Privacy Policy

This Privacy Policy explains what personal data Fizmat (the website fizmat.ai, its chat, storage and related services — the “Services”) collects, why, whom it shares it with, and what rights you have. It is prepared in accordance with Russian Federal Law No. 152-FZ “On Personal Data”.

1. Who we are

The operator of personal data is Fizmat: Aleksandr Andreevich Ivanov. For any question about personal data write to support@fizmat.space.

2. What data we collect

• Account data. When you sign in with Telegram — your Telegram ID, name, username and profile photo if they are public; the nickname you choose on the site.
• Your materials. Chat messages, attached files, packages, folders, tags, skills, memory notes, scheduled tasks, and the responses of AI models and results of tools (search, sandbox, browser).
• Data from services you connect. If you connect a service in Personalization → Connectors (Gmail, Google Drive, Google Docs, Sheets, Slides, Notion, GitHub, your own MCP servers), we receive an access token and the account address, and the content the assistant reads there at your request. See section 5.
• Usage data. How many requests and tokens were spent, which models were selected, storage used — for your plan and its limits.
• Security data. IP address, approximate location derived from it (city, country), browser and device, time of sign-ins and sessions — to show them to you in Security and to warn you about a foreign sign-in.
• Technical data. Server and error logs, session and anti-forgery cookies. We do not use third-party advertising or analytics cookies. Interface settings (theme, folded panels) are stored in your browser.

3. Why we use it

• to provide the Services: keep your account, answer your questions, search your storage, run code, carry out your scheduled tasks;
• to apply the limits of your plan and count usage;
• to keep the Services secure: notice suspicious sign-ins and protect against abuse;
• to fix errors and monitor the health of the Services;
• to comply with the law.

The legal grounds are performance of our agreement with you (the Terms), your consent, and our legitimate interest in the security of the Services.

4. Whom we share data with

We do not sell personal data. We share it only with those without whom the Services cannot work:

• AI model providers (for example DeepSeek, Google Gemini and other models you select under the input field) receive the text of your request, the conversation history, the needed fragments of your packages and attached files — to prepare the answer. Free models are provided on their providers’ terms, which may allow using requests to improve their services: do not send them what you do not want to disclose.
• Search services receive the search query when the assistant searches the web.
• Telegram — for sign-in, security notices and, if you connect it, messages from the assistant.
• Email provider — to deliver scheduled-task summaries you asked to receive by email.
• Hosting and file storage — the servers and object storage that hold the database, files and backups.
• IP geolocation service — receives the IP address of a sign-in.
• Public authorities — only on a lawful request.

Some providers are located outside Russia, so request data may be transferred across borders. By using the chat with such models you consent to this transfer.

5. Data from connected services

You can connect your own accounts in third-party services to Fizmat in Personalization → Connectors. Without your connection we have no access to these services.

• What we receive. The access token the service issues after your consent, and the account address (email or login) to show which account is connected. Tokens are stored encrypted and are never shown in the interface or to the model.
• What we read. Only what is needed for your request in a chat or a scheduled task: the assistant searches and opens emails, files, pages and repositories when you ask it to. We do not scan your accounts in the background and do not copy their content to us, except what was found for a particular answer (it stays in the history of that chat) and files the assistant opened at your request.
• What we change. By default — nothing: a connector only reads. The assistant can create email drafts, documents, spreadsheets, pages or issues only if you have turned on “Allow changes” for that connector. Fizmat cannot send email on your behalf at all.
• Whom we share it with. What is found in a service is passed only to the provider of the model you selected for the answer, and only to prepare that answer. Data from Google services is never passed to free models whose providers may train on requests: with such a model selected, Google connectors are unavailable.
• No training. We do not use data from connected services to train or improve AI models, do not sell it, do not use it for advertising and do not transfer it to third parties except as described above or as required by law. People do not read it unless you ask for support, it is needed for security, or the law requires it.
• How to disconnect. Disconnect the connector in Personalization — the token is deleted immediately. You can also revoke access in the service itself (for Google — myaccount.google.com/permissions). Messages of chats where the service’s data was used are deleted together with those chats.

Fizmat’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

6. How long we keep data

• Account and materials — as long as the account exists.
• Tokens of connected services — while the connector is connected; deleted immediately when you disconnect it.
• Deleted packages and folders — in the trash for the period of your plan, then erased.
• Backups — a limited number of recent copies; old ones are deleted in rotation.
• Sign-in and session log — for a limited time sufficient for security.
• After an account is deleted, its data is erased within 30 days, except what we must keep by law.

7. Your rights

You can:

• learn what data of yours we process and get a copy — packages can be exported as .uip and Markdown right from the storage;
• correct inaccurate data;
• delete individual materials, memory, chats, connectors — or the whole account;
• withdraw your consent to processing;
• appeal our actions to Roskomnadzor or in court.

Send requests to the address in section 1; we will answer within the time set by law.

8. Security

Access to data is restricted, connections are encrypted (HTTPS), API keys are stored as hashes and connector tokens are encrypted, files and backups are kept in separate storage. Code that the assistant runs is executed in an isolated sandbox with no access to other people’s data. No system is completely secure: if a breach affects your data, we will notify you and Roskomnadzor within the time required by law.

9. Children

The Services are not intended for children under 14. If you learn that a child has given us data without parental consent, write to us — we will delete it.

10. Changes

A new version of this Policy is published on this page with its effective date; previous versions remain available. We will announce material changes in advance.