Documents · revision 10 of 10 October 2026

Personal-data processing policy

Revision date: 10 October 2026, revision 10. Personal data are processed in accordance with Federal Law No. 152-FZ of 27 July 2006 “On Personal Data” (hereinafter — 152-FZ).

1. General provisions

This policy describes what data are processed on the diff.legal website, including its server-rendered enquiry form, subscription form and personal account pages (hereinafter — the “Site”), in email correspondence with the Operator and in correspondence with the Operator on Telegram, for which purposes, and how to submit a request. Processing is carried out by the personal data operator, Moscow (hereinafter — the “Operator”).

For personal-data processing matters and withdrawal of consent: support@diff.legal. To discuss a legal task: hello@diff.legal or the Telegram bot @diff_legal_bot (section 6.1).

Viewing the Site does not by itself mean consent to web analytics or to receiving mailings. Analytics are enabled only after you select “Accept” in the cookie window; enquiry data are processed after a separate consent checkbox before the form is submitted; mailings are sent only after a separate, optional consent checkbox for receiving them.

2. What data are processed

• Choice in the cookie window. A technically necessary record of whether you accepted or rejected analytics. Stored in the browser's local storage and in the choice log on the server (section 5.1). Does not require separate consent.
• Web-analytics data. Only after you select “Accept” does the Yandex Metrica service collect cookies, the IP address, information about the device and browser, the referral source, the pages viewed and actions on them (section 5.2).
• Enquiry data. One contact: an email address, phone number or Telegram username; the selected communication channel; the enquiry subject; a description of the task (optional). After submission you can add an optional brief: the project stage, the desired outcome and timelines.
• Email correspondence. Only if you write to the Operator by email yourself, including replying to the Operator's letter about an enquiry: the sender's address and the content of letters sent to hello@diff.legal or support@diff.legal (section 6).
• Correspondence on Telegram. Only if you write to the @diff_legal_bot yourself or specified Telegram as the communication channel in the enquiry form: the Telegram username, profile name and account identifier, the content of the messages you sent, and, when you follow a link from the Site, also the tag of that link's location on the Site (section 6.1).
• Mailing data. Only with separate consent to mailings: one contact (email address, phone number or Telegram username) and the selected channel; if consent is checked in the enquiry form, also the link between the consent and that enquiry.
• Proof of consent. Together with the enquiry, the edition and checksum of the consent text, the time of confirmation and the method of form submission are stored. For consent to mailings, the edition and checksum of its text, the time, the method (enquiry form or subscription form), the contact and the channel are stored, and on withdrawal from the mailing — the time of withdrawal.
• Form-protection data. The request referrer address is used to rate-limit requests; to limit submissions of enquiries and subscriptions, its hash is stored. This information serves form protection, not advertising.
• Wiki article rating. When a reader marks whether an article was helpful, only the vote itself and an anonymised salted hash of the source address, separate for each article, are stored — it does not allow restoring the address and serves to limit repeat voting. Aggregated article helpfulness summaries are visible only to the Site owner; counters are not shown publicly. This information is not used for advertising and is not linked to enquiries.
• Personal account data. Only with separate consent for the account: the selected sign-in method — a Yandex ID or VK ID user identifier issued to the Site’s application, a Russian mobile phone number (SMS sign-in) or an email address (email sign-in); linked sign-in methods and the dates they were confirmed; the password — only as an irreversible hash that does not allow the password to be recovered; technical data about sessions and one-time codes in protected form; the revisions, checksums and texts of account consents and the history of their granting and withdrawal (section 6.2).

Operations on data: collection, recording, systematisation, accumulation, storage, clarification, retrieval, use, provision of access to authorised persons, transfer (provision of access) to the persons specified in section 7, blocking, deletion, destruction. The processing method is mixed: both with and without the use of automation tools. Special categories and biometric data are not requested. Data are not collected covertly: web analytics operate only after your consent.

Do not submit through the open form, by email or on Telegram any documents, special categories of personal data, third-party information or confidential materials. The document-exchange channel is agreed by the parties separately. An enquiry can also be sent through your AI assistant: the assistant shows you the draft and the consent text and submits the enquiry only after your explicit confirmation; the transmitted enquiry details pass through the service in which the assistant operates and are stored with a mark that they were sent via an assistant. An enquiry is informational in nature: it does not oblige the sender to purchase services, or the Operator to provide them; rights and obligations arise only upon conclusion of an agreement.

3. Processing purposes

Data are processed for the purposes entered in the operator register:

• Preparation, conclusion and performance of an agreement — consideration of the enquiry, communication via the specified contact, clarification of the task and discussion of possible cooperation (enquiry and brief data, email correspondence and correspondence on Telegram).
• Collection and analysis of traffic statistics, improvement of the Site's operation — cookies and Yandex Metrica, only with your consent.
• Promotion of services — sending diff.legal's informational and advertising messages: reviews of legislative developments and practice for technology businesses, invitations to events, and information about services (mailing data). Only with your separate consent, given by an optional checkbox in the enquiry form or in the subscription form on the diff.legal/newsletter page, and only via the selected channel: email, SMS to the specified phone number (messenger messages are not sent to phone numbers), or messages on Telegram to the specified username.
• Operation of registration and the personal account — creating the account, verifying access to it, storing and showing the user’s actions with consents and handling the user’s requests (account data, section 6.2). This purpose is entered in the personal data operators’ register; until the entry is made, the account is not enabled.

The terms of the mailing are set out in a separate document — Consent to informational and advertising mailings. Consent to the mailing is not part of consent to processing the enquiry and is not a condition for submitting an enquiry or providing services. You can withdraw from the mailing at any time (section 9).

4. Legal grounds

The record of the choice in the cookie window is processed as necessary for the operation of the Site and does not require consent. Web analytics are conducted on the basis of your consent, expressed by selecting “Accept” in the cookie window (cl. 1 pt. 1 of Art. 6 of 152-FZ). Enquiry data are processed on the basis of consent, confirmed by a separate checkbox before the form is submitted, under the terms of the Consent to Personal-Data Processing (cl. 1 pt. 1 of Art. 6, Art. 9 of 152-FZ); for the preparation, conclusion and performance of an agreement, processing is also necessary for its conclusion and performance (cl. 5 pt. 1 of Art. 6 of 152-FZ). Email correspondence and correspondence on Telegram are processed to answer an enquiry and discuss an agreement concluded at your initiative (cl. 5 pt. 1 of Art. 6 of 152-FZ); requests about personal data — to perform the Operator's obligations under 152-FZ (cl. 2 pt. 1 of Art. 6 of 152-FZ). Mailings are sent on the basis of separate consent to personal-data processing for that purpose and to receiving advertising over telecommunications networks (cl. 1 pt. 1 of Art. 6, Art. 9, pt. 1 of Art. 15 of 152-FZ; pt. 1 of Art. 18 of Federal Law of 13.03.2006 No. 38-FZ “On Advertising”) under the terms of the Consent to Receiving Information and Advertising Mailings. After a mailing opt-out, information about the consent and the opt-out is kept to confirm compliance with the law (Art. 9 part 2, Art. 6 part 1 item 7 of 152-FZ). Personal account data are processed on the basis of separate consent confirmed by a checkbox before sign-in or registration on the terms of Personal Account Consent (Art. 6 part 1 item 1, Art. 9 of 152-FZ). Each consent may be withdrawn at any time (section 9).

5. Cookies and analytics

Cookies are small records that the Site stores in your browser. The Site has technically necessary records of your settings — the choice in the cookie window and the colour theme — and analytics cookies, which are created only after consent.

5.1. Technically necessary records of settings

The choice in the cookie window is stored in the browser's local storage (localStorage), not in cookies: this record is not sent to the server with every request. Without it, the cookie window would be shown on every visit. The record is created without separate consent. Yandex Metrica's records in the browser storage are created only after consent (section 5.2).

If you select the colour theme with the button in the Site header, the choice (“light” or “dark”) is stored in the browser's local storage and is not sent to the server. In “follow the system” mode no record is created, and on returning to that mode the record is deleted. The record is created without separate consent.

The fact of the choice is also written to a log on the Operator's server: the type of choice (cookie), the status (“accepted” or “rejected”) and the time. The IP address and other information about you do not enter the log; the log is not linked to enquiries.

5.2. Analytics cookies (Yandex Metrica)

The Yandex Metrica service (operator — YANDEX LLC) measures traffic and behaviour on the Site. The Metrica script is loaded, and its cookies and records in the browser storage are created, only after you select “Accept”. If you select “Reject”, they are not created. When consent is withdrawn, the Site deletes Metrica's first-party cookies (on the diff.legal domain, listed in the table below) and Metrica's records in the browser storage; the Site cannot delete cookies on Yandex's domains.

Metrica counts views of the Site's public pages and the addresses of the enquiry-form and subscription-form pages without field contents. Of the address parameters, only the utm_* and yclid advertising tags are passed to Metrica; the remaining parameters, including the selected enquiry subject, are removed from the address before the counter starts. Only the following events and information are passed to Metrica, without contacts or form field contents:

• “enquiry sent” (lead_sent) and “subscription completed” (newsletter_subscribed) — on successful submission of an enquiry or completion of a subscription, without the contact, channel, subject or description;
• “form filling started” (form_start) — once per page view on first input into the enquiry form;
• “click-through to Telegram” (telegram_click) — on clicking the bot link, with the tag of the link's location on the Site, for example the header, footer or a service page;
• “click-through to discuss a service” (service_cta) — on clicking the discussion button of a specific service, with the service identifier: deals, ai-ip or support;
• clicks on external links and file downloads — the address of the link or file, for example a link to the bot on Telegram, without form data;
• the click map — click coordinates and the page element, without field contents; it also works on confirmation pages;
• a “non-bounce” mark for an accurate bounce rate — information that the page view lasted at least 15 seconds, without form data.

The Site uses Webvisor: cursor movements, clicks and scrolling are recorded. Form field contents are not stored in the recording. Input fields and selection lists in the forms are marked for exclusion from the recording. Masking hides entered values; technical form labels, for example the selected method of communication, may be visible in the recording. Webvisor is not used on the separate enquiry and subscription confirmation pages (when the form is submitted without JavaScript); when submitting from the home page, the enquiry number and the brief form are hidden from the recording.

In addition to cookies, after you select “Accept”, Metrica stores records in the browser storage on the Site's domain (localStorage and sessionStorage). If you select “Reject”, they are not created; when consent is withdrawn, the Site deletes them together with Metrica's first-party cookies.

After you select “Accept”, the Yandex service may also set cookies on its own domains (third party): yandexuid, i, yuidss, ymex, usst, yabs-sid, is_gdpr, is_gdpr_b. They are set by the Yandex service on its domains under Yandex's terms; the Site does not create them and cannot delete them. These cookies can be managed in the browser settings and with the Yandex Metrica blocker.

• Withdraw consent or change the choice — the “Cookie settings” link in the Site footer; you can also delete the Site's cookies and data in the browser settings.
• The official Yandex Metrica blocker disables Metrica data collection in your browser on all websites.
• The terms on which YANDEX LLC processes data are set out in the Yandex Privacy Policy; Metrica data are stored on servers located in the Russian Federation.

6. Enquiries, the brief and access to data

Enquiries, briefs and proofs of consent are stored in the application database on a server in Russia. Technical storage is provided by the hosting provider. Backup copies of the database are stored on the server and on the Operator's computer in Russia for no longer than 14 days. Access to enquiries is protected by authorisation. Email correspondence with the Operator, including replies to enquiries by email and requests to support@diff.legal, is stored in the Operator's mail service (section 7). The new-enquiry notification, when email sending is enabled, contains the enquiry number, the selected subject and a link to the protected section, without the contact or task description; the notification is sent to the Operator through that mail service.

Consents to mailings and withdrawals from them are stored in the same database; access to them is protected by authorisation.

The brief is optional; it can be added via a temporary link after the enquiry is submitted. The link key is stored hashed and is valid for one hour. An error when submitting the brief does not cancel the enquiry.

The Site's public reference service for AI agents provides a catalogue of services. It does not receive enquiries, briefs or client documents. The Site's form does not transmit this information to public AI services; Yandex Metrica receives only events without form contents (section 5.2).

6.1. Telegram

The Site has “Write on Telegram” links to the @diff_legal_bot bot.

Writing on Telegram is your initiative and voluntary choice: you can also make an enquiry through the Site's form or by email. If you specified Telegram as the communication channel in the enquiry form, the reply will arrive on Telegram at the specified username; such correspondence is likewise conducted by your choice.

Correspondence goes through the Telegram service, which is operated by a foreign company; Telegram's servers may be located outside the Russian Federation. Telegram processes its users' data under its own rules, which the Operator cannot influence. If you selected the Telegram channel for the mailing, its messages are also sent through this service.

From the correspondence, the Operator receives the Telegram username, profile name and account identifier, and the content of the messages you sent. These data are used to answer the enquiry and discuss a possible agreement, and are stored for the periods specified in section 8.

Do not send documents, confidential information or third-party data on Telegram. The channel for transferring documents is agreed by the parties separately.

The bot link contains the start, for example site_footer. The tag shows only the place on the Site from which the click-through was made and contains no personal data. If you accepted analytics, Metrica receives the click-through-to-Telegram event with this tag (section 5.2).

6.2. Personal account

The personal account is an optional section of the Site. It works only after separate consent and lets you see and manage your consents and sign-in methods. The account does not confirm passport identity and does not open access to other people’s enquiries; previous enquiries and consents are not linked to the account merely by matching contacts.

Sign-in and registration are your choice: via Yandex ID or VK ID (the authorisation data exchange is performed with the respective service), with a one-time SMS code to a Russian mobile number, or with an email address and a password confirmed by a one-time code from an email message. The password is stored only as an irreversible hash and cannot be recovered; one-time codes are valid for a short period and work for a single confirmation. No analytics are used in the account; its cookies are listed in section 5.1.

In the account you can review the history of your consents with their exact texts, grant or withdraw mailing consent, change your password, connect additional sign-in methods and withdraw consent to the processing of data for the account. Withdrawing consent immediately ends the sessions and registers a request to stop processing (section 9). The processing terms are set out in a separate document — the Personal Account Consent.

6.3. Copy of the enquiry in the internal CRM

Received enquiries are duplicated in the Operator's internal customer-relationship management system (CRM) — on the Operator's server in the Russian Federation, with restricted access: only the Operator and employees authorised by it have access.

The CRM receives a copy of: the contact (email address or another channel you specified), the enquiry channel, the requested service, the enquiry text, additional brief details (stage, expected outcome, timing), and the version and date of the consent. The copy is used to process the enquiry, maintain correspondence and keep its history.

The enquiry is stored in the Site database and as a copy in the CRM. If the enquiry is deleted from the Site database (including upon withdrawal of consent), the CRM copy is destroyed at the nearest reconciliation; repeated copying of a destroyed enquiry is excluded.

7. Transfer to third parties

The Operator does not sell your data or transfer it to other persons, except:

• YANDEX LLC — processing of web-analytics data to the extent necessary for Metrica to operate, and only with your consent;
• when signing in to the personal account: authorisation data are transferred to the Yandex ID or VK ID service (VK LLC); the SMS sending service receives the phone number and a one-time code; emails with the account’s one-time codes are sent through the Operator’s mail service (section 6.2);
• the hosting provider — technical placement of the server and storage of the application database;
• the AI assistant service — if the enquiry is sent through an AI assistant: the enquiry details (contact, channel, subject, description) pass through this service before reaching the Operator;
• the provider of the Operator's mail service — storage and transmission of email correspondence through the hello@diff.legal and support@diff.legal mailboxes, including notifications of new enquiries (section 6) and mailing letters, if email is selected for the mailing;
• the Telegram service — correspondence on Telegram, including the reply to an enquiry if you specified Telegram as the communication channel, and the mailing on Telegram if you selected that channel (section 6.1);
• a mailing service that processes data on the territory of the Russian Federation — if the Operator entrusts it with sending mailing messages; the commission is formalised by an agreement in compliance with pt. 3 of Art. 6 of 152-FZ, and the service receives only the data necessary for sending;
• cases directly provided for by the legislation of the Russian Federation.

Cross-border transfer of personal data is not carried out, except for correspondence on Telegram that you start yourself and the mailing on Telegram if you selected that channel (section 6.1). The data are not published and are not disclosed to an unlimited circle of persons.

8. Retention periods

• Enquiry, brief, email-correspondence and Telegram-correspondence data, and proof of consent — until the processing purposes are achieved, but no longer than 3 years from the date of the last interaction. When consent is withdrawn, processing stops and the data are destroyed within up to 30 days, except where the law requires their storage. If an agreement has been concluded between you and the Operator, the data necessary for its performance are processed on that ground during its term of validity and for the periods established by law.
• Mailing data — until consent to the mailing is withdrawn. After withdrawal, personal-data processing for mailing purposes, including the sending of messages, stops immediately, and the data processed for the mailing are destroyed within up to 30 days; information about the fact, date and edition of the consent and about the withdrawal, together with the contact to which they relate, is stored for no longer than 3 years from the date of withdrawal to confirm compliance with the law and is not used for mailings.
• Personal account data — until the purpose is achieved, but no longer than 3 years since the last use of the account, or until consent is withdrawn. Upon withdrawal the sessions stop immediately, a request to stop processing is registered, processing stops and the data are destroyed within 30 days, except where the law requires retention; minimal information about granting and withdrawing consent is kept for no longer than 3 years from the withdrawal date to confirm compliance with the law.
• Web-analytics data — for the periods established by the Yandex Metrica service; cookie lifetimes are specified in section 5.2.
• The record of the choice in the cookie window — until the choice is changed or the browser storage is cleared; the choice log on the server is stored as proof of the choice, without the IP address.
• The hash of the request referrer address — used for rate limiting for an hour after submission; obsolete records are deleted when subsequent form submissions are processed.

Deletion includes the enquiry's related data; restoring a backup copy must not return withdrawn data to operational processing.

The copy of the enquiry in the CRM (section 6.3) is retained for the same period as the enquiry data. Upon withdrawal of consent, the copy is destroyed immediately after the withdrawal is received; re-transfer of the enquiry to the CRM is excluded. A copy may remain in CRM database backups for no longer than 14 days after destruction.

9. Your rights and withdrawal of consent

You may request information about the processing of your data, demand that it be clarified, blocked or deleted, and also withdraw consent.

• Withdrawal of consent to enquiry processing — a letter to support@diff.legal with the subject “Consent withdrawal diff.legal” and the contact specified in the enquiry.
• Unsubscribing from the mailing and withdrawal of consent to it — a letter to support@diff.legal with the subject “Mailing opt-out diff.legal” and the contact to which the mailing arrives, the opt-out link if the message contains one, or a reply “Unsubscribe” to the mailing message if the channel allows replies; every mailing message states the opt-out method. Processing of data for mailing purposes, including the sending of messages, stops immediately; the opt-out does not affect consideration of the enquiry.
• Withdrawal of consent to analytics — the “Cookie settings” link in the Site footer and selecting “Reject”, or clearing cookies in the browser.
• Withdrawing personal account consent — the withdrawal button in the account itself, or an email to support@diff.legal with the subject “Withdrawal of personal account consent”; when withdrawn in the account, the sessions end immediately and processing stops as described in section 8.
• Other requests, including for deletion of email correspondence and Telegram correspondence, — to support@diff.legal.

To protect the data, the Operator may ask you to confirm, with minimal information such as a contact from the enquiry, that the request relates to you. The reply is provided within the periods established by 152-FZ.

Withdrawal of consent is carried out in respect of all copies of the enquiry: the record is deleted from the Site database, the copy — from the CRM and its backups. The total period for carrying out the withdrawal across all copies is no longer than 30 days.

10. Changes to the policy

The current edition is available on this page and takes effect from the moment it is published. A change to the text does not mean that new consent is obtained: the edition and checksum of the consent confirmed when the enquiry was submitted or the subscription completed are stored separately.

11. Contacts

Personal-data operator, Moscow. For personal-data matters: support@diff.legal. For services: hello@diff.legal or Telegram @diff_legal_bot.