Artisthesis

1. Operator and scope

Personal data operator: ИП Шмуклер Ольга Александровна, INN 771370805407, OGRN 322774600558250, address: 107140, г. Москва, Большой Краснопрудный тупик, д. 8/12, email: info@shmuklergallery.ru.

This policy covers artisthesis.ru, artisthesis.com, the app installed from them and their API.

2. Whose data

Registered users and people who started registration, aged 18 and over. No data is collected from visitors without an account beyond a technically necessary language setting.

3. Purposes, data, bases and retention

Registration, email confirmation and account management: name or nickname, email, a one-way password hash (the password itself is never stored), language, time zone, date and edition of the consent. Basis: consent and performance of the terms. Kept until the account is deleted or consent withdrawn; an unconfirmed registration is kept for 7 days.
Service features: daily practices, library, collection, entry test, chosen topics, journal and notes, history and progress. Basis: performance of the terms and consent. Kept until you delete them or the account.
Service emails: confirmation, password recovery, notices of password or email changes. No marketing emails are sent.
Security: brute-force and abuse protection, session revocation. Email, sign-in time and IP address — the IP is held only in server memory to limit attempts, never stored in the database, for at most 15 minutes. Basis: the operator's legitimate interest.
Aggregate service improvement: sign-up and sign-in dates, completed tests and materials — never journal text. Basis: consent.

4. Operations

Collection, recording, organisation, accumulation, storage, clarification, retrieval, use, depersonalisation, blocking, deletion and destruction; transfer only to the parties in section 5. Processing is automated; no decisions with legal effect are made by automated means alone.

5. Where data is kept and who receives it

Data is stored and processed in the Russian Federation. Infrastructure: Timeweb Cloud — servers and backups, data centre in Moscow; Reg.ru (Registrator of Domain Names REG.RU LLC) — delivery of service emails.
There is no cross-border transfer of personal data.
Data is never sold or shared for advertising; it is disclosed to others only where the law requires.
Offline journal drafts stay in the browser on your device (IndexedDB) and are wiped when you sign out.

6. Health and other special categories

The operator does not ask for or use health data or other special categories. Journal text is visible only to its owner, never to analytics, reports, editors or administrators. Please do not record health details in the journal unless you want them stored in the service.

7. Security

HTTPS with HSTS.
Passwords are salted scrypt hashes; emailed links are single-use and time-limited, and only their hash is stored.
Sign-in attempts are limited; changing the password or email ends every other session and sends you a notice.
Server access is key-only, the database is closed to the network, administrator actions are logged.
Daily backups are kept for 14 days and then deleted automatically.
Personal data incidents are reported to Roskomnadzor within the deadlines of Art. 21(3.1) of 152-FZ.

8. Cookies and browser storage

Artisthesis uses only necessary cookies: the session (to stay signed in) and the language. No third-party, advertising or analytics cookies.

9. Your rights

Requests: info@shmuklergallery.ru. The operator replies within 10 working days, extendable by up to 5 with notice.

Learn how your data is processed and get a copy — the export is in your profile.
Correct your data, delete entries or the whole account — in your profile.
Withdraw consent — by deleting the account or writing to the operator.
Complain to Roskomnadzor or a court.

10. End of processing

When the account is deleted or consent withdrawn, data leaves the live database at once and backups within 14 days, unless the law requires otherwise.

11. Changes

New editions are published here with a date. Current edition: 14 October 2026.