Personal data processing policy

2. What data we process

We only collect fields that actually exist in the forms. We do not ask for a phone number and do not publish one as the controller’s contact.

• chat widget request: name, Telegram or email, task description;
• sign-up: name, email, optional Telegram, password (stored as a hash);
• sign-in: email and password;
• order: project type, options, title, description, budget and deadline if you provide them;
• dashboard chat: message text;
• review: display name, optional company or project, text, rating;
• builder and portfolio: texts, links and files (images, mp4/webm) that you upload;
• technical data: cookies, request date, server logs; with analytics consent — page views and visit IDs on this site, plus Yandex Metrica data if a counter ID is set.

If you type a phone number into the footer of a landing page in the builder, that is your page content, not a field BigCitySite collects from visitors of this website.

3. Purposes

• replying to a request and discussing a project;
• creating an account, signing in and managing an order;
• correspondence and publishing a review after moderation;
• storing portfolio and landing-page files;
• operator notifications by email and Telegram;
• authentication and site security;
• visit analytics — only after consent in the cookie banner.

4. Legal grounds

Processing is based on your consent (Article 6 of 152-FZ) and, after an order is placed, also on performing the service agreement. You give personal-data consent with a checkbox in the request or sign-up form. Analytics cookie consent is a separate choice in the banner.

5. How data is processed and who receives it

Data is stored in the site database and may be sent to the operator by email and Telegram. Processors:

• website hosting and server;
• S3-compatible storage — uploaded files;
• SMTP email (Gmail) — request and order emails;
• Telegram Bot API — operator notifications;
• Yandex Metrica — only if you accepted analytics in the banner and a counter ID is set.

We do not sell data or share it for third-party advertising. Any other disclosure is only as required by law or at your request.

6. Cookies and analytics

The site shows a consent banner. Analytics does not start before you choose.

• Essential cookies — dashboard sign-in (NextAuth: session, CSRF, callback) and the `bcs_consent` choice cookie for 12 months. Without them we cannot remember consent or keep you signed in.
• Analytics cookies are set only after “Accept all”: `bcs_vid` (visitor, 12 months), `bcs_sid` (session, 30 minutes), `bcs_hits` and `bcs_lp` (view count and last page). If a Yandex Metrica counter is set, its cookies (`_ym_uid`, `_ym_d` and service cookies) are also loaded; session replay is off. “Essential only” deletes analytics cookies.

You can change the choice in the footer: “Cookie settings”. Declining analytics does not block sending a request or using the dashboard.

7. Retention

• account, orders, chats, landing pages — while the dashboard is needed or until a deletion request;
• guest requests — until we reply and for a reasonable time after;
• reviews — while published or until consent is withdrawn;
• essential cookies — until sign-out or session expiry;
• analytics cookies — per Yandex Metrica rules or until you withdraw consent in the banner;
• server logs — a limited time for security.

8. Your rights

You may request information about your data, correction, account deletion, withdrawal of consent, and you may complain to Roskomnadzor.

Send the request from the email you used on the site to melmanoner@gmail.com. The controller’s full name is also provided in the reply. We usually respond within 30 days.

9. Data protection

Passwords are stored as hashes, the dashboard and admin are behind authentication, and production runs over HTTPS. Internet risks cannot be ruled out completely, but we take reasonable measures.

10. Policy changes

The current version is always on this page. The date at the top is updated when material changes are made.