Privacy Policy

Data controller (operator): VIZOT LLC (Общество с ограниченной ответственностью «ВИЗОТ»), OGRN 1257700503774, TIN 9707053050, registered office: 22 Seleznevskaya St., premises 4/T, Tverskoy municipal district, Moscow 127473, Russia.

Registration number in the Roskomnadzor register of personal data operators: 77-26-54898866.

The CEO is responsible for organizing personal data processing. Contact: hello@wisot.app.

The Android app also has its own detailed policy at wisot.app/en/privacy/app.

The Russian version — the wisot.app website, the web app and the Android app from RuStore or the Russian site. Its data is stored and processed on servers in Russia.

The international version of the Android app (the APK from the English site) stores data in the US and sends session text to OpenAI. Details are in the app policy.

1. Account: an ID, including an anonymous one created automatically when you use the site; your email address if you sign in by email; your first and last name, avatar and Yandex ID if you sign in with Yandex ID; a device ID; sign-in session details — IP address and browser.

2. Age confirmation: the age category, the time, a hash of your IP address and browser details.

3. Session content: the transcript of the audio and, if you turned the microphone on, of your speech; voice labels and names; session settings and projects; questions, answers, grades, messages in your chat with Wisot, summaries; how well topics are mastered.

4. Materials you add: uploaded files and the text extracted from them; screenshots if you take them. The original file is deleted after processing and the frame is not kept — only the text recognized from them is stored.

5. Technical data: IP address, browser and device details, service events and logs that may contain fragments of session text, language-model usage statistics; usage events of the site and the service — pages opened, key buttons pressed, sessions started and ended, errors — linked to your account and to a random browser ID.

6. App downloads and link visits: a hash of your IP address, browser details, the referrer and UTM tags. If you first came through a Wisot partner's personal link (wisot.app/p/…), we record that link and the time we registered it in your account (first touch), and on purchase we copy this mark into the payment record. Visits through other links don't change the first touch.

7. Messages to us and the iOS waitlist: your email address and what you wrote.

8. Analytics, only after your consent: Yandex Metrica receives your IP address, its cookie ID and your actions on the pages. Its Webvisor records actions on the page together with the text shown; on session, history and project pages the text is hidden from the recording.

9. Payments: the email address for the receipt (you enter it yourself, and it may differ from your sign-in address); what was bought, the amount, time and status of the payment, its YooKassa ID; the number of the accepted version of the Terms and the time you pressed “Pay”; refunds and their amounts. YooKassa tells us the masked card details — the first 6 and last 4 digits of the number and the expiry date; we keep only their hash (the card fingerprint). We never receive the full card number or the CVC/CVV code.

10. Hour accounting: the listening time and transcript volume of each session, hours credited, deducted and expired, overage, locked and unlocked summaries, the number of projects, files and screenshots for quotas, the service resources (language-model requests) used by the account.

11. Abuse prevention: a hash of the IP address from which free hours were requested (for IPv6, a hash of the first 64 bits of the address — that is, the network rather than a single device); a hash of your email address brought to a single form (without dots, “+tags” and aliases of the mail domain) or of your Yandex ID; records of the account being suspended and why.

To pick the interface language we match your IP address to a country. Neither is stored.

Audio. Speech is recognized on your device; only text reaches our servers.

Biometric data, location, contacts, camera images.

The full bank card number and the CVC/CVV code: you enter them on the YooKassa page.

We don't sell data, pass it to ad networks or use it for advertising.

• To run the service: account, sessions, questions, answers, summaries, search in your materials, hour and quota accounting. Basis — performance of a contract, i.e. the Terms of Service (Art. 6(1)(5) of 152-FZ).
• To accept payment, credit hours, send the receipt, handle a refund request or a payment dispute and keep accounting records. Basis — performance of a contract (Art. 6(1)(5) of 152-FZ) and obligations under the laws on cash registers (54-FZ) and on accounting (402-FZ) (Art. 6(1)(2) of 152-FZ).
• To confirm age and meet the operator's obligations. Basis — your consent and the law.
• To protect the service from abuse, investigate failures, understand how the service is used and improve it — from usage events; outside the company they leave only as aggregated statistics. Basis — the operator's legitimate interest.
• To make sure free hours go to one person once, to detect fraudulent payments and to automatically suspend accounts with abnormal resource use — the IP address hash, the email or Yandex ID hash, the card fingerprint, resource use. Basis — the operator's legitimate interest.
• To calculate the reward of the partner whose link you came through and to make sure the partner isn't paying for purchases themselves — the first touch and the card fingerprint. The partner doesn't receive your personal data. Basis — the operator's legitimate interest.
• To understand how the site is used — Yandex Metrica. Basis — your consent in the cookie banner, which you can decline.

The service automatically counts how many resources (language-model requests) each account uses per day. If use is far higher than normal studying would need, the account is suspended until the next midnight Moscow time — including when a plan is active. If the overall free load spikes, sessions may temporarily be prevented from starting for accounts without purchased hours.

The decision is based only on the amount of use, without analyzing the content of sessions. You can object to it: email hello@wisot.app and we will review the decision manually.

• a hosting provider in Russia — the servers running the database, file storage and our server;
• Yandex.Cloud LLC (Yandex AI Studio) — session text, fragments of materials and screenshots, to write questions, grade answers, reply to you, write summaries and search your materials; we have switched off request logging at the provider, so it does not keep requests or use them for debugging or model training;
• YANDEX LLC — Yandex ID sign-in and Yandex Metrica (only after consent);
• Unisender Smart LLC (Unisender Go) — delivery of sign-in code emails;
• YooMoney NBCO LLC (ООО НКО «ЮМани», the YooKassa service) — the email address for the receipt, the amount and description of the purchase, to accept payment, send the receipt and make refunds; in a payment dispute — information on how the plan was used. You enter card details on the YooKassa page, they are processed by YooMoney and never passed to us. By law, the receipt is sent through a fiscal data operator to the Federal Tax Service of Russia;
• in the international Android app — Supabase Inc., OpenAI and Google LLC (US), details in the app policy;
• government authorities — on a lawful request.

If this list changes, we will update this page. We don't share data with anyone else without your consent.

• Account, session content and hour accounting — while the account exists. We may delete inactive anonymous accounts.
• After a deletion request or withdrawal of consent, data is destroyed within 30 days unless the law requires keeping it longer.
• Records of payments and refunds (with the email address for the receipt), the accepted version of the Terms and the accounting of paid hours — 5 years after the end of the year in which the payment was made (Art. 29 of Federal Law No. 402-FZ on Accounting), then anonymized. If you delete your account earlier, these records are detached from it and kept until the end of that period — for accounting and in case of a dispute over a payment or refund; the rest of the data is deleted.
• The IP address hash and the email or Yandex ID hash used for abuse prevention, and the partner link first touch — while the account exists. After deletion, only the email or Yandex ID hash with the deletion date remains, with no other data, so that free hours and free summary unlocks are not granted again. Retention period — up to 3 years.
• Anonymized records of consent, age confirmation and account deletion — up to 3 years, to prove the processing was lawful.
• Technical data, logs, download and link-visit records — up to 12 months.
• Messages to us — up to 3 years. The iOS waitlist — until the iOS version ships or until you ask us to remove your address.
• Backups — up to 6 months.
• Yandex Metrica data — under Yandex's rules.

• find out whether we process your data, which data and why;
• ask us to correct, block or destroy data that is inaccurate, outdated or not needed for the purpose;
• withdraw your consent;
• delete your account: in the account settings ("Delete account") or by emailing hello@wisot.app; if you used Wisot without signing in, sign in by email (your data moves into that account) and delete it;
• get a copy of your data on request;
• object to a decision made automatically — for example, an account suspension by automatic protection; we will review it manually;
• complain about our actions to Roskomnadzor or a court.

Email hello@wisot.app with the subject "Personal data request". We answer within 10 business days; the term may be extended by another 5 business days if we tell you why.

Connections to the website and the server are encrypted (HTTPS). Access to database records is restricted by rules tied to the account, and inside the company only those who need data for their work can access it. Services are isolated from each other. IP addresses used for download limits, age confirmation and protecting free hours from abuse are stored only as a hash. The full card number never reaches us, and the card fingerprint is stored only as a hash. Backups are encrypted.

Functional cookies and browser local storage keep the site working: interface language, sign-in, settings, your cookie banner choice, speech recognition models, the visit's UTM tags, a random browser ID for our internal statistics (never shared with third parties), a signed mark of the partner link you came through — to record the first touch.

Yandex Metrica cookies appear only if you press "Accept" in the banner. If you press "Decline", Metrica doesn't load.

Wisot is meant for people aged 14 and over. If we learn that someone under 14 is using the service, we delete the account and the data. A parent or legal guardian can ask us to do this at hello@wisot.app.

We may update this policy. A new version is published on this page and takes effect from the date stated at its top.