Privacy Policy

← Home

This English text is provided for understanding only. The policy is a document under Russian law (152-FZ), and the Russian version is the binding one. Where the two differ, the Russian text prevails.

1. Data controller

The controller of personal data of only-positive.com users is Sole trader Margarita Rudolfovna Surnina (OGRNIP 325470400052720, INN 471904511983, registered address: Siversky settlement, Gatchina District, Leningrad Region, Russia) (the “Operator”). Processing follows Russian Federal Law No. 152-FZ of 27 July 2006 “On Personal Data”.
You can reach the Operator about any data question here: Telegram ВКонтакте WhatsApp

2. What data is processed

What you provide yourself:
  • your name (and, if you wish, patronymic and surname), email address;
  • your password — the site stores only its irreversible cryptographic hash (bcrypt) and cannot learn the password itself;
  • your profile photo and gallery photos;
  • the description, names and prices of your services, currency, language, page background;
  • links to your messenger and social network accounts;
  • the text of reviews you write about others, and questions to review authors;
  • if you register an organisation — its name, logo and information about its services. The organisation's name and logo are not personal data; the email address and other details of the person acting on its behalf are processed as that person's own data.
What appears without your involvement:
  • the date your profile was created;
  • your IP address and the time when the site sends an email to your address — solely so that nobody can use the site to mail strangers;
  • web server records of requests: IP address, page address, browser type.
If your profile was moved from the old site:
  • the phone number you used there is stored only as an irreversible hash (SHA-256). The number itself is unknown to the site and cannot be recovered from the hash; it only serves to recognise you during account recovery.
If you connected the Telegram bot:
  • the identifier of your chat with the bot;
  • images of payment receipts you send to the bot: the files stay in Telegram, the site keeps only a reference to them.

3. Purposes and legal grounds

  • To provide the service: registration and sign-in, showing your page in search, publishing reviews, contact between users, the paid subscription, and service emails and messages about the site and your page on it.
  • With your consent: emails and Telegram messages about new reviews — you can switch them off in your profile at any time.
  • Legitimate interest of the Operator: protecting the site from abuse — limiting how many emails go to one address and from one IP address.
  • To comply with the law: answering lawful requests from state authorities.

The Operator does not sell personal data and does not pass it on for advertising.

4. Retention periods

  • profile data and published reviews — while your account exists;
  • the IP address and email address recorded when a letter is sent — up to 7 days;
  • web server records — 14 days;
  • backups — 14 days, after which they are deleted automatically.

You can delete your account yourself, in your profile — the «Delete account» button. Your profile, services, photos and contacts are removed. Reviews you wrote about other people stay on their pages: that is information about someone else, and they are entitled to expect it not to vanish. If you want those removed too, write to support.

5. Sharing with third parties

The Operator does not sell data and does not share it for advertising. It reaches only those without whom the site cannot work:
  • hosting — the server running the site is located in the Russian Federation;
  • Cloudflare, Inc.(USA) — attack protection and proxying: the exchange between your browser and the site passes through Cloudflare's servers, which technically have access to the IP address, the addresses of the pages you open and the contents of the connection;
  • email delivery— the site's letters (registration confirmation, account recovery, notifications) are delivered through the Resend service (Resend, Inc., USA): the recipient's address and the text of the letter go there;
  • Telegram (Telegram Messenger Inc.) — if you connected the bot: the notification text and your chat identifier go there;
  • DeepL SE (Germany) — machine translation of specialist descriptions, service names and review texts into the site's other languages. Only the text itself is sent, without your name, email or any other data about you.

The «Choose this specialist» button. Pressing it asks to put you in touch with that specialist. The contact you type into the field is passed to the specialist — that is how they will answer you — together with your name and the link to your profile if you are signed in (both are public on your page anyway). A notice of the request is sent to the specialist by Telegram and by email, if they have given them — those messages never carry the contact itself. It opens to them only inside their own cabinet, behind a password, and only while their paid subscription is active; until then it is kept by the operator and not shown to the specialist. The operator receives the whole request: the specialist's name and the link to their page, your contact and — for signed-in visitors — your name, the link to your profile and your email address; if the specialist has not answered you, the operator puts you in touch themselves. The request is kept so it can be found later.

The «Report this specialist» button. The text of the report, your contact if you give one, and — for signed-in visitors — your name, the link to your profile and your email address are passed to the operator and kept. The report is never shown to the specialist and never published. The operator looks into it personally and may contact you; two confirmed reports remove the specialist from search. What the operator may tell the specialist while looking into it is your own choice, made when you send the report: name you, retell the substance without your name, or pass nothing on.

Cross-border transfer. Telegram, DeepL, Cloudflare and Resend are outside the Russian Federation, so passing data to them is a cross-border transfer, carried out under Article 12 of 152-FZ. Telegram notifications are voluntary: do not connect the bot and nothing goes there.

Yandex.Metrica.The site runs the Yandex.Metrica visit counter (Yandex LLC, Russia). It collects anonymised visit data: the page address, where you came from, the device and browser type, an approximate location from the IP address, and on-page actions — clicks and scrolling (Webvisor). Names, email addresses, phone numbers and the text of your reviews are not passed to it. The data is processed under Yandex.Metrica's terms and serves one purpose: to see what works on the site and what does not. You can opt out with the Yandex.Metrica opt-out extension or by blocking cookies in your browser.

There are no advertising pixels on this site. No information about you is passed to ad networks.

6. Where data is stored

Collection, recording, organisation, accumulation and storage of personal data of citizens of the Russian Federation uses a database located on a server in the Russian Federation (Article 18(5) of 152-FZ). Photos you upload are stored there too.

7. Security measures

The Operator applies measures proportionate to the size of the site. What is listed below is what is actually done:
  • data travels between your device and the site over HTTPS;
  • passwords are stored only as an irreversible hash (bcrypt); neither the Operator nor anyone else can read them;
  • phone numbers left over from the old site are stored only as an irreversible hash;
  • photo metadata, including the coordinates of where a picture was taken, is stripped from uploads;
  • the number of emails the site sends to one address and from one IP address is limited;
  • backups of the database and uploaded files are made daily.

No protection is ever complete. The Operator cannot guarantee absolute security and undertakes to inform you of an incident if it affects your data.

8. Cookies and browser storage

  • One technical cookie named session — it holds the proof that you are signed in. It lasts 30 days, is not readable by scripts on the page, and is removed when you sign out. Signing in cannot work without it.
  • One mark in browser storage — that you dismissed the invitation to connect Telegram, so it does not reappear.

Yandex.Metrica cookies — the visit counter sets its own, so it can tell a new visit from a returning one. The site uses no advertising cookies and passes no information about you to ad networks.

9. Your rights

  • to learn what data about you is processed and receive a copy of it;
  • to correct inaccurate data — almost everything can be edited in your profile;
  • to delete your account and data — with the button in your profile or through support;
  • to withdraw consent to notifications — with the switch in your profile;
  • to demand that processing stops;
  • to complain to Roskomnadzor (rkn.gov.ru) if you believe your rights have been violated.

You can send a request through support — an answer is given within 30 calendar days: Telegram ВКонтакте WhatsApp

10. Minors

Registering as a specialist or an organisation is possible from the age of 18.

An account for leaving a review (including through the «Sign-up for students» door) may also be created by someone aged 14 or older — with the knowledge of a parent or other legal representative. Children under 14 must not register: ask a parent to write the review in their own name.

If you are a child's legal representative and believe their data ended up on the site without your consent, write to support and it will be deleted.

11. Changes to this policy

The Operator may change this Policy. A new version takes effect once published on this page. The date of the last change is shown below. By continuing to use the site you accept the current version.

12. Contacts

For any question about the processing of personal data: Telegram ВКонтакте WhatsApp

Last updated: 28 August 2026

Reference translation. The binding text is the Russian one at /privacy.