Privacy Policy

• Account: name, email address, password hash, interface language, two-factor authentication flags.
• Profile: phone, profession, location (country, city, area), profile photo, social profile URLs.
• Data you enter: projects, expenses (including uploaded receipts), contacts, tasks, planner scenes and calculations (tiling, laminate, landscaping, etc.).
• OAuth (Google, Apple, Yandex): provider ID, email, name, and avatar URL when you sign in through the respective service.
• Contact form: name, email, subject, and message text.
• Payments: transaction metadata (amount, status, order ID) via bePaid. Smekalka does not store full card details.
• Landscape AI (when enabled): site photos you upload for segmentation are sent to Hugging Face for processing.
• Mobile app: API tokens (Laravel Sanctum) are stored on the server; they are not used in the browser.
• Technical data: IP address, browser and device type, server logs, demo-mode data (may be purged on a schedule).

Contract performance (terms of use): registration and sign-in, project storage, sync between web and mobile, material calculations, subscription payments.

Consent: contact form submission, registration, OAuth sign-in, optional features (including landscape AI), non-essential cookie choices (see Cookies policy).

Legitimate interest: service security and stability, abuse and spam prevention, technical logging.

Legal compliance: retaining data required for accounting and tax records, responding to lawful requests from authorities.

As of this policy date, Smekalka does not use third-party visit analytics cookies (Google Analytics, Yandex Metrica, etc.) on the website.

• Cloudflare Turnstile — contact form spam protection (IP address and verification token).
• bePaid — card payments; payment data processed by the provider.
• OAuth providers (Google, Apple, Yandex) — authentication when you choose that sign-in method.
• Hugging Face — image segmentation in the landscaping module when the feature is enabled by the user.
• Mail service (SMTP) — delivery of registration codes, notifications, and support replies.

We share data only with parties that help deliver the service, and only to the extent necessary. We do not sell personal data.

Account and user content data are kept while the account is active and for a reasonable period after deletion — for backups, dispute resolution, and legal compliance.

Registration confirmation codes (OTP) and cached operational data are removed automatically after a short period.

Contact form messages are kept until the request is handled and for the period needed to maintain correspondence records.

Server technical logs are retained for a limited time required for diagnostics and security.

Servers and primary processing are oriented toward serving users in the Republic of Belarus. When you use certain features, data may be transferred outside Belarus — notably to Cloudflare (spam protection), Hugging Face (image processing), OAuth providers, and mail services.

Such transfers occur only to the extent required for the feature you choose, with contractual and technical safeguards applied by the respective providers.

Under Belarus law you may request access, correction, blocking, or deletion of your personal data, and withdraw consent where processing is consent-based.

Send requests via the Contact form or to info@smekalka.by. We respond within a reasonable time and may ask you to verify your identity to protect your account.

You may also lodge a complaint with the authorized body for personal data protection in the Republic of Belarus.

The service is not intended for anyone under 16. We do not knowingly collect children’s personal data. If you believe a child provided data without a guardian’s consent, contact us and we will take steps to delete it.

We may update this policy. The current version is always available at https://smekalka.by/privacy-policy. The last update date is shown at the top of this document.

We may notify you of material changes by email or through the app interface.