Version of 6 October 2026. In force from 6 October 2026.
Courtesy translation. This English text is provided for convenience only and is not legally binding. Only the Russian text is binding, and it prevails over this translation in any discrepancy.
This policy describes how sole proprietor Artem Vitalievich Potykun (OGRNIP 325508100092492, INN 504418067410), the "Operator" or "HireHub", processes the personal data of users of the HireHub service: the website naimhub.work, the application app.naimhub.work, the HireHub Telegram bot, the API and the MCP server (the "Platform"). The policy follows Federal Law No. 152-FZ of 27.07.2006 "On Personal Data".
1. Operator
1.1. The personal data operator: Индивидуальный предприниматель Потыкун Артём Витальевич, INN 504418067410. State registration: OGRNIP 325508100092492, 18.02.2025, Межрайонная инспекция Федеральной налоговой службы № 23 по Московской области. Address: 141506, Московская область, г. Солнечногорск.
1.2. Requests about personal data, including withdrawal of consent and deletion requests, go to atmpotn@yandex.ru or through support in the application.
2. Whose data we process
2.1. Customers and their representatives, Specialists, Referrers, Managers and website visitors.
3. What data and why
3.1. Sign-up and sign-in. The identifier, username, name and profile photo from Telegram, Yandex ID or VK ID, the e-mail address if the sign-in service provides it, the interface language. Purpose: to create and maintain the Account. Basis: performance of the contract.
3.2. Specialist profile and resume. Name, photo, specialty, skills, work experience, education, portfolio, rate, the resume file and the text extracted from it. Purpose: to show the profile to Customers and to match tasks. Bases: performance of the contract (resume parsing and filling in the profile when a Specialist is admitted), consent to the processing of personal data and, for showing the profile in the catalogue, consent to the processing of personal data permitted for distribution.
3.3. Work on the Platform. Tasks, comments, messages, files, time records, reviews, support requests, ideas and bug reports. Purpose: performance of contracts. Basis: performance of the contract.
3.4. Money. Balance operations, payment and refund details, the e-mail for cash receipts, the payout profile of a Specialist, Referrer or Manager: full name, INN, tax status, bank details. The Operator does not receive bank card data: JSC "TBank" processes it. Purposes: settlements, payouts, cash receipts, accounting and tax records. Bases: performance of the contract and the Operator's legal obligations.
3.5. Security. IP address, the country determined from the IP address, device and browser type, sessions, action logs, contact filter hits and the risk score. Purposes: protecting Accounts, preventing fraud and bypassing of the Platform. Basis: the Operator's legitimate interest and performance of the contract.
3.6. Notifications. The Telegram chat identifier, the browser notification subscription. Purpose: notifications about tasks, money and security. Bases: performance of the contract and consent to receive notifications.
3.7. The Operator does not ask for special categories of personal data (health, racial or ethnic origin, political views, religious beliefs, private life) or biometric data. If a user has included such information in a resume or a message, the Operator does not use it to make decisions. The artificial intelligence model that checks an image looks in it only for violations of the Platform Rules and does not describe the people in it.
4. How we process data
4.1. The Operator collects, records, organises, accumulates, stores, updates, retrieves, uses, transfers (provides and gives access to), depersonalises, blocks, deletes and destroys personal data, with and without automation.
4.2. The texts, files and images that a user writes and uploads on the Platform are checked automatically for compliance with the Platform Rules. The check is part of the Operator's services under the contract with every user and is performed for all users alike: first by rules on servers in the Russian Federation, then by artificial intelligence models that run on the cloud platforms in section 7. The resume file that a Specialist sends for admission to Tasks is parsed by an artificial intelligence model to fill in the profile; the Specialist reviews the profile and may correct any field. For the admission decision the model receives only the resume details needed for the assessment: field of work, skills, positions and the description of duties, education, links to work. The name, date of birth, city and contacts are not passed to the model. Measures for violations are applied by the Operator's staff member, not by a program. A user may contest the result of a check through support, and the Operator replies to such an objection within 30 days.
4.3. A user's rating is calculated automatically and affects the order of results in the catalogue. It creates no legal consequences for the user.
4.4. The HireAgent assistant runs on artificial intelligence models outside the Russian Federation and is available only to a user who has given consent to cross-border transfer of personal data for HireAgent.
5. Where data is stored
5.1. Recording, organising, accumulating, storing, updating and retrieving the personal data of citizens of the Russian Federation take place in databases located in the Russian Federation: on the server and in the file storage of ООО «РЕГ.РУ» in the Russian Federation.
5.2. After being recorded there, data may be transferred abroad in the cases of section 7.
6. Who receives data
6.1. Data is processed on the Operator's instructions by, and transferred to:
- ООО «РЕГ.РУ»: the Operator's server in the Russian Federation, databases, the running Platform and file storage (profile photos, resumes, attachments, portfolio, backups);
- JSC "TBank": card payments, cash receipts, payouts to Specialists, Referrers and Managers, the Operator's account statements, linking the self-employed in the "My Tax" application;
- the Federal Tax Service of Russia: checking the status of a payer of the tax on professional income by INN;
- LLC "Yandex" (Yandex ID) and LLC "VK" (VK ID): signing in to the Platform, if the user chose that method;
- Telegram (Telegram Messenger Inc. and affiliated companies): the Telegram bot, signing in with Telegram and notifications;
- OpenRouter, Inc. (USA), Microsoft Corporation (USA, Microsoft Azure) and Google LLC (USA, Google Vertex AI), as named in section 7: automatic checking for compliance with the Platform Rules and resume parsing for all users, HireAgent only for users who have given consent to cross-border transfer for HireAgent;
- browser notification services (Google, Apple, Mozilla, Microsoft): delivering browser notifications in encrypted form.
6.2. The user's country is determined from the IP address on the Operator's servers using the DB-IP database (IP Geolocation by DB-IP). IP addresses are not sent to DB-IP.
6.3. The Operator provides data to state authorities only where the law requires.
6.4. The other side of a deal (the Customer or the Specialist) sees the name, photo, profile, messages and actions in shared tasks. Contact details are not passed to the other side.
7. Cross-border transfer
7.1. Data is transferred abroad only after it is recorded in databases in the Russian Federation, and only for the purposes and to the extent set out in this section.
7.2. Automatic checking and resume parsing. Recipients: OpenRouter, Inc. (USA); Microsoft Corporation (USA), Microsoft Azure; Google LLC (USA), Google Vertex AI. OpenRouter, Inc. (USA) sends requests only to the servers of cloud platforms in the USA that do not store the data passed to them and do not train models on it: Microsoft Azure (Microsoft Corporation, USA) and Google Vertex AI (Google LLC, USA). Models of the developers OpenAI, Google and Anthropic run on these platforms; the model developers themselves receive no data. Purposes: automatic checking of messages, tasks, comments, files and images for compliance with the Platform Rules; parsing the resume file to fill in the Specialist's profile. Data: the text or image being checked and the text of the resume. The models are not given the user's name, the account identifier, the contact details found by the check on servers in the Russian Federation, or image metadata. Bases: performance of the contract with the user (clause 5 of part 1 of Article 6 of Federal Law No. 152-FZ) and, for information about third persons in the texts and images being checked, the Operator's legitimate interest in enforcing the Platform Rules (clause 7 of part 1 of Article 6).
7.3. HireAgent. Recipients: the same as in clause 7.2. Purposes: HireAgent's answers and actions, the first steps on the Platform with HireAgent, HireAgent's digests. Basis: the user's consent to cross-border transfer for HireAgent.
7.4. Telegram (Telegram Messenger Inc. and affiliated companies, servers in various countries, including countries that do not ensure adequate protection), if the user themselves uses the Telegram bot or signing in with Telegram. Basis: performance of the contract.
7.5. Browser notification services (Google LLC, Apple Inc., Mozilla Corporation, Microsoft Corporation, USA), if the user themselves turned on browser notifications. Basis: performance of the contract.
7.6. The Operator's relay server in the Netherlands, through which requests to the recipients in clauses 7.2-7.4 pass over encrypted connections. The server stores no personal data.
7.7. The USA, the Netherlands and the countries of Telegram's servers, except those on Roskomnadzor's list, do not ensure adequate protection of personal data subjects' rights. The recipients in clauses 7.2 and 7.3 receive requests only on those servers that do not store the data passed to them and do not train models on it.
7.8. The Operator notifies Roskomnadzor of the cross-border transfer before it starts.
8. Retention periods
8.1. Account, profile, task and correspondence data are kept while the Account exists.
8.2. The resume file is kept for 180 days after upload and then deleted. Information moved from the resume to the profile is kept while the profile exists.
8.3. Primary accounting documents, cash receipts and the information for them, including the e-mail for receipts, are kept for 5 years after the end of the year they were drawn up, including after the Account is deleted. This is required by tax and accounting law.
8.4. Server logs are kept for 14 days, the MCP server call log for 90 days, the staff action log for 180 days. A sign-in session ends after 30 days without use. An API key unused for 365 days is revoked.
8.5. Contact filter hits are kept while the Account exists. The risk score counts hits of the last 90 days.
8.6. After an Account is deleted, its data is deleted or depersonalised within 30 days, except the data in clause 8.3 and data needed to complete settlements and resolve disputes.
9. User rights
9.1. A user may obtain information about the processing of their data, require it to be updated, blocked or destroyed if it is incomplete, outdated, inaccurate, unlawfully obtained or not needed for the stated purpose, withdraw consent, and appeal the Operator's actions to Roskomnadzor or in court.
9.2. The Operator answers a request within 10 business days. The period may be extended by 5 more business days, and the Operator will explain why.
9.3. Withdrawing consent. The user sends a request to atmpotn@yandex.ru or through support in the application. Consent to receive notifications can also be turned off in the notification settings. After withdrawal the Operator stops the processing based on that consent within 30 days, unless it has another lawful basis.
9.4. Deleting the Account. The user sends a request through support in the application or to atmpotn@yandex.ru. Settlements are completed before deletion: the unspent advance is returned and the accrued remuneration is paid.
10. Cookies and local storage
10.1. The Platform uses only the cookies and browser local storage entries it cannot work without. There are no third-party analytics or advertising counters on the Platform.
10.2. Cookies:
- sign-in session: keeps the user in the Account;
- chosen Referrer: remembers a visit through a referral link until sign-up;
- sidebar state: open or collapsed;
- staff session: for staff only, when an Account is reviewed on request.
10.3. Browser local storage: theme, language, panel widths, text drafts, recent searches, a mark that the user declined to install the application. The application also keeps a copy of its interface files in the browser to open faster and work on a weak connection.
10.4. The user can delete cookies and local storage in the browser settings. After that the user will need to sign in again.
11. Data protection
11.1. The Operator applies legal, organisational and technical measures: encrypted connections, role-based staff access, two-factor authentication for staff, action logging, backups.
11.2. Only staff with a separate right can access original texts hidden by the filter.
12. Changes to the policy
12.1. The Operator may change the policy by publishing a new version with its effective date. The current version is always available at naimhub.work/docs and in the application.