Privacy Policy

1. Who we are

seyyr (seyyr.com) is an app about art in Baku: museums and galleries, paintings, ratings and emotions, a taste profile, artist pages and events. The data controller and owner of the service is:

Name: Lita VC LLC (in Russian ОсОО "Лита ВиСи", in Kyrgyz "Лита ВиСи" ЖЧК)
Registered address: 18 Klubny Lane, office 5, Pervomaisky District, Bishkek, Kyrgyz Republic
Registration number: 335054-3301-OOO
Taxpayer ID (INN): 01310202610125
Director: Timur Gadzhiev
Email for data questions: [email protected]
Company registry: Ministry of Justice of the Kyrgyz Republic

This policy explains what data seyyr stores, why, who can see it, how long it is kept and how you can control it. It complements the Terms of Use.

2. What data we store

Only what seyyr's features need. Everything the app stores is listed below.

2.1 Guest profile

On your first visit, your browser receives a sid cookie - a random identifier signed by the server. A profile is created on the server when you first do something: rate a painting, search, spend a few seconds on a painting's page, mark a visit, book an event or arrive through an invitation link. The profile holds its creation time, your interface language and appearance, and the data described below. When you sign in, everything you did as a guest on this device moves into your profile.

Email - the address and the time it was confirmed. The sign-in code arrives by email.
Phone number - the number and the time it was confirmed, if you sign in with your number or confirm it with a code.
Phone number before SMS sign-in launches - while phone sign-in is still being worked on, we save the number you enter on the sign-in screen or in your profile settings, together with the interface language and the time, and link it to your profile, including a guest profile; we do not store your IP address. The number is not verified: no SMS code is sent to it, you cannot sign in with it, and other people cannot see it. We keep it to know how many people are waiting for phone sign-in and to prepare its launch. To delete the number, write to [email protected].
Sign-in codes - 6 digits, valid for 10 minutes, 5 attempts. We store only a salted hash of the code, together with the email or number, IP address, time and browser session: this lets us limit how often codes are requested and protects against code guessing. These records are deleted after 24 hours.
Google - when you sign in with Google, we request only the openid and email scopes and receive your Google account ID, your email address and a flag that Google has verified it; for Google Workspace addresses, also the organization's domain, to check whether Google vouches for the address (we do not store the domain). We store the account ID, this email address and the time it was linked. We do not request your name, photo, contacts or any other Google account data, and we do not store Google tokens. Data from Google is used only to sign you in and link the account to your profile, in line with the Google API Services User Data Policy, including the Limited Use requirements.
Sessions - one per device: the session ID, the profile and the sign-in time. Signing out deletes the session on that device.
Name and nickname - if you add them in your profile settings.

2.3 Ratings, emotions, notes and likes

A rating is the stars, one to three emotions and the time; a new rating of the same painting replaces the previous one. A note on a rating is private: only you see it, and it is not included in shared statistics or in "Compare taste". A like is a "like" mark and its time; a removed like is kept as a "removed" mark.

2.4 Viewing paintings and search

For each view of a painting's page, we store how many seconds it was on your screen and the time of the view. For searches, we store the query text (up to 100 characters), the painting you opened from the results, and the time; your recent searches are shown to you on the search screen. Your taste profile and match percentages with paintings are built from ratings, likes, viewing time, searches and purchases.

2.5 Visits and location

"I'm here" - with your permission, the browser sends your coordinates and their accuracy once. The server calculates the distance to the place and does not store the coordinates. If you are within 200 m of the place and the location is accurate enough, the visit is saved: the place, the time, the distance and the accuracy in metres. If the visit is not confirmed, nothing is saved.
"Been before" - a visit mark without location.
"Near me" in the catalogue - coordinates rounded to about 10 m are kept only in that browser tab and sent to the server with the request for the list of places, to sort the places by distance. They are not saved in the database, but as part of the request address they end up in the web server log (see "Technical logs").

2.6 Events and bookings

You do not need to sign in to book an event: you give your name and phone number. With the booking we store the event, the status of your place, the payment method (transfer to the organizer or demo payment), the amount, the times you booked, paid and arrived, the ticket link and a short entry code, and your language for booking messages. If you gather friends - also the number of places and how long they are held; on the waitlist - your position and the time until which a place is offered to you.

2.7 Purchase requests

You can send a request to buy a work after signing in with a confirmed email or number. We store the work, your message (if you wrote one), the status and dates: requested, sold, received or declined. When you confirm receipt, the work appears in your collection with a record of who you bought it from and when.

2.8 Artists and studios

If you create an artist or studio page, we store everything you put on it: name, page type, about text, photo, links, WhatsApp number and payment details for events, as well as works (title, year, size, price, photo, "sold" and "hidden" marks) and events with their covers. Photos are downsized in the browser before upload and stored on our server together with who uploaded them.

2.9 Invitations and "Compare taste"

Referral code - created for your share links and added to them.
Invitation - when someone opens seyyr for the first time through your link, we record who invited them, the page and type of link, whether they came from a phone or a computer, the time, and later the type and time of their first action.
"Compare taste" - the taste match percentage between a friend and the person who invited them, and the time of the comparison.
Card reposts - which card (rating, taste, art Baku knowledge) you sent or saved.

2.10 Technical logs

Application log - the request method and path, the response code and processing time (no IP address or query parameters), and server errors.
Message log - text messages and service messages about bookings and purchase requests: the recipient's number or email and the text. For emails, only a masked address (first letter and domain), the subject without the code and the delivery result are recorded.
Web server log - IP address, country and city (determined by Cloudflare), time, the request address with parameters, the response code, browser and language, and the page the request came from. Cookies are not recorded.

3. Why we use data

to make seyyr's features work: profile and sign-in, ratings and taste profile, visits and art Baku knowledge, event bookings and tickets, purchase requests, artist pages, invitations and "Compare taste";
to send sign-in codes and service messages about bookings and purchase requests;
to protect the service: limit request rates and investigate errors and abuse;
to compute anonymous statistics - trends, popular paintings, average ratings, numbers of invitations - without names or contacts;
to understand how seyyr is used - how long visits last, whether people come back, where they come from and where they get stuck - with Yandex Metrica.

We process data with your consent and to the extent needed for the service you ask for. You give consent by continuing on the sign-in screen or by using a feature - for example, booking an event; the browser shares your location only after a separate permission.

We do not sell data, share it for advertising or send marketing emails: seyyr's only emails are sign-in codes. seyyr has no ad trackers.

4. Who can see your data

Only you - notes on ratings, search history, visits, tickets, your collection, and the email and number in your profile.
Everyone - a painting's average rating and emotion shares, without names; an artist's or studio's page with everything published on it, except payment details.
Visitors of an event page - the names of people who booked, in short form ("Leyla A."), including in link previews of the event. Friends with a group link see the name of the person who gathered the group.
The event organizer - the name, phone number, booking and payment status of everyone booked for their event. People who booked see the organizer's payment details.
The artist or studio - your name, phone number (or email, if there is no number) and message from a request to buy their work.
Friends in "Compare taste" - a friend who opens your link sees your name or nickname, the match percentage and paintings you both like; the paintings to compare may include your favourites. You see the names or nicknames of those who compared and their percentage.
People you share links with - your ticket shows your name, and share cards show your rating or taste.
The seyyr team - the metrics page shows only numbers: invitations, first actions, sales, reposts - without names or contacts.

We may disclose data where the law requires it.

5. Services that help seyyr run

HostVDS - hosting. The server with the database and uploaded photos is in Latvia (EU).
Cloudflare - content delivery and protection network and the tunnel to the server: all traffic between your browser and seyyr passes through Cloudflare.
Resend - sending sign-in code emails, EU region (Ireland): receives your email address and the email with the code.
Google - Sign in with Google, if you choose it (see "Signing in").
OpenStreetMap - your browser loads map tiles directly from OpenStreetMap servers; they see your IP address and the requested map area.
Yandex Metrica (YANDEX LLC, Russia) - visit statistics: the addresses of pages you open (except ticket, group and "Compare taste" links - Metrica is not loaded there), where you came from, time on pages, clicks and scrolling, device, browser and approximate location by IP address. On public pages - home, places, paintings, evenings, artist pages - Webvisor records actions on the page and what it shows; it is off on profile, cabinet, ticket, diary and taste pages, and text typed into fields and notes on ratings are not recorded. Yandex's terms - Metrica terms of use; you can turn collection off with Yandex's browser add-on or by blocking mc.yandex.ru scripts in your browser.
WhatsApp and email - the "Message on WhatsApp" and "Send an email" buttons open these services when you tap them; the conversation then takes place outside seyyr.

This means data is transferred outside the country where you are: to the EU, Russia and the countries where these services operate. Each of them processes data under its own terms.

Payments. No money passes through seyyr: you pay for a place at an event directly to the organizer, using their payment details, and for a painting - to the artist, as you agree. seyyr uses no payment services and receives no bank card data. The demo payment is an imitation for demonstration: no card is entered and no money is charged.

6. Cookies and browser storage

sid - guest or profile session: signed by the server and not accessible to page scripts; 1 year.
lang and theme - your chosen language and appearance; 1 year.
device - a mark that the device has a touch screen; 1 year.
install_hint and desk_promo - you hid the install tip or the "seyyr is made for your phone" panel; 30 days.
auth_flash - a message after signing in or out; 1 minute.
_ym_uid, _ym_d and other cookies and storage entries prefixed _ym - Yandex Metrica: they tell a new visit from a returning one; up to 1 year.
In browser storage: seyyr-prefs - language and appearance for the offline page; catalog-near - your point for "Near me" sorting, only in that tab; the app cache - interface files and the offline page.

All of these except the Metrica cookies are needed for seyyr to work; there are no advertising cookies. If you delete the sid cookie, the browser loses its link to your guest profile.

7. How long we keep data

sign-in codes are valid for 10 minutes; records of code requests (email or number, IP address, time) are deleted after 24 hours;
data of an unfinished Google sign-in - up to 10 minutes;
cookies - see "Cookies and browser storage";
application and web server logs are overwritten as they fill up;
records of opening the seyyr pitch deck and following the QR code in it (IP address, city, browser, time, link label) - 1 year;
Yandex Metrica data - under Yandex's rules;
everything else - profile, ratings, notes, likes, visits, searches, bookings, purchase requests, artist pages, invitations, the message log - is kept while the profile exists. seyyr has no separate deletion periods yet: we will delete data at your request to [email protected].

8. Your rights

You can:

find out what data about you is stored and get a copy;
correct it: your name and nickname in profile settings, a rating on the painting's page, anything else on request;
delete it - your whole profile or specific data;
withdraw consent: block seyyr's access to your location in your browser settings, remove seyyr's access in your Google account settings, sign out, or ask us to delete your data.

Write to [email protected] from the email linked to your profile, or give the number from your profile - we may ask you to confirm that the profile is yours. We will reply within the time limits set by law. If you have not signed in, your data is linked only to the browser cookie: for us to find and delete it, first sign in on that device - your guest data will move into the profile.

If you believe your rights have been violated, you can contact a personal data protection authority.

9. Children

seyyr is not designed to be used by children on their own. Kids' classes are booked by parents or other legal guardians: the booking contains their name and phone number, not the child's data. If you believe a child has given us their data, write to [email protected] and we will delete it.

10. Security

seyyr is served only over HTTPS. The session cookie is signed and not accessible to page scripts, sign-in codes are stored as hashes, the number of attempts and the rate of code requests are limited, Sign in with Google uses OpenID Connect with PKCE, and the email and number in your profile are shown masked. No system is completely secure: if you notice a vulnerability or a leak, write to [email protected].

11. Changes to this policy

When seyyr starts storing new data or working with a new service, we update this policy and the date at the bottom of the page. The new version applies from the moment it is published here.

12. Contact

Questions and requests about data: [email protected]. Data controller: Lita VC LLC, 18 Klubny Lane, office 5, Pervomaisky District, Bishkek, Kyrgyz Republic.