Consent to Personal Data Processing

Version: 1.0 Effective date: 22.05.2026 Service: «Girlies, i'm spilling...» Website: https://girlies.artelin.org

This Consent to Personal Data Processing, hereinafter referred to as the “Consent”, sets out the terms under which the user gives consent to the processing of their personal data when using the «Girlies, i'm spilling...» web service, hereinafter referred to as the “Service”.

The controller and operator of personal data is an individual applying the special tax regime “Tax on Professional Income” under the laws of the Russian Federation: Pavel Ilyich Shikleev, Taxpayer Identification Number / INN 550619042837, hereinafter referred to as the “Operator”.

User support email: shikleyev@gmail.com. Email for personal data and legal matters: shikleyev@gmail.com.

1. How the User Gives Consent

1.1. The user gives this Consent by performing an active action in the Service interface, including ticking the relevant checkbox next to the consent text and then clicking a sign‑in, registration, continue or similar button.

1.2. Recommended checkbox text in the interface:

> I consent to the processing of my personal data in accordance with the Consent to Personal Data Processing and the Privacy Policy and Personal Data Processing Policy.

1.3. Before giving this Consent, the user must not complete registration, create an account, use the main features of the Service, create rooms, communicate with AI Characters or transmit personal data to the Service beyond the minimum technical data necessary.

1.4. By giving this Consent, the user confirms that:

• they are at least 18 years old;
• they act freely, of their own will and in their own interest;
• they have read this Consent;
• they have read the Privacy Policy and Personal Data Processing Policy;
• they understand what personal data may be processed;
• they understand the purposes of personal data processing;
• they understand that use of the Service is impossible without processing the minimum set of personal data necessary for registration, authentication, account operation, chats, rooms, AI Characters, security and support.

1.5. If the user does not agree with this Consent, the user must not register, sign in to the Service or use its main features.

2. Data Subject

2.1. The data subject is the user of the Service — an individual who is at least 18 years old and who registers, signs in or uses the Service.

2.2. The user must not use the Service on behalf of another person, transmit another person’s personal data without a lawful basis or create an account using another person’s data.

2.3. The Service is not intended for persons under 18 years old. The Operator does not intend to collect or process personal data of minors.

3. Personal Data Operator / Controller

Personal Data Operator / Controller:

Pavel Ilyich Shikleev Status: individual applying the special tax regime “Tax on Professional Income” Taxpayer Identification Number / INN: 550619042837 Service: «Girlies, i'm spilling...» Website: https://girlies.artelin.org User support email: shikleyev@gmail.com Email for personal data and legal matters: shikleyev@gmail.com

4. Purposes of Personal Data Processing

The user gives consent to the processing of personal data for the following purposes:

• user registration;
• authentication through Google, VK, Yandex or another available sign‑in method;
• creation and maintenance of the account;
• confirmation of age 18+;
• provision of access to the Service;
• operation of rooms, chats and AI Characters;
• generation of responses from AI Characters;
• storage of message history;
• creation of summaries of previous messages;
• operation of short‑term and long‑term character memory;
• personalization of communication;
• development of relationships between the user and AI Characters within the Service;
• accounting of room, character and user settings;
• operation of the user profile;
• accounting of message limits, rooms, characters and other features;
• provision of free features;
• provision of paid features, plans and subscriptions;
• processing of payments and payment statuses;
• allocation of bonuses, additional messages and other benefits;
• display of advertisements;
• provision of rewarded ads and accounting of advertising rewards;
• analytics of Service operation;
• improvement of the interface, features and quality of the Service;
• technical support;
• processing of user requests;
• sending service notifications related to account, security, payment, document changes or Service operation;
• ensuring information security;
• prevention of abuse, spam, fraud, attacks and unauthorized access;
• keeping technical logs;
• confirmation of acceptance of documents and consents;
• compliance with applicable legal requirements;
• protection of the Operator’s rights and legitimate interests.

5. List of Personal Data

The user gives consent to the processing of the following categories of personal data.

5.1. Account and Authentication Data

• internal user identifier in the Service;
• user identifier from the OAuth provider;
• email address;
• name or display name;
• avatar or avatar URL;
• interface language;
• date and time of registration;
• sign‑in method;
• account status;
• information about age 18+ confirmation;
• information about acceptance of the User Agreement, Public Offer, this Consent and other documents.

5.2. User Profile Data

If the user voluntarily completes the profile, the following data may be processed:

• name or nickname;
• age or age range;
• gender;
• city;
• work or education;
• hobbies;
• favorite movies, music, books, games and food;
• goals;
• likes and dislikes;
• personal facts;
• communication preferences;
• other information voluntarily entered by the user for personalization.

5.3. Chat, Room and Character Data

• user messages;
• responses from AI Characters;
• chat history;
• room names;
• room composition;
• selected characters;
• room settings;
• user instructions;
• relationships with characters;
• summaries of previous messages;
• short‑term and long‑term character memory;
• reactions, typing statuses, response order and other technical chat events;
• data about message limits, number of rooms, number of characters, message length and use of features.

5.4. Technical Data

• IP address;
• date and time of visit;
• user agent;
• device type;
• browser type;
• operating system;
• interface language;
• session information;
• cookie identifiers;
• error information;
• server logs;
• interface actions;
• login attempt data;
• data necessary to protect against abuse, spam, attacks and unauthorized access.

5.5. Plan, Advertising and Bonus Data

• current user plan;
• plan limits;
• access rights and entitlements;
• promo codes;
• bonus status;
• rewarded ad viewing information;
• information about additional messages or other rewards;
• ad impression data, if provided by an advertising network;
• ad removal settings, if such functionality is available.

5.6. Payment Data

If the user purchases a paid plan, subscription or another paid feature, the following data may be processed:

• selected plan;
• price;
• currency;
• access period;
• payment status;
• payment date;
• payment identifier;
• subscription identifier;
• auto‑renewal status;
• refund, cancellation or failed payment information;
• data necessary for tax records and confirmation of service provision.

The Operator does not store full bank card data. Payments are processed by a third‑party payment provider.

5.7. Request Data

When the user contacts support or submits a legal request, the following data may be processed:

• email address;
• name or nickname;
• content of the request;
• attachments, if sent by the user;
• date and time of the request;
• support correspondence history;
• information necessary to respond to the request.

5.8. Consent Data

The Operator may process and store:

• date and time of consent;
• IP address;
• user agent;
• document version;
• document text hash;
• consent source;
• consent type;
• age 18+ confirmation;
• acceptance of the User Agreement;
• acceptance of the Public Offer;
• provision of this Consent;
• consent or refusal regarding optional cookies;
• consent or refusal regarding marketing communications, if such communications are used.

6. Data the User Must Not Transmit

6.1. The Service does not request the user to provide:

• passport data;
• scans of documents;
• exact residential address;
• banking details;
• full bank card details;
• medical documents;
• information about diagnoses;
• health information;
• information about intimate life;
• information about religious, philosophical or political views;
• personal data of other people.

6.2. The user must not send such data in chats, profiles, support requests, room names, character instructions or any other fields of the Service.

6.3. This Consent is not consent to intentional transmission, publication, disclosure or long‑term storage of special categories of personal data.

6.4. If the user voluntarily provides such information, the Operator may:

• avoid storing such information in long‑term character memory;
• delete such information;
• restrict its processing;
• process it only to the minimum extent necessary for the operation of the Service, security, legal compliance, deletion, blocking or protection of the Operator’s rights.

7. Actions with Personal Data

The user gives consent to the Operator performing the following actions with personal data:

• collection;
• receipt;
• recording;
• organization;
• accumulation;
• storage;
• clarification;
• updating;
• modification;
• extraction;
• use;
• comparison;
• analysis;
• personalization;
• transfer;
• provision of access;
• entrusting processing to third parties;
• anonymization;
• blocking;
• deletion;
• destruction;
• other actions necessary for the purposes specified in this Consent.

Processing may be carried out by automated means, without automated means, or by mixed methods.

8. Location of the Main Database

8.1. The main database of the Service and hosting are located in the Russian Federation.

8.2. Hosting provider: AdminVPS.

8.3. Location: Russia, Moscow.

8.4. Provider website: https://adminvps.ru/.

8.5. The Operator may change the hosting provider or infrastructure location provided that applicable law is complied with and the Privacy Policy is updated if such change materially affects the processing of personal data.

9. Transfer of Data to Third Parties

9.1. The user gives consent to the transfer of personal data to third parties where such transfer is necessary for the purposes of processing specified in this Consent, operation of the Service, performance of the contract with the user, compliance with the law, security or protection of the Operator’s rights.

9.2. Personal data may be transferred or entrusted for processing to the following categories of recipients:

• hosting provider AdminVPS;
• OAuth providers: Google, VK, Yandex;
• AI providers, including DeepSeek;
• payment providers;
• advertising networks;
• analytics services;
• email and notification services;
• technical support services;
• contractors involved in development, maintenance and security of the Service;
• government authorities where transfer is required by law;
• other persons where necessary for contract performance, protection of the Operator’s rights, Service security or at the user’s request.

9.3. Third parties receive only the data necessary to perform the relevant function.

9.4. The Operator does not sell the user’s personal data.

10. AI Processing

10.1. To generate responses from AI Characters, the Service may transmit message fragments, room context, character descriptions, summaries, relationship memory, user profile data, interface language and response rules to an AI provider.

10.2. The main AI provider as of the date of this Consent is DeepSeek.

10.3. The Operator aims to transmit to the AI provider only the data necessary to generate a response and operate scenario logic.

10.4. The Operator does not transmit full payment data to the AI provider and does not intend to transmit passport data, banking details or other sensitive information.

10.5. The user understands that use of an AI provider is necessary for the operation of AI Characters, message generation, group scenes, summaries and personalized communication.

11. Cross‑Border Transfer of Personal Data

11.1. Some services used by the Service may be located outside the Russian Federation or may process data outside the Russian Federation.

11.2. Potential cross‑border transfer may occur when using:

• Google OAuth;
• DeepSeek or another AI provider;
• foreign analytics services;
• foreign advertising networks;
• foreign email and notification services;
• other technical contractors, if used.

11.3. The user gives consent to the cross‑border transfer of personal data to the extent necessary for the operation of the Service, authentication, generation of AI responses, technical support, security, analytics, advertising and performance of the contract with the user.

11.4. Where applicable law requires prior notification, assessment, consent or other actions before cross‑border transfer of personal data, the Operator takes the necessary measures in accordance with applicable law.

11.5. When working with users from the Russian Federation, the Operator aims to minimize the transfer of personal data outside the Russian Federation and to transfer only data necessary for the relevant function.

12. Cookies and Similar Technologies

12.1. The Service may use cookies and similar technologies for website operation, authentication, security, session storage, analytics, advertising, product improvement and provision of rewarded ads.

12.2. Strictly necessary cookies may be used without separate consent where they are required for website operation, authentication, security and provision of features requested by the user.

12.3. Analytics, advertising and other optional cookies are used with separate user consent where such consent is required by applicable law.

12.4. This Consent does not replace separate cookie settings if the Service implements a cookie banner or cookie settings panel.

13. Marketing Communications

13.1. This Consent is not consent to receive promotional email newsletters, push notifications or other marketing communications where separate consent is required by applicable law.

13.2. Consent to marketing communications may be obtained separately, for example through a separate optional checkbox in the interface.

13.3. Service messages related to account, security, payment, document changes or Service operation may be sent without separate marketing consent, provided that they are not advertising.

14. Term of Consent

14.1. This Consent is valid from the moment it is given by the user until it is withdrawn, the account is deleted or personal data processing is terminated on grounds provided by applicable law.

14.2. After withdrawal of Consent or account deletion, the Operator stops processing personal data unless otherwise required or permitted by applicable law.

14.3. Certain data may be retained after withdrawal of Consent or account deletion where necessary for:

• compliance with the law;
• tax records;
• confirmation of payment and service provision;
• fraud prevention;
• security;
• dispute resolution;
• protection of the Operator’s rights and legitimate interests;
• confirmation of receipt of consent;
• processing of technical logs to the minimum extent necessary.

15. Withdrawal of Consent

15.1. The user may withdraw this Consent at any time.

15.2. To withdraw Consent, the user may send a request to: shikleyev@gmail.com.

15.3. The request should preferably include:

• account email;
• name or nickname, if applicable;
• sign‑in method, if known;
• request description: withdrawal of consent to personal data processing.

15.4. The Operator may request additional information to confirm the user’s identity where necessary to protect the account and prevent unauthorized access to data.

15.5. Withdrawal of Consent does not affect the lawfulness of processing carried out before the withdrawal was received.

15.6. If processing of personal data is necessary for account operation and provision of the Service, withdrawal of Consent may result in termination of access to the Service, account deletion or inability to use certain features.

16. User Rights

The user has the right to:

• receive information about the processing of their personal data;
• request correction of personal data;
• request blocking or deletion of personal data where such data is incomplete, outdated, inaccurate, unlawfully obtained or no longer necessary for the stated purpose of processing;
• withdraw this Consent;
• request termination of personal data processing in cases provided by law;
• contact the Operator with requests regarding personal data processing;
• challenge actions or omissions of the Operator before a competent personal data protection authority or court;
• exercise other rights provided by applicable law.

Requests should be sent to: shikleyev@gmail.com.

17. Confirmation of Consent

17.1. The Operator may store technical information confirming that this Consent was given.

17.2. Such information may include:

• user identifier;
• date and time of consent;
• IP address;
• user agent;
• sign‑in method;
• version of this Consent;
• text hash of this Consent;
• version of the Privacy Policy and Personal Data Processing Policy;
• text hash of the Privacy Policy and Personal Data Processing Policy;
• consent source in the interface;
• age 18+ confirmation;
• acceptance of the User Agreement;
• acceptance of the Public Offer.

17.3. Such information is stored for the purposes of confirming consent, complying with the law, protecting the Operator’s rights and resolving possible disputes.

18. Related Documents

This Consent applies together with the following documents:

• User Agreement;
• Public Offer;
• Privacy Policy and Personal Data Processing Policy;
• Cookie Policy, if published separately;
• payment, subscription and refund rules, if published separately or included in the Public Offer.

If there is a conflict between this Consent and the Privacy Policy, the document that provides the user with a higher level of protection shall apply unless otherwise required by applicable law.

19. Changes to this Consent

19.1. The Operator may update the text of this Consent.

19.2. The new version of the Consent is published on https://girlies.artelin.org and becomes effective on the date specified in the new version.

19.3. If changes materially affect the scope of personal data, purposes of processing, processing methods, transfer to third parties or user rights, the Operator may request new consent from the user.

19.4. Continued use of the Service after the new version of this Consent becomes effective does not replace the need to obtain new consent in cases where such new consent is required by law.

20. Language Versions

This Consent may be available in Russian and English. The Russian-language version is the primary version for users located in the Russian Federation and shall prevail in case of discrepancies between language versions, unless otherwise required by mandatory provisions of applicable law.

21. Operator Details

Personal Data Operator / Controller: Pavel Ilyich Shikleev Status: individual applying the special tax regime “Tax on Professional Income” Taxpayer Identification Number / INN: 550619042837 Service: Girlies, I'm spilling Website: https://girlies.artelin.org Hosting and main database: AdminVPS, Russia, Moscow User support email: shikleyev@gmail.com Email for personal data and legal matters: shikleyev@gmail.com