Multator
Sign in

Privacy Policy

Policy for processing Multator users’ personal data.

This Personal Data Processing Policy (the Policy) sets out how personal data of users of the Multator online service is processed and protected (multator.org) and is published pursuant to Part 2 of Article 18.1 of Federal Law No. 152-FZ of July 27, 2006, On Personal Data (hereinafter, 152-FZ).

This Policy applies together with the Terms of Service. Consent to personal data processing, when required, is obtained in separate documents or forms and is not incorporated into this Policy or the Agreement.

Last updated: 24 августа 2026 г.

1. Personal data operator

Operator — the operator of the Multator service. Email for legal notices: legal@multator.org, support and complaints: support@multator.org.

Send requests concerning personal data processing to the email address above.

2. Processing principles and legal grounds

The Operator processes personal data lawfully and fairly, limits processing to predetermined purposes, does not combine databases with incompatible purposes and does not collect excessive data. Refusing to provide optional data does not prevent access to the Service.

Legal grounds for processing:

  • performance of a contract (the Terms of Service) to which the data subject is a party (Paragraph 5 of Part 1 of Article 6 of 152-FZ);
  • the data subject’s consent for optional features: push notifications, public profile information and analytics;
  • pursuing the Operator’s legitimate interests while respecting data subject rights: account security, fraud and abuse prevention, and protection of the Operator’s rights;
  • fulfilling obligations imposed on the Operator by Russian Federation law, including tax and information legislation.

Personal data of a person below the age at which they can independently consent is processed with the consent of their parent or other legal representative.

3. Data we process

  • Registration data: name, username, email address, password hash, registration date and email verification status.
  • Profile data: avatar, About me text, date of birth (optional, with visibility settings), privacy and notification settings.
  • Authentication data: two-factor authentication details, registered passkeys, remember-me tokens and sign-in information.
  • External sign-in data: account ID with the sign-in provider, name, avatar and email address, to the extent supplied by the provider.
  • User-generated content: animations and their frames, audio, covers, titles and descriptions, comments, community chat and private messages, likes, ratings, follows, favorites, reports, contest participation and votes.
  • Paid feature data: spider transaction history, payment amounts, dates and statuses, and payment system transaction IDs. The Operator does not receive or store bank card details; these are processed by the payment service.
  • Technical data: IP address, cookies and browser local storage, device and browser details, request dates and times, requested page addresses and error information.
  • Push notification data: browser subscription details, when the feature is enabled voluntarily.
  • Support requests: correspondence with support and any attached information.

The Operator does not request special categories of personal data (race, ethnicity, political views, religious beliefs, health or private sexual life) or biometric personal data. If a User voluntarily includes such information in public content, they choose to make it available to an unlimited audience.

4. Purposes of processing

  • registration, identification, authentication and access to Service features;
  • creating, storing, publishing, displaying and moderating user content;
  • user messaging, chat, comments, follows and contests;
  • providing paid features, accounting for spider transactions, processing payments and refunds, and financial and tax accounting;
  • account security and prevention of fraud, manipulation and abuse;
  • sending service messages (email verification, password resets and account activity notices) and, with separate consent, push notifications;
  • improving the Service, anonymized traffic analytics and error diagnostics;
  • reviewing reports and requests, complying with law and cooperating with authorized government bodies.

Personal data is not used to build preference profiles: content selection principles are explained in the Recommendation Technology Policy. The Operator does not make decisions with legal consequences solely through automated processing.

5. Processing methods, storage and retention

Processing is performed with and without automation: collection, recording, organization, accumulation, storage, updating, retrieval, use, transfer (provision and access), anonymization, restriction, deletion and destruction.

Retention periods:

  • account and profile data — until account deletion, after which it is deleted or anonymized within 30 days;
  • published content — until deleted by its creator or the Administration;
  • chat and private messages — for the period necessary to operate the feature and in cases provided for by information legislation;
  • payment and spider transaction data — for periods established by tax and accounting law (at least 5 years);
  • requests, reports and moderation decisions — for the period necessary to review potential claims and disputes;
  • technical logs — for the period necessary for security and diagnostics.

Backups are retained for a limited period for recovery; deleted information is removed from them during scheduled rotation.

6. Sharing data with third parties

The Operator does not sell personal data. Data may be shared:

  • with infrastructure and service providers supporting the Service (hosting, file storage, email delivery and push notifications), to the extent necessary to provide those services;
  • with payment services when topping up, to the extent necessary to process payments and refunds;
  • with sign-in services when using the relevant account, under their policies;
  • with Yandex Metrika (Yandex LLC) for visit statistics;
  • with YouTube, only if the creator separately permits posting their work on the Service’s channel when publishing;
  • with authorized government bodies in the cases and manner provided for by Russian Federation law.

Cross-border transfers of personal data occur only on the grounds provided by Article 12 of 152-FZ and after notifying Roskomnadzor of the intended transfer. The Operator seeks to minimize the use of foreign services for processing user data.

7. Cookies and analytics

The Service uses cookies and browser local storage:

  • required — maintaining your sign-in session, protecting against forged requests and saving interface preferences (such as appearance). The Service cannot function without these;
  • analytics — Yandex Metrika, which collects visit information: page views, referral sources, device specifications and recordings of on-page actions (session replay and click maps). An account identifier may be sent to Metrika to associate a user’s sessions.

Yandex’s data processing policy: yandex.ru/legal/confidential. You can opt out of analytics cookies by disabling cookies in your browser or using a blocker; core Service features will continue working, but disabling required cookies makes signing in impossible.

8. Security measures

  • identifying security threats and applying legal, organizational and technical measures under Article 19 of 152-FZ;
  • transmitting data over a secure connection (HTTPS) and storing passwords as irreversible hashes;
  • restricting staff and contractor access according to their roles;
  • data backups;
  • two-factor authentication, passkeys and account activity notifications available to users.

If an unlawful transfer of personal data (a leak) is detected, the Operator notifies Roskomnadzor within 24 hours and provides the results of an internal investigation within 72 hours, as required by Part 3.1 of Article 21 of 152-FZ.

9. Data subject rights

You have the right to:

  • obtain information about processing your data, including its purposes, methods, duration and recipients;
  • request correction, restriction or destruction of incomplete, outdated, inaccurate, unlawfully obtained or unnecessary data;
  • withdraw consent to processing; processing necessary for contract performance or required by law may continue to the relevant extent;
  • object to processing based on the Operator’s legitimate interests;
  • appeal the Operator’s acts or omissions to Roskomnadzor (rkn.gov.ru) or a court.

Send requests to legal@multator.org and must include information identifying you (username and account email address and, if necessary, the number of your main identity document), the substance of your request and a signature. A response is sent within 10 working days of receipt; this may be extended by no more than 5 working days with notice to the applicant.

You can update some data yourself in profile settings. Account deletion is available in settings or by request to support@multator.org.

10. Children

The Service is not intended for independent use by children under 14. The Operator does not knowingly collect children’s personal data without their legal representatives’ consent; such data is deleted when identified. Parents and legal representatives may contact legal@multator.org to obtain information on a child’s data processing or request deletion of the data and account.

11. Policy changes

The Operator may update this Policy. The current version is published on this page with its date. Users are also informed of significant changes through the Service.

12. Contact

For personal data processing questions: legal@multator.org. Other contact methods are listed under Contact.