Privacy Policy

1. General provisions

1.1. This Privacy Policy (hereinafter — the «Policy») defines the procedure for processing the personal data of Users of the WoW Brain platform by the operator WoW Brain Ltd (hereinafter — the «Operator»).

1.2. The Operator processes personal data in accordance with applicable data protection law of 27.07.2006 «On Personal Data», the Constitution and other regulations.

1.3. Using the Platform constitutes the User's consent to the terms of this Policy.

2. What data we process

2.1. Data provided by the User during registration and use of the service:

• email address;
• name or nickname;
• password (stored as a bcrypt cryptographic hash);
• phone number (when filling out the profile);
• avatar, photo (when uploaded by the User).

2.2. Data generated while using the Platform:

• results of completed tests and trainers;
• goals, notes, materials of the Atlas of Goals;
• history of interaction with the AI Neuro-Probe;
• progress in learning courses;
• date and time of visits (last_seen_at).

2.3. Technical data collected automatically:

• IP address;
• device type, operating system, browser version;
• cookies (see the Cookies Policy);
• server request logs.

2.4. The Operator does not store payment data. Card details are processed by a certified PCI-DSS payment provider; the Operator receives only the transaction status and amount.

3. Purposes of processing

• providing access to the Platform's functionality;
• authentication and account protection;
• personalizing recommendations and content;
• processing payments and subscriptions;
• informing about the service and important changes;
• usage analytics (in anonymized, aggregated form);
• ensuring security and preventing fraud;
• compliance with the requirements of applicable law.

4. Legal grounds for processing

4.1. Consent of the personal data subject (cl. 1, part 1, Art. 6 of applicable data protection law), given in the manner specified on the page Consent to Personal Data Processing.

4.2. Performance of the contract concluded with the User (cl. 5, part 1, Art. 6 of applicable data protection law).

4.3. Achievement of purposes provided for by law or necessary to exercise the rights and legitimate interests of the Operator (cl. 7, part 1, Art. 6 of applicable data protection law).

5. Storage conditions and periods

5.1. Personal data is stored on servers physically located within the territory.

5.2. The storage period is determined by the purpose of processing. For accounts — until the User deletes the account or it is blocked for violation of the Terms.

5.3. Upon expiry of the period, the data is subject to destruction or anonymization.

6. Transfer to third parties

6.1. The Operator does not sell personal data to third parties.

6.2. Data is transferred to third parties only in the following cases:

• Payment gateway (a certified PCI-DSS payment provider) — to process payments;
• Email delivery services (MailRelay) — to send notifications;
• AI model providers (DeepSeek, Deepgram) — to process Neuro-Probe requests in anonymized form;
• Government authorities — upon an official reasoned request;
• in other cases provided for by the applicable law.

6.3. A confidentiality agreement is concluded with every contractor that has access to personal data.

7. Data protection measures

• encryption of data transmission via TLS 1.2/1.3;
• storing passwords as a bcrypt cryptographic hash;
• HMAC-signed authentication cookies;
• protection against automated attacks (rate limiting, honeypot);
• filtering of spam registrations by a domain blacklist;
• isolated access to the server infrastructure via SSH keys;
• regular backups (daily);
• auditing and logging of administrator actions.

8. Rights of the personal data subject

8.1. The User has the right to:

• obtain information regarding the processing of their personal data;
• demand correction, blocking or destruction of data if it is incomplete, outdated or unlawfully obtained;
• withdraw consent to processing;
• appeal the Operator's actions to Roskomnadzor or a court.

8.2. Requests to exercise these rights are sent to support@wow-brain.com. The response period is 30 calendar days.

9. Account deletion

9.1. The User may delete their account at any time by sending a request to support@wow-brain.com or through the Settings section in their personal account.

9.2. After deletion, the associated personal data is destroyed within 30 days, except for information that the Operator is required to retain by law (e.g., financial transaction records — 5 years).

10. Changes to the policy

10.1. The Operator may make changes to the Policy. Material changes are published on the website 14 days before they take effect.

10.2. The current version is effective from May 27, 2026.

11. Operator's contacts for personal data matters

WoW Brain Ltd
Address: 9 Temasek Boulevard, #29-01 Suntec Tower Two, Singapore 038989
Email for personal data matters: support@wow-brain.com
General email: support@wow-brain.com

Complaints about the processing of personal data may be submitted to Roskomnadzor: rkn.gov.ru.