Privacy Policy
1. Controller and Scope
1.1. This Privacy Policy explains how Redacto handles personal data when a user visits the website, creates or uses a Redacto account, purchases a license, receives a license key, signs in to the extension, MS Word add-in, or desktop application, manages installations, validates a license, or contacts support.
1.2. The controller is the Redacto licensor identified in Section 12 of the license offer for individuals. Contact details for privacy requests are listed in the same section.
1.3. This Policy covers the public website, Redacto user accounts, the Chrome browser extension, the MS Word add-in, and the desktop application.
2. Summary
- User text and files: processed locally in the extension, MS Word add-in, or desktop application and not sent to Redacto servers.
- User account: email is used as the login; the original password is not stored. Yandex ID and VK ID are optional login methods that the user may link or unlink.
- Purchase email: used for payment processing, receipt delivery, license key delivery, and license-related service messages.
- Payments: processed through YooKassa; Redacto does not receive or store bank card details.
- Marketing: sent only with a separate opt-in consent and stopped after unsubscribe or consent withdrawal.
- Licensing: the license belongs to the account and covers up to four installations. Client Applications send only sign-in, installation, trial, and license validation data, not user text, files, or masking dictionaries.
3. Data We Process
3.1. During license purchase and payment, Redacto processes the user's email address, local order data, YooKassa payment identifiers, payment amount, payment status, timestamps, and technical metadata needed to issue and deliver the license key.
3.1.1. For each checkout order, Redacto stores an audit record showing that the user accepted the license offer and acknowledged the personal data processing policy. The record includes server-side timestamps, the full wording of the required checkbox confirmed by the user, document versions, and SHA-256 hashes of the document texts current at checkout.
3.1.2. When a user registers or uses an account, Redacto processes the email, its normalized hash and encrypted value, a strong password hash, email verification status, session identifiers and expiry times, IP address, user-agent, mandatory acceptance records, an encrypted TOTP secret, hashes of 2FA recovery codes and, when Yandex ID or VK ID is used, a hash of the provider's technical identifier. Original passwords and provider access tokens are not stored.
3.1.3. During registration or sign-in with email and password, Yandex SmartCaptcha may process the IP address, browser technical data, and a one-time verification token to distinguish a user from an automated request. The one-time token is sent to the backend for validation and is not stored in the account.
3.2. For receipts, Redacto forms and transmits the data required by the applicable tax regime and sends the receipt to the purchaser electronically.
3.3. During Client Application confirmation, license linking and validation, and free-attempt accounting, Redacto processes random account and installation identifiers, application type and version, platform, connection and last-activity dates, hashes of one-time authorizations, access tokens, refresh tokens and installation identifiers, the signed license token, a license key during explicit linking, license status, activation and expiration dates, and the trial counter for the account.
3.3.1. During the transition period, a technical Google OAuth subject hash may be processed for self-service migration of a previously paid Google-bound license. Google email is not used as proof of ownership and does not automatically merge accounts.
3.4. If the user opts in to marketing emails, Redacto processes the email address, consent timestamp, consent source, consent text version, SHA-256 hash of the consent text, subscription status, and unsubscribe data. Each checkout order also stores whether the marketing checkbox was selected for that purchase.
3.5. If the user contacts support, Redacto processes the email address, message content, and any information the user chooses to include in the request.
3.6. Technical logs may temporarily contain request date and time, IP address, user-agent, request URL, processing result, and error details. These logs are used for security, diagnostics, and abuse prevention.
3.7. When checking for desktop updates, the application sends standard HTTP request metadata, application version, platform, and architecture to the distribution server. User documents and account data are not included in update requests.
4. Purposes
4.1. Purchase email and order data are used to enter into and perform the license agreement: process payment, issue a license key, send a receipt, deliver service messages, and provide support.
4.2. Payment and receipt data are processed to comply with legal obligations and to confirm transactions.
4.3. License and installation data is processed to provide one account with access on no more than four installations, validate the license term, account for one shared free attempt, prevent key sharing, revoke an installation or license, and restore access.
4.4. Marketing emails are sent only with prior consent. The user may unsubscribe or withdraw consent.
4.5. Technical logs are processed to keep the website and backend working, investigate errors, prevent fraud, and protect Redacto and its users.
4.6. Account data is processed to register users, verify email, authenticate, restore access, manage sessions and linked login methods, prevent abuse, and respond to support requests. The legal bases include user consent, entering into and performing the agreement, legal obligations, and legitimate security interests.
4.7. Update metadata is processed to deliver an appropriate signed desktop version securely and diagnose distribution errors.
5. How the Client Applications Process Data
5.1. Redacto's core feature is local processing of user text and files in the browser, MS Word environment, or desktop application. User text, files, masking dictionaries, and masking policy settings are not sent to Redacto servers for masking or restoration.
5.2. The extension analyzes text that the user types or pastes on supported websites and in the side panel, detects personal and sensitive entities, replaces them with markers such as [PERSON_1], [EMAIL_1], and [ORG_1], and lets the user restore original values where local state is available.
5.2.1. The MS Word add-in analyzes the current Word document in .docx format, a selected fragment, or text available through the add-in interface, applies the same local masking rules, and lets the user restore original values where add-in local state is available.
5.2.2. The desktop application processes selected files in device memory. To display an Office document, a separate local process of the bundled LibreOffice creates a temporary PDF representation; external relationships are removed from the working copy, and temporary files and profiles are deleted after processing.
5.3. Local detection may use a built-in NER model running through ONNX Runtime and WebAssembly, as well as local rules. These computations run on the user's device.
5.4. The extension and desktop application process supported files, including .txt, .csv, .docx, .xlsx, and .pptx, locally. The MS Word add-in works with the current .docx document. If the user creates a JSON dictionary, it may be password-protected locally.
5.5. The extension keeps the client session and license token in the trusted service worker context; content scripts cannot access them. The add-in uses isolated Office-origin storage. The desktop application stores a random installation identifier locally and writes session tokens to disk only through operating-system protected encryption. If protected storage is unavailable, the session lasts only until the application closes.
5.6. To sign in, a Client Application creates a one-time PKCE authorization and opens the common Redacto page in the browser or Office Dialog. After confirmation, the application receives a client session and license token. Passwords and Yandex ID or VK ID secrets are never entered inside the Client Applications. One free attempt is counted by account and shared across all products.
5.7. The user can delete local data by uninstalling the Client Application, clearing extension or site data, signing out, or using built-in browser, MS Word, and operating-system controls.
6. Chrome Web Store Limited Use Disclosure
6.1. The use and transfer of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.
6.2. Redacto uses data obtained through Chrome APIs only to provide or improve its single purpose: local sensitive data masking and restoration with license activation and validation.
6.3. Redacto does not sell user data, does not transfer user data to advertising platforms or data brokers, does not use user data for personalized advertising, retargeting, credit scoring, or lending decisions, and does not use user text or files to train external AI or machine learning models.
7. Third Parties and External Services
7.1. YooKassa is used to process payments. After the user submits the license purchase form, the payment form may load the official widget and YooKassa/YooMoney resources required for payment. Bank card details are entered into the payment form and are not transmitted to Redacto.
7.2. An SMTP provider may be used to deliver license keys and service messages. Only the data necessary to send the email is provided.
7.3. If the user has opted in to marketing, Redacto may export the email address, consent timestamp, consent version, and unsubscribe URL to an external email service. Marketing emails are not sent without separate consent.
7.4. Receipt and transaction data may be transmitted to tax authorities where required by applicable law.
7.5. Redacto may use technical providers for hosting, domain, email, and infrastructure. Such providers may access data only as needed to provide their services.
7.6. If the user selects Yandex ID or VK ID, the user is redirected to that provider. The provider processes data under its own terms, while Redacto receives the technical identifier and email required for authentication. Redacto does not automatically merge accounts solely because provider emails match; linking occurs only after the user has signed in to the existing Redacto account.
7.7. Yandex SmartCaptcha may be used to protect registration and sign-in with email and password from automated attacks. The widget loads Yandex Cloud resources, and the backend sends the service a one-time verification token and the user's IP address. Yandex ID and VK ID use separate sign-in flows and do not require this check.
7.8. Google OAuth is used only during the transition period to confirm a legacy license binding. The Google subject is hashed, and Google email is not used for migration.
7.9. The desktop application receives signed updates from downloads.redactoapp.ru. LibreOffice runs locally as a separate third-party component and does not receive account or license data.
8. Retention
8.1. Personal data is retained no longer than necessary for the purposes described in this Policy, unless a longer period is required by law, contract, or legitimate rights protection.
8.2. The purchaser email is stored in minimized form: a hash is used for order lookup and audit, while the original value is stored encrypted only where needed for license delivery, service retry, or mandatory legal requirements.
8.3. Raw license keys issued after payment are stored only encrypted and only for a limited period required for service re-delivery. After that period, only the key hash and public license data remain.
8.4. Marketing consent is retained until unsubscribe, withdrawal, or termination of marketing activities. After unsubscribe, the encrypted email used for marketing is cleared, while a hash may remain in a suppression list to prevent renewed sending without new consent.
8.5. Checkout consent audit records, including the wording of the required checkbox, are retained with the related order data for contract and legal proof purposes. They do not include IP address or user-agent.
8.6. Technical logs are retained for a limited period necessary for diagnostics, security, and incident investigation.
8.7. Active account data is retained while the account is used. After account deletion, data is deleted or anonymized except where retention is required by law, contract performance, dispute resolution, or abuse prevention. Expired or revoked sessions and one-time tokens are subject to periodic cleanup.
8.8. Active installation data is retained until revocation or account deletion. The technical Google binding and migration record are retained for 12 months from the migration date and then deleted. Account license ownership and order history remain subject to the general retention rules of this Policy.
9. Security Measures
9.1. Redacto applies organizational and technical measures to protect personal data, including data minimization and separation between payment, account, licensing, and local processing in the Client Applications.
9.2. Purchaser email is stored as a hash and encrypted value. Encryption and token-signing secrets are kept separate from public code.
9.3. User text, files, masking dictionaries, and Client Application settings are not accepted by the account, payment, or licensing backend.
9.4. Redacto does not use user text or files for advertising, profiling, credit scoring, or training external AI or machine learning models.
9.5. Passwords are protected by a strong salted password-hashing function. Server sessions and one-time links are stored as hashes, and sensitive account values are encrypted. State-changing requests use cross-site request forgery protection, exact origin checks, and rate limiting.
9.6. The desktop application isolates its interface from file-system and process access, exposes only a fixed IPC command list, validates license tokens locally, and installs a signed update only after user confirmation.
10. User Rights and Choices
10.1. Users may request information about their personal data, correction, restriction, or deletion where applicable.
10.2. Users may withdraw marketing consent. Withdrawal does not affect processing that occurred before withdrawal and does not prevent processing required to perform the license agreement, send receipts, comply with law, or protect rights.
10.3. Privacy requests should be sent to the controller contact listed in Section 12 of the license offer. The request should include the email used for the account, purchase, or support and describe the request. Redacto may request information needed to confirm the user's connection to an account, order, or license.
11. Emails, Cookies, and Analytics
11.1. Redacto does not use its own web analytics, tracking pixels, or marketing email open/click tracking on the landing page.
11.2. The YooKassa payment widget loads only after the user submits the license purchase form. Within the payment form, YooKassa may use its own cookies, local storage, and network requests necessary to process the payment.
11.3. Service emails about registration, email verification, access recovery, purchase, receipt, license key, license status, and support are not marketing emails. Marketing emails are sent only with separate consent.
12. International Transfers
12.1. Redacto aims to store the purchaser database containing personal data of Russian citizens in the Russian Federation.
12.2. If email, mailing, support, hosting, or other infrastructure providers involve international transfer of personal data, such transfer is performed only where a valid legal basis exists and applicable law is followed.
13. Changes to This Policy
13.1. Redacto may update this Policy when the product, payment flow, data categories, law, or Client Application distribution requirements change.
13.2. The new version takes effect when published on the website unless it states otherwise.