Privacy Policy

and consent to the processing of personal data · Normido · normido.com · revision 1.1 of 11.06.2026

This is an English translation provided for convenience. The service is operated under the laws of the Russian Federation; the Russian-language version prevails. The original (governing) document is available at normido.com/privacy.

This Policy has been developed in accordance with Federal Law No. 152-FZ of 27.07.2006 "On Personal Data" and describes what data the Normido service processes, for what purpose and how it is protected. By using the Service, you give your consent to the processing of data on the terms set out below.

1. Operator

The operator of personal data is Individual Entrepreneur Vitaliy Aleksandrovich Kuvakin (OGRNIP 321665800179025, INN 661219700419, date of registration 13.10.2021), Yekaterinburg, Sverdlovsk Region, Russian Federation. Website: normido.com. Contact for enquiries regarding personal data: kuvakinnn1986@gmail.com.

The operator is included in the register of operators carrying out the processing of personal data, which is maintained by the Federal Service for Supervision of Communications, Information Technology and Mass Media (Roskomnadzor) [record registration number: ___ — to be specified].

2. What data is processed

Phone number — for registration and protection against the repeated creation of accounts. Stored as an irreversible hash (SHA-256 with salt); the number itself is not stored in plain text.
Telegram identifier (user_id), interface language.
Profile questionnaire: sex, age, height, weight, activity, goal, allergies and (optionally) information about state of health, diet, supplements, lab test indicators — which you enter yourself.
Nutrition diary: descriptions/results of food analysis, dates and statistics.
Technical data about payments (transaction identifier, amount) — without bank card data (payment is processed by Telegram / the payment provider).

Photos of food and forms are processed "on the fly" for analysis and are not stored in the Service's database as images.

Special categories of personal data (health data). Some of the information that you may enter voluntarily (information about state of health, pregnancy and breastfeeding, diet, supplements taken, numerical indicators from forms) relates to a special category of personal data within the meaning of Article 10 of Federal Law No. 152-FZ. Its processing is carried out exclusively on the basis of your separate consent (in the form of an electronic document), which you give before entering such data, and only for the purposes of providing the functions of the Service (calculation of approximate norms, reference prompts, keeping a personal diary of indicators). The Service processes this data for reference and informational purposes and does not use it for making a diagnosis, treatment or other medical activity. Entry is optional — without it the main functions remain available. You may withdraw your consent at any time by writing to the Operator's e-mail; after withdrawal, processing ceases and the data is deleted (with the exception of anonymized statistics).

3. Purposes of processing

provision of the functions of the Service (nutrition analysis, calculation of norms, keeping a diary);
registration, identification, protection against fraud and abuse;
acceptance of payment and provision of access to paid tariffs;
user support and improvement of the Service.

4. Transfer to third parties and cross-border transfer

4.1. For the operation of the Service, data is transferred to processors acting on behalf of the Operator:

Telegram (Telegram Messenger Inc.) — delivery of messages and processing of payments;
OpenAI (OpenAI, L.L.C., USA) — processing of text and images for food recognition and nutrient calculation by means of artificial intelligence;
TimeWeb — hosting and storage of the database on servers located in the Russian Federation.

4.2. Cross-border transfer. When processing a request, part of the data (the text of your message and/or the image of the food) is transferred to the processor OpenAI, L.L.C., located in the USA. The USA is not included in the list of countries ensuring adequate protection of the rights of personal data subjects. The legal basis for such transfer is your consent, as well as the necessity of performing the contract (offer) to which you are a party (Article 12 of Federal Law No. 152-FZ). The transfer is carried out to the minimum necessary extent solely for the performance of the analysis; photos are not stored by the processor as part of the Service. You have the right not to give such consent — in that case the AI analysis functions will be unavailable.

4.3. The initial recording, systematization and storage of the personal data of citizens of the Russian Federation are carried out in databases located in the territory of the Russian Federation (Part 5 of Article 18 of Federal Law No. 152-FZ). The data is not sold to third parties.

5. Storage period and protection

5.1. Personal data is stored on servers in the Russian Federation for the duration of the use of the Service and until the purposes of processing are achieved or until the consent is withdrawn (whichever occurs earlier). After withdrawal of consent or deletion of the profile, the data is deleted or anonymized within no more than 30 days, with the exception of information that the Operator is obliged to store by law (for example, settlement data for the purposes of accounting and tax records — for the periods established by law) and anonymized statistics.

5.2. Organizational and technical protection measures are applied: restriction of access to data, encryption of the communication channel (HTTPS), storage of the phone number as an irreversible hash, and refusal to store photos. The cross-border transfer of certain data to the processor OpenAI, L.L.C. (USA) is carried out in the manner described in clause 4.2 of this Policy, to the minimum necessary extent.

6. Your rights (Article 14 of Federal Law No. 152-FZ)

to obtain information about the processing of your personal data, its purposes, methods and the composition of the data;
to demand the clarification (correction), blocking or deletion of data if it is incomplete, outdated, inaccurate, obtained unlawfully or not needed for the stated purpose;
to withdraw consent to processing (including consent to the processing of health data and to cross-border transfer) at any time;
to appeal against the actions or inaction of the Operator to Roskomnadzor or in court.

6.1. To exercise your rights, write to the Operator's e-mail (kuvakinnn1986@gmail.com). You can delete your profile and the data associated with it on request or with the command /delete in the bot. After deletion, the data is erased or anonymized in the manner set out in clause 5.1; anonymized statistics may be retained.

6.2. Withdrawal of consent does not affect the lawfulness of the processing carried out before its withdrawal. After withdrawal of consent, the provision of functions for which this data is necessary (including AI analysis) may be terminated.

7. Consent

By pressing the confirmation button in the bot (or by continuing to use the Service), you confirm that you have read this Policy and the Public Offer, agree to the processing of personal data (including health information — where it is voluntarily entered) and understand that the Service is not a medical service.