Consent to the Processing of Personal Data
DRAFT — to be reviewed by a lawyer before public launch.
Draft of 18 October 2026 (supplemented on 20 October 2026, 23 October 2026, 27 October 2026 and 28 October 2026); document version:2026-10-28.
By ticking the box during registration in the Cifrela app (or when accepting a new version of the documents in the app), I, in accordance with Regulation (EU) 2016/679 (GDPR) and the Law of Ukraine "On Personal Data Protection", voluntarily give my consent to SOFTSOLEDGE IT LLC (ТОВ «СОФТСОЛЕДЖ АЙТІ»; EDRPOU code 45418214; vul. Zelena 109, office 444, Lviv 79035, Ukraine; the controller) to process my personal data on the following terms:
- Data: username; email address (if I register by email); public encryption keys and the key certificate; information on the registration method, profile confirmation status and who invited me; invitations I create (code, expiry, note, who used them); email addresses of people I invite by email (used once to send the email and not stored in readable form: the note keeps only a mask, and for the limits a keyed hash is kept in memory for up to a day); my search visibility settings ("by name", "by email"); company membership and role (for company accounts); the first and last name, job title and photo of my profile (sent to my contacts end-to-end encrypted; in a company account the name and job title are stored on the server as an employee card visible to colleagues and the company owner); date of registration and of last activity (to the day); the document version and the time of this consent (and of any later consent to new versions — the new record replaces the previous one); technical data required to deliver encrypted messages, attachments and delivery receipts (group membership, sender's username, time, type and size of records and files — without access to their content; encrypted files are kept for up to 30 days); technical data of calls (the fact and time of a call, pseudonyms of group call participants, the IP addresses needed to connect through the TURN relay and the group call server, and the phone model, OS version, network type and call library version that the app sends to the group call server when connecting — without access to audio and video); IP address — also temporarily in the server's memory for rate limiting. If I add a bot to a chat or write to it myself: what I write to the bot and the fact that I added it; if I address the AI assistant — my request and up to the last 30 messages of that chat.
- Purpose: providing access to the Cifrela Service under the Public Offer Agreement; verifying the email address; sending service messages and invitation emails to addresses I provide; transferring files, showing my profile to my contacts and colleagues (the colleague directory in a company), delivery receipts, calls; exact search for me by username or email by people who already know them (unless I turn it off in the settings); notifications of new messages; protecting the Service against abuse. Also — delivering messages to bots added to a chat and the AI assistant's replies when I address it.
- Processing operations: collection, recording, storage (including in encrypted form), use, anonymisation, erasure; disclosure to processors — Hetzner Online GmbH (hosting, Germany, EU) and Brevo (Sendinblue SAS, email delivery, France, EU) — solely for the stated purpose. Notifications work without Google services: they are received by a service of the app on my phone, which has no encryption keys and cannot see the content of messages. The app shows my phone's contact list only on the phone — if I open "Invite from contacts" myself and grant permission — and does not send it to the server or store it; from the system contact list without permission it receives only the phone number or email address I pick, and the phone number does not leave the phone. The app receives no biometric data. Messages I address to the AI assistant, together with up to the last 30 messages of that chat, are transferred to the processor Anthropic, PBC (USA) solely to generate a reply; messages I write to a company bot or a system bot — to the system the bot belongs to (the company's system, WiTime CRM, ClinicKey).
- Duration: until the account is deleted and, thereafter, to the extent and for the periods set out in the Privacy Policy.
- My rights (Articles 15–22 GDPR, Article 8 of the Law of Ukraine): to be informed of the processing, to access my data, to have it rectified or erased, to restrict processing, to object to it, to receive my data in a machine-readable format, to withdraw this consent (by deleting my account in the app or by writing to office@softsoledgeit.com), and to lodge a complaint with the Ukrainian Parliament Commissioner for Human Rights, with the data protection supervisory authority of an EU Member State or with a court.
- I confirm that I am at least 16 years old (or have the consent of my parents or other legal guardians), that I have read the Privacy Policy and the Public Offer Agreement, and that withdrawal of consent does not affect the lawfulness of processing before its withdrawal.
- I undertake to send email invitations only to people I know.