Privacy policy for the CRAZY CHICKENs mobile app

1. Who processes your data

The personal data controller is individual entrepreneur I. I. Shans, taxpayer identification number (INN) 650103018939 (the Restaurant).

For personal data questions and deletion requests, contact: dostavka@crazychickens.ru.

2. What data we collect

• Phone number — to sign in using an SMS code and to contact you about your order.
• Name and delivery address (city, street, building, block, apartment, floor and courier instructions) — you enter these in your profile, and they are needed to deliver your order.
• Order information — items, total, time, order status and payment status.
• Payment information. You enter your bank card details in the YooKassa payment form. The App and the Restaurant do not receive or store your card number, only the payment identifier and status.
• Technical data — IP address and server request logs (phone numbers are masked in logs). These are needed to operate the service and prevent abuse, such as bulk SMS requests.
• Device data during payment. The YooKassa payment module embedded in the App collects technical device information (model, operating system version, network settings and device identifiers) to prevent fraud. It also collects technical payment form statistics through AppMetrica (Yandex LLC).

The App does not request access to your location, contacts, photos, camera or microphone and does not display advertising.

3. Why we use your data

• signing in to the App and protecting your account;
• placing, preparing, delivering and paying for orders;
• checking whether delivery is available at your address;
• displaying order history and current order status in the App;
• complying with legal requirements, including accounting and payment receipts;
• protecting the service against fraud and abuse.

We do not sell personal data or use it for third-party advertising.

4. Who receives your data

Only to the extent needed for the purposes listed:

• YooKassa (YooMoney NBCO LLC) — processing order payments;
• the SMS provider — sending sign-in codes (your phone number is shared);
• the restaurant’s iiko management system — sending orders to the kitchen and courier (name, phone number, address and order items) and, on first sign-in, your phone number for the guest record;
• the courier — delivering your order (name, phone number, address and instructions);
• public authorities — only where required by law.

5. Where and how long data is stored

Data is stored on servers located in the Russian Federation and transmitted over an encrypted connection (HTTPS).

• account data (phone number, name and address) — while you use the account, until you delete it;
• order and payment records — for 5 years, as required by accounting legislation; after account deletion, they are no longer linked to the account;
• server logs (IP address and masked phone number) — for up to 6 months.

On your device, the App stores sign-in data, your basket and a menu cache. These are removed when you sign out (except for the menu cache) or uninstall the App.

6. Your rights

You can find out what data is processed about you, correct it (your name and address can be changed in the App profile), withdraw consent to processing and request deletion. To do so, delete your account in the App or email dostavka@crazychickens.ru. We will respond within 10 business days.

7. How to delete your CRAZY CHICKENs account and data

In the App (the account is deleted immediately):

1. Open the Profile tab (the person icon at the bottom right).
2. Tap Delete account at the bottom of the screen.
3. Confirm by tapping Delete.

Without the App (within 30 days):

1. Email dostavka@crazychickens.ru with the subject “Account deletion”.
2. Include the phone number you used to sign in to the App.
3. We will delete your account within 30 days and reply to your email.

What is deleted:

• your profile: name, delivery address and courier instructions;
• all active sessions on all devices;
• order history in the App — it is no longer accessible;
• upon an email request, your guest record in the restaurant’s management system is also deleted.

What is retained:

• order records (items, total, address, recipient name and phone number) and payment records — for 5 years, without a link to the account: this is required by accounting legislation and needed for refunds and claims;
• server logs (IP address and masked phone number) — for up to 6 months;
• if a phone number was blocked for violations, the number itself is kept while the block remains in effect.

Orders already placed will still be delivered. A deleted account cannot be restored; signing in again with the same phone number creates a new, empty account.

8. Changes to this policy

We may update this policy. The current version is always available at this address, with the revision date shown at the top of the page.