PIDLAB Privacy Notice

Operator and scope

The personal-data operator for pidlab.io is individual entrepreneur Alexey Borisovich Borozdin, INN 781626255984, OGRNIP 322784700290619. Postal address: 38A, building 26, 2nd Khutorskaya Street, Moscow, 127287, Russian Federation. Email for requests: info@pidlab.io.

This notice covers the hosted PIDLAB service, its public materials, accounts, stands and practical tasks. It does not present a future separate corporate deployment as an existing service.

Why data is processed

Accounts, sign-in, access recovery, saved stands and tasks selected by a user require the relevant data to provide the service and perform the agreement with that user (Article 6(1)(5) of Russian Federal Law No. 152-FZ). Processing is limited to what these actions require.

Account protection, abuse prevention and investigation of technical incidents serve the legitimate interests of the operator and users while respecting their rights (Article 6(1)(7)). Processing necessary to meet a legal obligation uses the applicable legal basis. Where a separate purpose requires consent, it is obtained separately; this notice is not itself that consent.

Account, session and log data

Account data includes email, a user identifier, a password hash, email-verification status and sign-in and lockout information. Two-factor authentication uses its setup data when enabled. Where Google sign-in is available, a Google account identifier may be linked. PIDLAB does not receive your Google password.

Sessions and security processing use IP addresses, browser User-Agent, event times, session identifiers and technical operation information. Logs may record changes to accounts, access, tasks and results. They support security and troubleshooting rather than advertising profiles.

Stands, tasks and results

A saved stand contains its name, loop model, parameters and other data the user saves in the workspace. Practical tasks may contain an organisation, participant roles, invitees' emails, task conditions, selected stands, parameter changes, attempt times, scores and reasons for the result.

Access to materials and results depends on the role and access granted within an organisation. In a sports leaderboard, other participants see an alias, score and the time the attempt was completed; email is not displayed. An alias does not mean the operator cannot link a result to an account. Do not put other people's personal data into stands or tasks without a lawful basis.

Optional practice statistics

General account settings provide a separate optional checkbox, Allow optional recording of practice days. It is off by default. You can use the simulator without enabling it. Its purpose is to understand whether participants use ordinary simulation and return to practice; it does not affect access prices, assignment results or skill assessment.

After opt-in and Start, the application waits for 30 seconds of a visible ordinary simulation running. It then sends a day marker and the technical identifier of the current consent. The live database stores the account identifier and one UTC calendar day, together with the consent time, notice version and technical consent state. These statistics do not include stand names, PID parameters, charts, session duration or referral sources. Qualification assessments are excluded. The report shows aggregates; these are client reports, not proof of successful tuning.

The history window includes today and the preceding 89 UTC calendar days. Older days are excluded from reports and removed at service startup and every hour thereafter. Confirmed opt-out deletes consent and practice days from the live database; opting in again starts a new history. If the server has not confirmed opt-out, the interface offers a state check and does not claim that deletion has occurred.

Opt-out does not mean immediate deletion from existing backups or operational request logs. Those logs may contain the IP address, browser information, time and request path as described in Accounts, sessions and logs; controller parameters are not transmitted for this recording. Contact info@pidlab.io about deletion and backups.

Cookies and browser storage

The technical pidlab_sid cookie maintains account sign-in. Normal page JavaScript cannot read it; production uses secure transport over HTTPS. The available Google sign-in flow uses a temporary pidlab_oauth_state cookie lasting up to 10 minutes. Blocking technical cookies may prevent sign-in.

localStorage stores language and theme preferences, local work and user-defined catalog items; sessionStorage stores temporary navigation and tab state. Clearing them may remove local work but does not delete an account or server data. These public legal pages contain no data-collection form or third-party analytics.

Infrastructure and external services

The server application and database run on hosting infrastructure. Email-verification, access-recovery and invitation messages pass through the SpaceWeb SMTP provider, which processes the destination address and message content. Your email provider also processes the delivered message under its own rules. Requests to info@pidlab.io are handled in the service's official mailbox.

Before delivery, a service email is stored encrypted in a server queue. The worker clears the address and content from the queue when delivery completes, retries end or the message expires; a technical record of attempts and status remains. This does not delete mail already delivered to mailboxes or included in earlier backups.

If you choose an available Google sign-in option, the browser visits Google and the PIDLAB server exchanges an authorisation code for verified account information. The flow requests OpenID, email and basic profile access. Application pages may also load fonts from Google Fonts, which receives network information for those requests. These external requests are not purely internal PIDLAB processing.

Backup arrangements include database copies on the server, the operator's computer and Yandex.Disk. Access to those copies is intended for recovery rather than public disclosure. Adding a processor or changing an external transfer requires a separate assessment of its basis and data-protection requirements.

Retention and deletion

Data is processed within its stated purpose and must not be retained longer than needed for that purpose, unless applicable law or another lawful basis requires a different period. The validity period of a recovery link or session is not the same as the physical retention period of all related records.

Disabling an account blocks sign-in but does not itself erase stands, logs or task results. Deleting a test hides it from new starts; existing attempts and recorded results may remain for review. To stop processing or request deletion, contact info@pidlab.io so your records, any grounds for continued retention and backup copies can be assessed.

Your rights and requests

You may request information about processing of your data, correction of inaccurate data, and restriction or deletion where the law provides grounds, and withdraw consent you previously gave. Withdrawal does not stop processing for which another applicable lawful basis remains.

Include the account email, the request and enough detail to locate the relevant record. Do not send a password, a two-factor code or an active recovery link. If confirmation that the request concerns your account is needed, the method will be explained in the reply. You may contact Roskomnadzor or a court; contacting support does not limit that right.

Changes and new purposes

This notice carries a version date. New processing, advertising emails or disclosure of results to new recipients is not authorised merely because someone once created an account. A new purpose, basis or consent is handled separately where required.