Version of 23.10.2026
1.1. This Policy explains what personal data the Kompas service (the mobile app and its server back end, the "Service") processes, why, how and for how long it keeps it, who receives it, and what rights users have. It is based on Russian Federal Law No. 152-FZ of 27.07.2006 "On Personal Data".
1.2. The personal data operator is individual entrepreneur Anton Nikolaevich Miroshnichenko, INN 673210148881, OGRNIP 324774600326584, registered on 17 May 2024 by the Interdistrict Inspectorate of the Federal Tax Service of Russia No. 46 for Moscow; mailing address: apt. 103, 3b Engelsa St., Voskresensk, Moscow Region, Russia (the "Operator"). Email for personal data requests: [email protected].
1.3. This Policy is published in the app and at https://kompas.jollynomad.ru/legal.
1.4. If a user is a Vietnamese citizen or another person covered by the Vietnamese Law on Personal Data Protection No. 91/2025/QH15, the Operator also takes its requirements into account.
1.5. Under Vietnam's Law No. 91/2025/QH15, for users' data the Operator is the party that decides the purposes and means of processing and processes the data itself. Data that users enter about other people is processed on the user's instructions (clause 4.4).
2.1. Account: email address, name (if provided), interface language. If the app offers Sign in with Google and the user uses it, also the Google account identifier.
2.2. Sign-in and security: one-time sign-in codes (stored as a hash), the IP address and time of a code request, information about device sessions, records of accepted documents (which version and when).
2.3. Company: details entered by the owner — names, tax code (MST), address, director's name and title, charter capital, registration date, bank and account. The name of an invited accountant or lawyer, if the owner entered it. Details of the firm the invitee works for: name, address, registration number, contacts and a scan of the registration certificate, for the "verified" mark.
2.4. Quarterly records: employee information (name, position, salary, number of dependants), revenue, expenses, suppliers.
2.5. Payment requests: the buyer's name, tax code, address and email, if the user enters them.
2.6. Company verification: a scan or photo of the enterprise registration certificate, which may contain the director's personal data.
2.7. Community: nickname, messages, participation in chats and groups, reports, blocks, notification settings.
2.8. App crash information: a technical description of the error, device model, operating system and app versions, time of the crash. Email address, name and user identifier are not included.
2.9. Business-opening consultation request: questionnaire answers, including nationality, presence in Vietnam and visa type, business sector and city; contact details, preferred language, convenient time, comment; request status and the agreed consultation time. If the request is sent without signing in — also name and email address.
2.10. Notifications: device token for push notifications and notification language.
2.11. Payments: invoice requests — what is paid for, amount, payer (name or company name), payer's tax code if given, status and dates. When paying on the website — what was paid for, the amount, the YooKassa payment number and status. Bank card details are entered on the YooKassa page and are not shared with the Operator.
2.12. Data on the device: settings and an offline copy of data are stored only on the user's device.
2.13. Log of the Operator's staff actions: which actions administrators took on an account and why.
2.14. Surveys: answers to voluntary in-app surveys — role (owner, accountant, etc.), difficulties in running the business, free-form comment.
2.15. AI assistant: questions the user asks the AI assistant, the answers, ratings of answers and comments on ratings.
2.16. Company access log: which company member worked with which section and when; invitations, the owner's consents, changes to and closing of access.
2.17. Business partners: tax codes of companies the user checks or saves, and the user's labels for them; tax office information about these companies — name, address, status and its date; changes to this information; manual check marks and notes. When checking a company, the Operator does not collect information about its directors or other people.
2.18. Accountant matching: what the user needs from an accountant, language, city, budget, a comment about the company and task, payer name; request status and the shortlist. This data is not shared with firms.
2.19. Company documents (Business plan): files uploaded by the owner and specialists, their names, size, who uploaded them and when. Files may contain personal data of employees, customers and business partners — the user shares it under the processing instruction (clause 6.2 of the Terms of Use).
2.20. Firm catalog: firms' business contacts — email, phone, Zalo, website — published with the firm's consent.
3.1. Registration and sign-in.
3.2. Running the Service's features: deadlines, records, calculations, payment requests, working with an accountant and a lawyer, community, company verification, business partner checks, AI assistant, firm catalog, accountant matching, document exchange.
3.3. Accepting payments, activating paid plans and sending payment documents.
3.4. Notifications about events in the Service.
3.5. Answering user requests and handling reports.
3.6. Meeting obligations set by law.
3.7. Protecting the Service and users from abuse: limiting sign-in and request attempts, protecting the community from spam.
3.8. Improving the Service based on answers to voluntary surveys and ratings of AI assistant answers.
4.1. The user's consent to personal data processing (given in a separate document).
4.2. Performance of the contract with the user — the terms of use and public offer.
4.3. Obligations set by law (for example, recording payments).
4.4. The Operator processes data of other people that the user enters (employees, buyers, company directors) on the user's instructions. The user is responsible for having a basis to share it.
5.1. Data is stored on a server in Moscow (Russia) at the hosting provider Cloud.ru.
5.2. Database backups are kept for 14 days.
5.3. A company's data is available to its owner and to the people the owner invited (accountant, lawyer, firm), only in the sections the owner opened and until access is closed. The Operator's staff access data only to check documents, handle reports and provide support.
5.4. Data in transit is encrypted (HTTPS). Sign-in codes and session keys are stored only as hashes. Staff access to administrative functions requires a one-time code. Server access is restricted.
The Operator shares data only to the extent a feature needs:
| Recipient | What is shared | Why | Where |
|---|---|---|---|
| NCO YooMoney LLC (YooKassa service) — when paying on the website | amount, purchase description, email for the receipt | accepting payment and the fiscal receipt | Russia |
| Google LLC (Firebase Cloud Messaging) | device token, notification text | push notifications | USA |
| Google LLC (Firebase Crashlytics) | app crash information (clause 2.8) | finding and fixing errors | USA |
| Google LLC (Sign in with Google — if the app offers it) | sign-in data that Google shares with the user's consent | signing in | USA |
| Plus Five Five, Inc. (Resend service) | email address, text of the sign-in code email | sending emails | USA, Japan |
| Công ty TNHH Casso (VietQR service) | the tax code (MST) of a company — the user's own or a business partner's | looking up company details and checking the company's tax status | Vietnam |
| Microsoft (Azure Translator) — only if translation is enabled | community message text | translating messages | Microsoft's processing locations |
| Anthropic, PBC — when a question is asked to the AI assistant | question text, language, excerpts from the Kompas knowledge base | preparing the answer | USA |
| An accountant, lawyer or firm invited by the company owner | company data in the sections the owner opened; the owner's name and email | working with the company on the owner's instructions | Vietnam or the firm's country stated in its profile |
Address of Plus Five Five, Inc.: 2261 Market Street #5039, San Francisco, CA 94114, USA. The Operator provides the addresses of other recipients on the user's request.
Questions to the AI assistant are sent to Anthropic through the Operator's equipment in Vietnam. The name, email and other account data are not sent with the question. Do not include other people's personal data in questions.
Sending data to other countries is cross-border transfer. The Operator carries it out under Article 12 of Federal Law No. 152-FZ.
Data collected in Vietnam is processed on a server in Russia. Under Vietnam's Law No. 91/2025/QH15 this is a cross-border transfer, and the Operator carries it out under that law.
Data is not sold or shared for advertising.
7.1. Account and company data — while the account exists. After the account is deleted, the data is deleted and backups are refreshed within 14 days.
7.2. Company verification documents — until the decision and 30 days after it.
7.3. Sign-in codes — until used, but no longer than their validity period. Records of code requests (email, IP address, time) — 30 days.
7.4. Push notification tokens — until signing out on the device or until the token is revoked.
7.5. Payment and invoice request records — for the period required by accounting and tax law, including after the account is deleted.
7.6. Consultation requests — 12 months after the request is closed. Requests sent without signing in — the same, unless they were linked to an account earlier.
7.7. Log of the Operator's staff actions — 3 years.
7.8. Survey answers — while the account exists.
7.9. Questions to the AI assistant, answers and ratings — while the account exists. The Operator's staff may review them to check the quality of answers.
7.10. Company access log — 3 years; deleted together with the company.
7.11. Scan of a firm's registration certificate — until the review decision and 30 days after it.
7.12. Business partners, check marks and the history of changes — while the partner is in the company's list; deleted together with the partner or the company.
7.13. Accountant matching requests — while the account exists; payment information — under clause 7.5.
7.14. Company documents — while the company exists or until the user deletes them.
7.15. Catalog entries — while the firm agrees to publication.
8.1. The user has the right to: - receive information on how their data is processed and a copy of their data; - require that their data be corrected, blocked or deleted, restrict processing or object to it; - withdraw consent; - complain about the Operator to Roskomnadzor (and, for citizens of Vietnam, also to the personal data protection authority under Vietnam's Ministry of Public Security), or go to court.
8.2. Users can delete their account in the app profile.
8.3. To exercise other rights, the user writes to [email protected] from their account email. The Operator replies within 10 business days; this may be extended by 5 business days with an explanation. Correction or deletion on a justified request — within 7 business days. For persons covered by Vietnam's Law No. 91/2025/QH15, the Operator confirms receipt within 2 business days and fulfils the request within the periods of Article 5 of Decree No. 356/2025/NĐ-CP, if shorter.
8.4. After consent is withdrawn, the Operator stops processing and deletes the data within 15 days, unless the law allows or requires further processing. The Service cannot be used without processing the data it needs to work.
8.5. The Operator notifies Roskomnadzor of a personal data leak or unlawful access within the periods of Article 21 of Federal Law No. 152-FZ, the Vietnamese authority — within the periods of Article 23 of Law No. 91/2025/QH15, and affected users — in the app or by email.
The Operator may change this Policy. The new version is published in the app and at https://kompas.jollynomad.ru/legal with its date. Users are notified of material changes in the app.
This document is drawn up in Russian. The English and Vietnamese translations are provided for convenience. In case of discrepancy, the Russian text prevails.