Privacy Policy

1.1. This Privacy Policy ("Policy") sets out how Magecut ("Operator," "Service") processes and protects users' personal data. 1.2. This Policy has been prepared in accordance with Federal Law No. 152-FZ of July 27, 2006, "On Personal Data" (as amended through 2026), Federal Law No. 149-FZ of July 27, 2006, "On Information, Information Technologies, and Information Protection," and other Russian Federation regulations concerning personal data. 1.3. By using the Service, the User agrees to this Policy. If you disagree, you must stop using the Service. 1.4. This Policy applies only to Magecut. The Operator does not control and is not responsible for third-party websites and services that the User may access through links available in the Service.

2.1. The Operator may process the following personal data: • Last name, first name, and patronymic; • Email address; • Phone number (if provided); • Social media account data (when using OAuth); • IP address, cookies, browser, and device information; • Usage data (uploaded files, projects, activity history); • Payment information (processed via certified payment agents); • Other data voluntarily provided by the User. 2.2. The Operator does not process special categories of personal data (biometric, health, political views, etc.).

3.1. Personal data is processed for: • User registration and identification; • Providing access to Service features; • Order processing and payments; • Communication (notifications, support, newsletters); • Service improvement and new feature development; • Statistical and analytical research; • Compliance with Russian Federation law; • Fraud prevention and security. 3.2. Processing is based on: user consent (Art. 6(1)(1) FZ-152), contract performance (Art. 6(1)(5) FZ-152), and legitimate interests (Art. 6(1)(7) FZ-152).

4.1. Processing includes collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, transfer (provision, access), anonymization, blocking, deletion, and destruction. 4.2. Processing is performed both with and without automation. 4.3. The period of personal data processing is determined by the achievement of the purposes for which the data was collected, unless a different period is established by law. 4.4. Personal data is stored within the Russian Federation in accordance with Part 5 of Article 18 of FZ-152 (2026 edition).

5.1. The Operator may transfer personal data to third parties when: • The User has given explicit consent; • Transfer is necessary for the Service functionality; • Transfer is required by Russian law; • Transfer is necessary to protect the rights and legitimate interests of the Operator or third parties. 5.2. The Operator may engage the following categories of third parties: • Payment systems and banks — to process payments; • Hosting providers — to store data; • Analytics services — to analyze use of the Service; • Cloud computing providers — to process video data. 5.3. When transferring personal data, the Operator ensures compliance with FZ-152, including entering into appropriate agreements authorizing data processing (Part 3 of Article 6 of FZ-152). 5.4. Cross-border transfers are limited to countries with adequate data protection, per Art. 12 FZ-152 (2025–2026 amendments).

6.1. The Operator takes necessary and sufficient organizational and technical measures to protect personal data against unlawful or accidental access, destruction, modification, blocking, copying, distribution, and other unlawful actions by third parties. 6.2. Protection measures include: • TLS 1.3 encryption in transit and AES-256 at rest; • Control and restriction of access to information systems; • Firewalls and intrusion detection; • Regular security audits and penetration testing; • Staff training on data handling; • Backup and recovery procedures; • Recording and accounting for operations involving personal data. 6.3. The Operator appoints a person responsible for organizing personal data processing in accordance with Article 22.1 of FZ-152.

7.1. Users may: • Request information about their data processing (Art. 14 FZ-152); • Request clarification, blocking, or destruction of personal data that is incomplete, outdated, inaccurate, unlawfully obtained, or unnecessary for the stated processing purposes (Article 14 of FZ-152); • Withdraw consent by notifying the Operator; • Appeal the Operator’s actions or omissions to Roskomnadzor (the Federal Service for Supervision of Communications, Information Technology and Mass Media) or in court; • Request deletion of all personal data and associated data from the Service (the "right to be forgotten" under FZ-149). 7.2. Requests may be sent to: privacy@magecut.com. 7.3. The Operator undertakes to review a request within 10 business days of its receipt (the shortened period under the 2026 requirements).

8.1. The Service uses cookies for functionality, personalization, and statistics. 8.2. Cookie types: essential (authentication, settings), analytical (usage analysis), functional (preferences). 8.3. Users may manage cookies via browser settings. Disabling cookies may limit Service functionality. 8.4. Analytics services anonymize data per Roskomnadzor recommendations.

9.1. The Service is not intended for users under 14. The Operator does not intentionally collect personal data from minors. 9.2. Users aged 14–18 may use the Service with the consent of their legal representatives. 9.3. If the Operator discovers that personal data of a person under 14 is being processed without the consent of a legal representative, the Operator will immediately delete that data.

10.1. In the event of a leak or other incident involving personal data, the Operator undertakes to: • Notify Roskomnadzor within 24 hours of discovering the incident (as required by FZ-152, 2025 edition); • Notify affected Users within 72 hours; • Take all necessary measures to minimize the consequences of the incident; • Conduct an internal investigation and eliminate the causes of the incident. 10.2. The Operator maintains an incident log as required by the regulator.

11.1. The Operator is liable for violations of personal data legislation in accordance with current Russian Federation law, including: • Administrative liability under Art. 13.11 of the Code of Administrative Offenses (with increased fines since 2025); • Civil liability for damage to data subjects; • Criminal liability under Art. 137, 272 of the Criminal Code for unlawful collection and use of data. 11.2. The Operator is not liable for the actions of third parties that gain access to personal data through the User’s fault (a weak password, disclosure of account credentials, etc.).

12.1. The Operator may update this Policy. Updates take effect upon publication unless otherwise stated. 12.2. The current version is always available at: magecut.com/privacy. 12.3. For material changes, Users will be notified at least 10 business days in advance via email or Service notification.

13.1. For data processing inquiries: • Email: privacy@magecut.com • Person responsible for personal data processing: privacy@magecut.com 13.2. Supervisory authority: Federal Service for Supervision of Communications, Information Technology and Mass Media (Roskomnadzor), rkn.gov.ru. Published: March 20, 2026. Last updated: March 20, 2026.