Personal data processing policy

This policy applies to rank.ru and its Russian and English versions. The operator is NOVYE INFORMATSIONNYE SISTEMY LLC, Tax ID 7729697022, Registration ID 1117746963619, 10/96 Michurinsky Prospekt, Moscow, Russia. Contact: admin@administrator.ru. This policy addresses Russian Federal Law No. 152-FZ on personal data.

• Page delivery and requested checks: public domain, mode, language, request time and public technical website information. Legal basis: providing the service at the user’s initiative, Article 6(1)(5).
• Security and diagnostics: connection IP, time, request URL, User-Agent and technical errors. Application limits store HMAC identifiers of IPs and domains rather than raw IPs; this is pseudonymisation, not guaranteed anonymisation. Legal basis: legitimate interests in service protection subject to individual rights, Article 6(1)(7).
• Email requests: sender address, name if supplied, message and attachments voluntarily sent to the operator. Bases include pre-contractual or contractual steps initiated by the sender, legitimate interests in responding and protecting rights, and legal duties for statutory requests.

Data subjects include visitors, administrators, correspondents and people whose information may appear in scanned website metadata. Biometrics, special categories and advertising profiles are not requested.

Processing is automated and may involve authorised staff: collection, recording, organisation, storage, correction, retrieval, use, necessary access, restriction, deletion and destruction. Reports, domains, scores and metadata excerpts may be published in the registry and accessible to search engines. Correspondent contact details and visitor technical identifiers are not included in reports. Do not submit URLs containing secrets or private account addresses. Public availability alone does not grant unlimited permission to distribute personal data: the operator reviews restriction and deletion requests; where consent is required, it is obtained separately, including separate consent to distribution under Article 10.1.

Rate-limit records are retained for at most 24 hours and pruned on requests and scheduled maintenance. Reports and registry entries are retained for up to 365 days after the last check, then removed by maintenance; a new check replaces the report. Score history is limited to 16 entries. Previews and error logs are retained for up to 30 days; logs also have a size limit. Administrator sessions have an inactivity period of up to two hours. Email requests no longer needed are deleted when their purpose is fulfilled and no later than one year, unless statutory retention applies. Working files are deleted; backups expire under the operator’s cycle, within 30 days after deletion. The operator must configure hosting access/error logs and backups for retention of up to 30 days.

Necessary access is provided to authorised staff and hosting and email providers under legally required confidentiality arrangements. Initial recording and storage of Russian citizens’ data must use databases in Russia; the operator ensures this through hosting selection. The application uses no external analytics and does not send submitted domains to AI providers. Checks contact public servers, including foreign servers, and DNS; the application does not forward visitors’ source IPs. External report images load in the browser only after a separate click and reveal the browser IP and technical information to the image host. Linked websites apply their own policies. Any new cross-border personal data transfers require compliance with Article 12, including applicable notifications.

You may request information, correction, restriction or destruction, object to unlawful processing, withdraw separately given consent and complain to Roskomnadzor or a court. Email admin@administrator.ru with the subject “Rank.Ru — personal data” and identify the affected data or report. The operator requests only necessary verification of identity or authority. Data access requests are answered within 10 working days, with a justified extension of up to 5 working days. After consent withdrawal, processing stops and data is destroyed within statutory periods, generally up to 30 days unless another legal basis applies. Silence, browsing and dismissing the cookie notice do not constitute consent.

Safeguards include access controls, HTTPS in deployment, protected administration sessions, password hashing, form protection, rate limits, locks and private file storage. The operator organises backups, access management, scheduled deletion and incident response, including statutory Roskomnadzor notifications. Revised policies are published here; expanded processing does not replace any required separate consent.

A request to block future checks requires retaining a minimal administrative record of the domain and restriction status until an authorised person lifts it. This prevents scans from resuming after a report is deleted. The report and its metadata are removed when retention expires; the restriction record contains no correspondent contact details.