Personal Data Processing Policy

klass.music Service - https://t.me/klass_musicbot

Version dated 11 October 2026

This Policy describes the processing of data of klass.music Telegram bot users and the procedure for contacting the Operator. Information about engaged payment and technology services is disclosed before the relevant processing in accordance with this Policy.

1 Operator and scope

1.1. The Operator is AYTI IDROK AKADEMIYASI LLC, Taxpayer Identification Number (INN) 312880165, registered on 16 March 2026. Address: Republic of Uzbekistan, Fergana Region, Kushtepa District, urban settlement of Kushtepa, Shodlik Citizens' Assembly (MFY), Bakhmal Street, Building 12-A. Contact for data requests: klassvpn@gmail.com. Telephone: +7 902 252 6805. Technical support on Telegram: https://t.me/help_klassai.

1.2. This Policy applies to data of users, purchasers and persons contacting support. Applicable law is determined by the nature of the processing and the categories of data subjects. Requirements of Russian Federation law, including Federal Law No. 152-FZ, are complied with where applicable; mandatory requirements at the Operator's place of business are also taken into account.

1.3. This Policy is a document on data processing and does not replace consent where consent is required. Starting to use the bot or making a payment does not constitute consent to all processing purposes. Processing for advertising and other activities requiring separate consent is carried out after that consent is obtained.

2 Data categories purposes and legal bases

2.1. Bot access and order records: Telegram ID, name and username where available, selected Package details, Generation Balance, order history, payment date and amount, payment identifier and status. Purposes: entering into and performing the contract, identifying purchases and correcting errors. Legal basis: the necessity of entering into and performing the contract within the limits of applicable law.

2.2. Song creation and delivery: request text, selected settings, source lyrics and the generation result. These materials may contain personal data if the User includes them in a request. An appropriate legal basis applies to such data, including separate consent where required. A description without surnames, addresses or other identifying information is sufficient to create a song.

2.3. Support and claims: the content of an enquiry, contact details provided by the User, order number, payment confirmation and technical error details. Purposes: handling the enquiry, performing the contract and protecting rights. The Operator requests only necessary information.

2.4. Security: event logs, request times and statuses, information on errors and indications of abuse to the extent actually available to the bot infrastructure. Purposes: security and diagnostics. The legal basis is determined by law; legitimate interests are not relied on in conflict with the data subject's rights.

2.5. Payments are made through payment services available in the bot interface. Information about the selected payment service and its data processing rules is provided in the payment interface before payment details are entered. The Operator receives information necessary to confirm payment and record the order, and does not request CVV codes, passwords or verification codes. Special categories of personal data and biometric data are not required for the bot to operate. Do not send documents, medical information or voice recordings for identity verification.

3 Processing and data recipients

3.1. Processing may include collection, recording, organisation, storage, updating, retrieval, use, transmission for order fulfilment, blocking, deletion and destruction, mainly by automated means. Employee and contractor access is limited to the necessary authorisations.

3.2. Telegram processes data independently within its platform. Telegram privacy policy: https://telegram.org/privacy. Use of Telegram does not release the Operator from obligations relating to its own processing.

3.3. Song creation uses generation services and API intermediaries based on Suno technology. Request text and settings are transmitted to them. Telegram ID and payment information are not transmitted for generation unless necessary and separately disclosed. Actual recipients and applicable processing rules are communicated to the User before transfer through the Service interface or a separate notice. The Operator ensures a legal basis for transfer. Suno terms: https://suno.com/terms; privacy policy: https://suno.com/privacy.

3.4. Suno's standard terms provide for broad use of materials and results, including model improvement. The Operator does not promise exclusion from training or confidentiality on the provider's side without a separate contractual basis. Applicable terms are disclosed and necessary permissions obtained before transfer. This Policy does not, by itself, grant rights to use other persons' materials.

3.5. The Operator stores personal data in Selectel infrastructure within the Russian Federation. The Operator's servers and databases used to store personal data are located within the Russian Federation. Applicable localisation requirements are complied with when collecting and processing data of Russian Federation citizens. Transfer of data to technology providers for generation is separately governed by clauses 3.3-3.6 of this Policy.

3.6. Use of foreign services may involve cross-border transfer of personal data. Before such transfer begins, the Operator identifies recipients, countries, data categories and legal bases, makes mandatory notifications and complies with applicable restrictions. Recipients and countries are communicated to the User before transfer under clause 3.3. This wording does not replace required consents or mandatory procedures.

4 Retention and protection

4.1. Personal data are retained no longer than necessary for the processing purposes. Account and balance data are retained to maintain the account and fulfil paid orders; requests and songs to fulfil orders, provide access to results and handle quality claims; enquiries to handle them and resolve related matters; technical logs and backups, if created, for security and Service recovery. Clause 4.2 applies when the purpose has been achieved or the basis for processing has ceased. Data needed to fulfil statutory duties or protect rights in a specific dispute may be retained to the necessary extent on an independent lawful basis.

4.2. Once the purpose has been achieved or the legal basis has ceased, the Operator stops the relevant processing and ensures deletion or destruction of the data within statutory periods, unless another lawful basis for retention exists. Where one exists, further use is limited to the relevant purpose. If backups are created, updating and deleting them must ensure compliance with mandatory data destruction deadlines; restoring backups must not resume processing of data that must be deleted.

4.3. The Operator implements access controls, account protection, secure data transmission and incident response proportionate to the risks. The person responsible for organising personal data processing is Individual Entrepreneur Badalov. Contact for enquiries: klassvpn@gmail.com. Actual safeguards are checked before publication of the Policy. Statutory notifications are made in the event of incidents.

5 Data subject rights and requests

5.1. A data subject may obtain information about processing, request updating, blocking or destruction of data in statutory cases, withdraw consent, object to processing within statutory limits, and challenge the Operator's actions before a competent authority or court.

5.2. Requests should be sent to klassvpn@gmail.com. Provide the Telegram ID or username, the subject of the request and information allowing the link to the account to be verified. The Operator may request additional verification only to the extent necessary; a passport is not automatically requested for every enquiry.

5.3. The Operator replies and fulfils lawful requests within the periods set by applicable law. Where Federal Law No. 152-FZ applies, information requested is provided within 10 working days; any legally permitted extension of no more than 5 working days is accompanied by a reasoned notice. Other requests are subject to their respective statutory periods.

5.4. Withdrawal of consent does not stop processing for which another independent lawful basis exists. The Operator states that basis and the data categories retained. Deletion of data necessary to fulfil an order may prevent provision of the service, but does not extinguish lawful refund claims or the obligation to handle claims.

5.5. Other persons' personal data must not be included in a request without the necessary basis. On receiving an enquiry from such a person, the Operator checks the basis for processing and takes the measures required by law.

6 Policy changes and access

6.1. This Policy is available in the bot menu before a request is submitted or payment made. A new version states its publication date. A Policy change does not retroactively create a new basis for processing; where a new purpose or new consent is necessary, the Operator informs the data subject and obtains the required consent.

6.2. This Policy is published in the klass.music Telegram bot menu and made available to the User before data are collected. The Operator must identify recipients, transfer countries and actual safeguards before the relevant processing begins; omission of their details from the Policy does not release the Operator from statutory obligations.