website, issuing the license key, keeping records of the plan, license keys and balances, crediting free tokens, changing the number	Contract, law (Part 10 of Article 8 of Federal Law No. 149-FZ)	While the account is active + 1 year
Software and website: verification codes	Phone number, time the code was sent, delivery method, IP address, number of attempts	Confirming the number, protection against call and SMS abuse	The Operator's legitimate interest (clause 7 of Part 1 of Article 6 of the Law)	90 days
Software: e-mail (optional)	E-mail, if the user has provided it at registration or in the settings	Service notices: project closure, changes to documents, claims, support replies — contract; marketing and informational messages — only if separately ticked (the document "Consent to Receive Marketing Messages") — consent	Contract; for marketing — consent	While the account is active + 1 year or until the user deletes the e-mail
Software: login log	Account, fingerprint of the new device, date and time of login, IP address	Notification of login from a new device, handling disputed logins	Contract	1 year
Bot: linking Telegram	Telegram ID, username, name from the Telegram profile, date of linking	Notifications, support and generations in the Bot for users who have linked Telegram	Contract	While Telegram is linked + 1 year
Server: licenses and devices	License key, hardware fingerprint, dates of activation and checks, software version, log of device resets	Verifying the license key, limiting use to two devices, assisting with support (the Operator sees the date of the last check in the account card); aggregate usage statistics not linked to a user (clause 7.3)	Contract; for statistics — clause 9 of Part 1 of Article 6 of the Law (statistical purposes with anonymization)	While the account is active + 1 year
Server: free token protection	Hardware fingerprint, hash of the phone number, registration date	Preventing free tokens from being obtained on several accounts from one number or computer	Contract; after its termination — the Operator's legitimate interest	3 years
Payment Page: personal links	Link hash, account, phone number with the middle digits masked, license key, time of creation and expiry	Showing for which account the order is being placed	Contract	Up to 24 hours after the link expires (the link is valid for 30 minutes)
Website: sign-in session	Session identifier, account, sign-in and sign-out time, IP address	Signing in to pay.blenderfamily.com for payment and plan management	Contract	Until sign-out or session expiry; sign-in record — 1 year
Server: payments, tokens, cost of generations	Account, e-mail for the cash receipt (entered on the Payment Page), amount, Robokassa order and payment number, plan and Pro term, token batches (amount, dates of crediting and expiry), model, date and cost of jobs	Settlements, cash receipts, charge reminders, refunds, tax accounting; keeping the token Balance	Contract, law	5 years; token Balance records — for as long as the account exists, but not less than 5 years
Server: auto-renewal	Consent to auto-renewal (date and time, IP address, Pro term, amount, frequency, version of the text, number of the first payment), records of cancellations	Automatic charges and evidence of consent and of its cancellation	Contract, law	5 years
Server: generations	Job references (images, video, audio)	Performing the generation	Contract	2 hours after the job is completed; for a stuck job — 24 hours
Server: generations	Prompt and parameters of the job (for images, the prompt is not stored)	Handling requests and disputed charges	Contract	30 days
Server: generations	Finished output	Delivery and re-delivery if the connection is interrupted	Contract	2 hours
Bot (users who have linked Telegram): generations	Images attached to a generation card	Performing the generation	Contract	2 hours
Bot (users who have linked Telegram): conversations with language models	The user's messages and the model's replies	Continuing the conversation	Contract	30 days from the last message
Server: telemetry	License key, hardware fingerprint, area of the software in use, session length, feature counters	Improving the software	Consent	1 year
Server: crash reports linked to the license key	License key, hardware fingerprint, version, error text (file paths and the Windows user name are stripped by the software before sending)	Fixing errors with the ability to contact the user	Consent	1 year
Support, error reports, suggestions	Text of the request, attachments, account or Telegram ID, e-mail for the reply	Responding to the request	Contract	6 months after the request is closed
Software: online feedback — profile	Feedback name (any, entered by the user), feedback code	Connecting with users the user has chosen: showing them the name	Contract (clause 5, Part 1, Article 6 of the Law)	While the account is active or until the user deletes the profile
Software: online feedback — connections	Codes of connected users, date of connection; access term and cohort label set by the recipient; the feedback e-mail — only if the user has ticked "Show e-mail" for that connection	Managing who may send works and until what date; showing the e-mail to the chosen recipient. The Operator does not send e-mails to this address	Contract	While the connection is active; after it is removed or the code is changed — together with the works under it. The e-mail is deleted immediately when the user unticks the box or the connection is removed
Server: online feedback — files	Works the user sends to the recipient (videos, images, Canvas frames) and reviews (annotations, drawings, the reviewer's voice recording)	Delivering the work and the review to the recipient	Contract	7 days from sending; "high quality" videos — 3 days; unfinished uploads — 7 days
Server: online feedback — works and messages	Titles of works, versions and statuses, participants' messages (up to 4,000 characters)	Managing the work between the sender and the recipient	Contract	1 year after the work is closed or the connection is removed; a message deleted by the user is erased immediately
Document acceptance log	Account (phone number) and license key, document and version, date and time of acceptance and of withdrawal, source (software, website), IP address and browser or software details, payment number, version of the checkbox text	Confirming the conclusion of the contract, the user's age and the receipt of consents	Contract, law	While the account is active + 3 years
Web server logs	IP address, time, request URL	Server security	The Operator's legitimate interest (clause 7 of Part 1 of Article 6 of the Law)	90 days
Mailings	E-mail (from the software or from the Payment Page — only if separately ticked), Telegram ID of users who have linked Telegram	News and offers	Consent	Until consent is withdrawn

5. What the Operator does not collect

5.1. Projects, media files, notes and software settings are stored only on the user's computer and are not sent to the server. The Operator has no access to them. The exceptions are what the user themselves sends: to cloud AI services (prompts, references, voice requests and audio for transcription, clause 8.2) and, through online feedback, to a recipient of their choice (works, reviews with a voice recording, messages, clause 8.9). A local review file that the user shares on their own does not reach the server. If project synchronization is introduced in the future, it will be enabled only by a separate choice of the user, and the Policy will be supplemented.

5.2. The Operator does not process special categories of personal data or biometric data. Images of people and voice recordings that the user includes in a request to an AI model or in an online feedback work or review are processed only to fulfil the request or deliver it to the recipient and are not used to establish anyone's identity. What to include in a request is decided by the user (clause 9.3).

5.3. Local AI models run on the user's computer; the data the user processes in them are not transferred to the Operator.

5.4. Downloading of models and helper programs. Helper programs (FFmpeg, llama.cpp, stable-diffusion.cpp, ONNX Runtime, DirectML) are downloaded by the software from the Operator's server; the user's IP address is recorded in the web server log (row "Web server logs", 90 days) and is not linked to the account. The fallback source for some of them is github.com and nuget.org. If Windows does not yet have the Microsoft Edge WebView2 component, the software installer downloads it from Microsoft's servers — that website sees the IP address under Microsoft's rules. Models are downloaded by the software directly from huggingface.co: that website sees the user's IP address under its own rules, and the Operator receives no data about the download. In the same way, the software directly accesses third-party services that the user has connected themselves (for example, Google Calendar): their data and the user's credentials for them are not transferred to the Operator.

5.5. Anonymized crash reports. If the user has not given consent to telemetry, the software sends only a technical report upon a crash, without the license key, fingerprint, account or other identifiers; file paths and the user name are stripped before sending, and the IP address is not stored with the report. Such a report does not relate to a specific person and does not constitute personal data. Sending can be disabled in the software settings.

6. Hardware fingerprint

The hardware fingerprint is computed by the software from the computer's hardware identifiers (disk serial number, network card MAC address, operating system installation identifier), and the result is hashed using the SHA-256 algorithm. On Windows, the serial number of the system volume (drive C:), the MAC address of the physical network adapter and the Windows installation identifier (MachineGuid) are used; in the macOS version, once it is released, the computer's hardware identifier (UUID) and the MAC address of the network card; the Policy will be supplemented before its release. If any of the sources cannot be read, it is skipped. Only the hash is transferred to and stored on the Server; the identifiers themselves are not transferred and cannot be recovered from the hash. The fingerprint is needed so that a license key works on no more than two devices and so that free tokens cannot be obtained on several accounts from one computer. The Operator treats the fingerprint, taken together with the license key and the account, as personal data.

7. What the Operator does with the data

7.1. The Operator collects, records, systematizes, accumulates, stores, updates, retrieves, uses, transfers (provides, grants access to), blocks, deletes and destroys personal data. Processing is automated.

7.2. The Operator does not make decisions that produce legal effects for the user on the basis of solely automated processing.

7.3. Aggregate statistics. From the license key verification data and job records that the Operator processes in any case for the performance of the contract, the Operator computes only aggregate indicators: the number of users who launched the software per day, week and month; the number of users online; the distribution of software versions; the number of generations by model. The indicators are anonymized and do not make it possible to single out a specific user; no separate data are collected for them (clause 9 of Part 1 of Article 6 of the Law).

8. To whom data are transferred

8.1. Hosting. The Operator's database and server are located in Russia, with the hosting provider Timeweb (TIMEWEB.CLOUD LLC, INN 7810945525); online feedback files are temporarily stored there as well, in Timeweb object storage in Russia. When data of Russian citizens are collected, their recording, systematization, accumulation, storage, updating and retrieval are carried out using databases located in Russia (Part 5 of Article 18 of the Law).

8.2. AI services. When the user starts a cloud generation, the content of the request (text, settings, uploaded images, voice requests and audio for transcription) is transferred to the aggregator RouterAI (Inter LLC, INN 7017351722; backup channel — the Timeweb AI service (TIMEWEB.CLOUD LLC, Russia)) and, through it, to the provider of the selected model, directly or through an intermediary cloud platform (Microsoft Azure, Amazon Bedrock, Google Vertex AI, DeepInfra and others). Model providers' servers may be located outside Russia. The user decides what to include in a request; other people's personal data may be included only with their consent (Offer, clause 8.4). The Operator transfers only the request itself: neither the Telegram ID, nor the e-mail, nor the license key, nor any other user identifier is transferred to the aggregator or to model providers: the aggregator sees the Operator's account, and providers see the aggregator's account. In a conversation with a language model, the entire conversation within the model's limit is transferred anew with each response. The cross-border transfer of the content of requests is carried out by the Operator (Section 9). The terms of certain Providers allow the content of requests to be used to improve their models; such Providers are marked on the page license.blenderfamily.com/legal/models. The Operator is seeking, through the aggregator, to have such use switched off.

8.3. Telegram. For users who have linked Telegram to their account, notifications, support and delivery of generation outputs in the Bot operate through the Telegram messenger, which is a foreign service. In addition, support requests from all users — from the software, at support@blenderfamily.com and from the Bot — are forwarded to a private support group in Telegram that only the Operator can access. The text of the request, its attachments and the request number are sent to the group; the phone number, the e-mail for the reply and the user's account are not transferred to the group — the Operator finds them by the request number in the Operator's panel and replies from there.

8.4. Payments. Payments are accepted by ROBOKASSA LLC (INN 5047063929, OGRN 1055009302215), a bank payment agent (payment aggregator) of its partner credit institutions. Bank card details are entered on Robokassa's side; the Operator neither receives nor stores them. The amount, the order number, the buyer's e-mail for the cash receipt and the receipt contents are transferred to Robokassa; the phone number, the Telegram ID and the license key are not transferred to Robokassa. The Operator receives the payment number and status from it. Cash receipts are generated by Robokassa as a payment agent (the "Robocheki" service), which transmits the settlement details to the tax authority through a fiscal data operator; this is required by Federal Law No. 54-FZ. For auto-renewal, the Operator stores only the number of the first payment in Robokassa.

8.5. E-mails. Reminders about charges and service e-mails are sent from noreply@blenderfamily.com through the Timeweb e-mail service (TIMEWEB.CLOUD LLC, Russia).

8.6. The phone verification code — by a call with a code or by SMS — is delivered on the Operator's instructions by the Russian service SIGMA messaging (Media Technology LLC, INN 7816547697); the phone number and the code are transferred to it. The service acts under a contract containing the terms of the instruction (Part 3 of Article 6 of the Law) and may not use the number for its own purposes. If delivery of the code via Telegram is enabled, the code will arrive as a Telegram message to the account linked to that number: for this, the phone number and the code are transferred to Telegram. The Telegram account is not linked to the user's account in this case — the account remains the phone number.

8.7. Data may be disclosed to government authorities upon their lawful request.

8.8. The Operator does not sell personal data and does not transfer them to third parties for advertising purposes.

8.9. Online feedback. The feedback name, the e-mail (only if the user has ticked "Show e-mail"), works, reviews and messages are received only by the user with whom the sender has connected by feedback code. This is a transfer at the user's instruction for the performance of the contract, not dissemination. Before the first sending, the Software shows what the recipient will see. Files are available only to the participants via a temporary link; the Operator does not view the contents of works, reviews and messages, except when a participant contacts support or as required by law. The Operator cannot delete copies that the recipient has saved in their Software; the recipient is responsible for their further use. If the recipient is an organization (for example, a school), it processes the data received as an independent operator.

9. Cross-border transfer

9.1. Cross-border transfer occurs in three cases: during cloud generation (clause 8.2); when Telegram is used — for users who have linked Telegram (clause 8.3); when a support request is forwarded to the support group in Telegram — for everyone who contacts support, to the extent of the text and attachments of the request (clause 8.3). In addition, if delivery of the verification code via Telegram is enabled, the phone number and the code are transferred to Telegram (clause 8.6). In all other cases, the phone number and e-mail are not transferred outside Russia.

9.2. Countries to which data may be transferred, as of the date of this version:

the United Arab Emirates — Telegram FZ-LLC (correspondence in the Bot; delivery of the verification code, if enabled);
the United States — the model providers OpenAI, Anthropic, Google, xAI, Krea, Recraft, Black Forest Labs Inc., MiniMax (servers), and the cloud platforms through which the aggregator routes requests to models: Microsoft (Azure), Amazon Web Services (Amazon Bedrock), Google (Vertex AI), DeepInfra and other hosts of open models (NVIDIA and Zhipu AI models);
Germany — Black Forest Labs GmbH;
Singapore — BytePlus (ByteDance models), Kling AI (Kuaishou models), MiniMax (legal entity);
the People's Republic of China — the country of the developers ByteDance, Kuaishou and Zhipu AI. As of the date of this version, requests to their models are sent to recipients in Singapore and the United States; China is included in the notification to Roskomnadzor in case the aggregator or the backup channel sends a request directly to the developer.

The current list of models, request recipients and their countries is available at license.blenderfamily.com/legal/models. Before connecting a recipient from a country not included in the notification, the Operator supplements the notification to Roskomnadzor and this Policy. Notifications of intent to carry out cross-border transfer were sent to Roskomnadzor on 25.09.2026 (application No. 100436627) and on 26.09.2026 (application No. 100437644 — Singapore).

9.3. Whether to include their own photos, voice and other information about themselves in a request is decided by the user; other people's personal data may be included only with their consent (Offer, clause 8.4). Everything the user includes in a request is processed only to fulfil the request (clause 5.2).

10. How data are protected

the server is accessible from the internet only via the secure HTTPS protocol; all other ports are closed by a firewall;
login to the server is possible only with cryptographic keys; password login is disabled, and repeated attempts are blocked;
secrets and the database are accessible only to a service account;
login to the admin panel requires a password with confirmation by code, and the number of attempts is limited;
backups are stored with restricted access rights;
web server logs are deleted after 90 days, and generation and conversation data are deleted automatically according to the periods in Section 4;
the software sends the server a hardware fingerprint rather than the computer's identifiers themselves; the Windows user name is stripped from crash reports before sending;
verification codes (call or SMS) are one-time and valid for 30 minutes; the number of entry attempts and the number of codes sent per number, device and IP address are limited.

11. User rights

11.1. The user has the right to:

obtain information about which of their data are processed, why and how;
require their data to be updated, blocked or deleted if the data are incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose;
withdraw consent to optional processing and to marketing messages;
appeal against the Operator's actions to Roskomnadzor or in court.

11.2. Requests are accepted at legal@blenderfamily.com, from the Support section of the software and via the Bot. The Operator responds within 10 working days; this period may be extended by a further 5 working days, with the reasons stated.

11.3. Withdrawal of consent is possible using the toggle in the software settings, the "Unsubscribe" link in an e-mail, a button in the Bot (if Telegram is linked), or by e-mail. After withdrawal, the Operator stops the relevant processing and deletes those data within 30 days. The license key and access to the software do not depend on this.

11.4. Deletion of data needed for the contract (phone number, license key, fingerprint, account) means termination of the contract: without these data the Operator cannot verify the license key or grant access. The Telegram link, the e-mail and the online feedback profile can be deleted separately, without terminating the contract. When the account is deleted, the online feedback profile, connections, files on the server, and the user's works and messages are deleted as well; for the other party the work remains marked "the other participant has been deleted", without the deleted user's name and e-mail. The Operator cannot delete copies on the participants' computers. Payment data are retained for the tax record-keeping periods even after the account is deleted.

12. Age of Users

12.1. Only persons who have reached 18 years of age may use the software, the Bot and AI services. Age is confirmed by the user when accepting the License Agreement; the Operator does not request or store separate documents proving age.

12.2. If the Operator becomes aware — from the user, their legal representative or otherwise — that a user is under 18, the Operator cancels the license key and deletes that user's data within 30 days, except for payment data, which are retained for the tax record-keeping periods. This can be reported to legal@blenderfamily.com.

13. Data breaches

13.1. If the Operator discovers an unlawful transfer, provision or dissemination of, or access to, personal data, the Operator:

within 24 hours notifies Roskomnadzor of the incident, its presumed causes, the harm caused, the measures taken and the contact person;
within 72 hours informs Roskomnadzor of the results of the internal investigation and of the persons responsible, if they have been identified;
notifies affected users in the software and, for users who have linked Telegram, also in the Bot.

13.2. The internal incident response procedure is approved by the Operator separately.

14. Cookies

The pages of the websites license.blenderfamily.com and pay.blenderfamily.com do not use web analytics or advertising cookies. After sign-in by phone number, pay.blenderfamily.com stores a session identifier in the browser — this is necessary for sign-in to work; it is deleted on sign-out or when the session expires. The payment page temporarily keeps the personal payment link in the browser tab's memory (sessionStorage) until the tab is closed. The Robokassa payment form, on its own domain, sets its own cookies under Robokassa's rules. If this changes, the Policy will be supplemented before such use begins.

15. Changes to the Policy

The Operator publishes new versions of the Policy at license.blenderfamily.com/legal/, stating their date; previous versions remain available. The Operator gives notice of material changes in the software and on the website.

16. Operator details

Individual Entrepreneur Andrey Vladimirovich Shkil

INN 561017656972 · OGRNIP 325565800076010

Registered on 5 August 2025 by the Interdistrict Inspectorate of the Federal Tax Service of Russia No. 10 for the Orenburg Region

Location: Orenburg

Phone: +7 995 350-76-91 · Personal data matters: legal@blenderfamily.com

Support: the Support section of the software, e-mail support@blenderfamily.com

The Operator is included in the register of personal data operators: registration number 56-26-023381, Roskomnadzor Order No. 91 of 30.09.2026 (notification of 25.09.2026, application No. 100436576). Notifications of intent to carry out cross-border transfer were sent on 25.09.2026 (application No. 100436627) and on 26.09.2026 (application No. 100437644).