Consent to the Processing of Personal Data
Fate Loom mobile application
Version 1.2 of 24.09.2026.
This is a translation of the Russian original. In case of any discrepancy, the Russian version prevails.
This document is drawn up separately from the Terms of Use and the Privacy Policy, as required by Article 9(1) of Russian Federal Law No. 152-FZ of 27.07.2006 "On Personal Data".
It consists of three independent consents, each given by a separate action. Consents No. 1 and No. 2 are required for the Service to work and are requested at registration as mandatory; Consent No. 3 is optional. Each of them can be withdrawn independently of the others.
Who the consent is given to (operator / controller)
Ruslan Radikovich Idrisov, self-employed taxpayer (professional income tax regime, Russian Federation)
INN: 745503928293
Correspondence address: poste restante, post office 143985 (Balashikha 45, 3 Pervogo Maya St.), Balashikha, Moscow Region, Russia
E-mail: privacy@fateloom.app
Who gives the consent (data subject)
Since the Service does not request identity document details, you are identified by the information you provide at registration and by the data the Service records at the moment consent is given:
- your internal account identifier within the Service;
- your VK user id, or your Google account identifier and e-mail address, depending on the sign-in method chosen;
- your name or form of address, if you provided one;
- the date, time and IP address from which consent was given;
- the version of the document to which the consent relates.
The Service stores this information as evidence of the fact, content and moment of consent, and provides it to you on request.
How consent is given
By ticking a separate box next to the relevant item during registration in the application. Consent is given electronically, freely, by your own will and in your own interest; it is specific, informed, unambiguous and given by a clear affirmative action.
Consent No. 1. Processing of personal data
Purposes
1. Registration and identification in the Service, account security.
2. Generating readings, interpretations and answers to follow-up questions, taking into account the profile form if completed.
3. Accounting for Threads, the Pro Subscription, streaks, bonuses and the referral programme.
4. Accepting and confirming payments, issuing receipts, handling refund requests.
5. Handling support requests.
6. Sending notifications and reminders related to the operation of the Service.
7. Detecting and preventing fraud, reward inflation and abuse.
8. Improving the quality of the Service using anonymised data.
9. Serving advertising, including rewarded advertising, and granting rewards for watching it.
10. Running the Arcana section: recording the cards that came up for you, unlocked facets of card texts, the card in study, milestones reached and rewards granted for them.
Categories of personal data
- VK user id; Google account identifier and e-mail address;
- internal account identifier, registration date;
- name or form of address, date of birth, gender, life areas of interest, description of the current situation, main goal, tone and detail preferences;
- text of questions and follow-up questions, spread types chosen, cards drawn, generated interpretations, reading history;
- card meeting journal: the card drawn, its orientation, the spread type, the position in it and the date; unlocked facets, the card in study, milestones reached and rewards granted;
- interface language, time zone;
- Thread balance and its change history, Subscription status and end date, streak, referral code, ownership of appearance items;
- payment system, transaction identifier, product identifier, amount, currency, status and date of payment;
- IP address, operating system type and version, device model, application version, installation identifiers, server logs, advertising identifier.
Operations and methods of processing
Collection, recording, systematisation, accumulation, storage, updating (renewal, alteration), retrieval, use, transfer (provision, access), anonymisation, blocking, deletion, destruction.
Processing is carried out by mixed means: with and without the use of automation.
Processors engaged by the operator
Processing is entrusted to the parties listed in section 6 of the Privacy Policy, each within the scope needed to perform its task and subject to confidentiality obligations:
- VK LLC (INN 7743001840) — confirming VK ID sign-in;
- YANDEX LLC — serving advertising (Yandex Advertising Network);
- ROBOKASSA LLC (INN 5047063929) — payment acceptance and fiscalisation;
- Hangzhou DeepSeek Artificial Intelligence Co., Ltd. (DeepSeek) — generating interpretation texts;
- Server v arendu LLC (HOSTKEY, INN 7719408546) — hosting the server side.
Duration and withdrawal
This consent is effective from the moment it is given until it is withdrawn or the account is deleted.
You may withdraw it:
- by deleting your account in the application — Settings section;
- by sending a request to privacy@fateloom.app from the address linked to your account, or quoting your account identifier.
Processing stops within 30 calendar days of receipt of the withdrawal, except for data the operator must retain by law or needs to defend an already asserted claim.
Withdrawing this consent makes further provision of the Service impossible and means deletion of the account.
Consent No. 2. Cross-border transfer of personal data
Given by a separate tick. Without this transfer the core function of the Service — generating readings — is impossible, so this consent is mandatory for registration.
What is transferred abroad
| Recipient | Country | Data transferred |
|---|---|---|
| Hangzhou DeepSeek Artificial Intelligence Co., Ltd. (DeepSeek) | China | Question and follow-up question text, spread type, cards drawn, profile form if you filled it in (name or form of address, date of birth, gender, life areas, description of the situation, goal) |
The operator does not transfer personal data to any other recipient outside the Russian Federation.
Purpose of the transfer
Generating the interpretation text and answers to follow-up questions.
What you should know before consenting
The People's Republic of China may not ensure a level of protection of data subjects' rights equivalent to that established by Russian law, and it is not covered by a European Commission adequacy decision within the meaning of Article 45 GDPR. The level of protection of your rights there may be lower than that established by Russian or European law, and the operator's and the supervisory authority's ability to control further processing is limited. Transfer takes place without appropriate safeguards under Article 46 GDPR, on the basis of your explicit consent under Article 49(1)(a) GDPR.
I confirm that I have been informed of the above and consent to the cross-border transfer of the listed data to the listed recipients for the stated purposes.
Duration and withdrawal
Effective until withdrawn. Withdrawn in the same manner as Consent No. 1.
Withdrawing Consent No. 2 makes the core function of the Service impossible and, like withdrawing Consent No. 1, means deletion of the account.
Consent No. 3. Marketing and informational messages
Optional. It has no effect on your access to the Service.
Purpose
Sending messages about new features, promotions and discounts, and other advertising and informational messages.
Service notifications — for example, a reminder that your daily streak is about to end — are not advertising: they are sent under Consent No. 1 and can be turned off in the app settings.
Data and channels
E-mail address, device identifier for push notifications.
Channels: push notifications, e-mail.
Duration and withdrawal
Effective until withdrawn. You may withdraw it at any time: by turning off notifications in the app settings, via the unsubscribe link in an e-mail, or by writing to privacy@fateloom.app.
General provisions
Consents are given freely. Consent No. 3 is not a condition of using the Service. Consents No. 1 and No. 2 are mandatory because the Service cannot be provided without the corresponding processing.
The operator retains records of these consents, including version, date, time and IP address, for 3 years after withdrawal or account deletion, in order to demonstrate the lawfulness of processing.
If the data processed, the purposes of processing or the recipients change, the operator will request fresh consent; until it is obtained, processing in the new scope will not take place.