Personal Data Processing Policy

This Personal Data Processing Policy (the "Policy") is drawn up in accordance with Federal Law No. 152-FZ "On Personal Data" dated July 27, 2006 ("152-FZ") and sets out how the Operator processes personal data and what measures it takes to protect it, with respect to visitors to the site izidevops.com (the "Site").

The Operator treats respect for human rights and freedoms in the processing of personal data, including the right to privacy and personal and family confidentiality, as the primary goal and condition of its activity.

This Policy is public and permanently published at izidevops.com/privacy.

1. Terms used in this Policy

For the purposes of this Policy, the following terms apply:

• Personal data means any information relating directly or indirectly to an identified or identifiable natural person (a data subject).
• Processing of personal data means any action (operation) or set of actions (operations) performed on personal data, with or without automated means, including collection, recording, organization, accumulation, storage, refinement (update, correction), retrieval, use, transfer (disclosure, provision, access), de-identification, blocking, deletion, and destruction of personal data.
• Operator means the individual Vladislav Makhankov, who independently organizes and/or carries out the processing of personal data, and who determines the purposes of processing, the scope of personal data subject to processing, and the actions (operations) performed on personal data.
• Data subject means a visitor to the Site.
• Site means the set of graphic and informational materials, computer programs, and databases that make them accessible on the internet at izidevops.com.
• Cookies means a small piece of data sent by a web server and stored on a user's computer, which the web client or browser sends back to the web server each time it opens a page of the corresponding Site.

2. Operator

The operator of personal data processing on the Site is the individual Vladislav Makhankov.

To contact the Operator about personal data processing, write to partners@izidevops.com.

3. Legal grounds for processing personal data

The Operator processes data subjects' personal data only in the cases set out in Part 1 of Article 6 of Federal Law No. 152-FZ "On Personal Data," including when processing is necessary to exercise the Operator's rights and legitimate interests, provided this does not infringe on the rights and freedoms of the data subject.

A data subject accepts the terms of this Policy by continuing to use the Site after reviewing it. If a data subject does not agree with the terms of this Policy, they must stop using the Site.

4. Purposes of processing personal data

The Operator processes a data subject's personal data only for the following purposes:

• registering and authenticating the data subject in the Site's personal dashboard (/app section), including identification by email address and password or by a confirmed account with a third-party authorization service;
• providing the data subject with dashboard features: saving progress through learning materials, showing bookings for consultation sessions, and managing notification settings;
• providing the agentic learning mode: issuing personal access tokens that the data subject uses, at their own initiative, to connect their chosen AI agent software to the Site, and processing that agent's requests on the data subject's behalf;
• building and storing the data subject's individual learning plan and self-assessment of their level on course topics, including on requests from the AI agent the data subject connected;
• sending the data subject transactional messages related to using the dashboard and the services provided, by email;
• keeping the Site operational, stable, and fault-tolerant;
• diagnosing technical faults and finding and fixing errors in the Site's operation;
• protecting the Site and its users from automated data scraping, distributed denial-of-service (DDoS) attacks, unauthorized access, and other actions that disrupt the Site's operation;
• ensuring the information security of the Operator's hardware and software;
• collecting Site traffic statistics, analyzing visitor behavior, and improving the user interface using the "Yandex Metrica" web analytics service.

5. Categories of personal data processed

Within the Site's dashboard (/app section), the Operator processes the following categories of personal data, provided voluntarily by the data subject on registration and during subsequent use of the account:

• the email address the data subject provides on registration, or received from a third-party authorization service as part of the account profile;
• the data subject's password hash, computed with the Argon2id algorithm; the Operator does not store the password in plain form;
• the display name (nickname) the data subject sets themselves;
• the data subject's Telegram username, if they provide it themselves as a contact channel; this identifier is used only for the Operator to reach the data subject manually, and is not used in automated messaging;
• the data subject's account identifier with a third-party authorization service (Yandex ID, Google or GitHub), if the data subject chooses to sign in through that service, along with the data received from that service during authorization (email address and whether it is verified, user identifier);
• records of the data subject's progress through learning materials: identifiers of completed lessons, their status and results (scores), lesson bookmarks saved by the data subject, dates of learning activity, as well as technical records of using interactive lab environments (lesson and task identifiers, success status, duration, and other technical session metadata);
• data on agentic-mode access tokens: the token name the data subject sets, the agent program name reported on connection, the issue date, last-used date, expiration date, and revocation date. The Operator does not store the token itself in plain form, only its irreversible hash;
• data on the networks an agentic-mode access token is used from: the IP address subnet without the last part of the address (for IPv4, without the last octet; for IPv6, the first 48 bits), the date and time of the first and last request, and the agent program name. Used to detect the token being passed to third parties, and kept for 90 days;
• the data subject's individual learning plan: chosen lessons and topics, self-assessment of their level on each topic, a list of topics they want to learn, and notes on plan items. The notes and the wish list are free text generated by the data subject's AI agent on their behalf, and may contain personal data the data subject chooses to include;
• results of mock interviews in agentic mode: the date, parameters and identifiers of the questions asked, a score for each answer, and a short note on what the answer missed. The score and note are generated by the data subject's AI agent; the Operator does not store the text of the data subject's answers. If the interview is run against a job posting, only the list of technologies found in it is kept, not the posting text itself. The Operator keeps the data subject's 20 most recent completed interviews; an unfinished interview is deleted 7 days after it starts;
• the question-review queue: identifiers of questions the data subject answered partially or not at all in a mock interview, and the number of times they marked a question "knew it" in the trainer;
• data on using the course's labs in agentic mode: lesson and lab identifiers, when the lab was opened, hints received, and solutions shown. Used to rate-limit access to paid labs;
• data on lab failures reported by the data subject's AI agent: lesson and lab identifiers, the type of failure, the exit code and up to 2000 characters of the failed script's output, and the OS and tool versions (bash, Docker, kind, kubectl). The data subject's files and code are not sent. Used to fix labs, and kept for 180 days;
• data the data subject provides when booking a consultation (mentorship) session: the name and contact details they give, their self-reported level, a free-text comment, and any resume file they upload (including its original file name, type, and content), if they upload one;
• data related to paying for services (booking consultation sessions, mentorship orders, purchases of access to practice with an AI agent): the plan and order amount, the order's status and processing history, the contact details and comment the data subject provides, and the payment transaction identifier from the payment service (YooKassa or Lava.top). The Operator does not process or store the data subject's card details; the payment service handles that on its own;
• the content of requests the data subject sends through the "Report a problem" form, including the request text (which may contain personal data the data subject chooses to include), the reply email address they provide, the page address the request was sent from, and their software information (User-Agent string);
• the log of notifications sent to the data subject, including the message topic, channel, and delivery result;
• the authentication events log (sign in, sign out, sign up, data export, account deletion) with the time of the event and the source IP address of the request; data on the data subject's active sessions (the IP address and User-Agent string of the device used to sign in), processed for access management;
• short-lived technical data processed to protect against automated password guessing: a log of failed sign-in attempts with the email address or source IP address; requests to the service interface between the lab infrastructure and the Site are logged with the source IP address. In "Report a problem" requests, the source IP address is stored as an irreversible hash.

When someone visits the Site, the following data is automatically recorded in the web server's technical logs ("access logs"), which the Operator treats as personal data out of legal caution:

• the data subject's device IP address;
• the date and time of the request;
• the identifier of the requested resource (URL), the HTTP method, the server response code, and the amount of data transferred;
• the data subject's software information (User-Agent string) and the page they came from (Referer), when available.

In addition, as part of using the "Yandex Metrica" web analytics service (operator: Yandex LLC, OGRN 1027700229193, 16 Lva Tolstogo St., Moscow, 119021), de-identified visit data is processed: an anonymous visitor identifier (cookie), IP address, device and browser information, referral source, the sequence of pages viewed, on-page actions (clicks, scrolling, form fills without saving the values entered), and time spent on pages. The Site has "Webvisor" enabled, which records a visitor's actions within the Site's pages. This data is recorded and stored on Yandex LLC's servers located in the Russian Federation, in accordance with the privacy policy and terms of use of the "Yandex Metrica" service, published at yandex.ru/legal/confidential.

The Operator does not process special categories of personal data concerning race, ethnicity, political views, religious or philosophical beliefs, health, or intimate life, nor does it process biometric personal data.

6. How personal data is processed

The Operator processes personal data using automated means, in compliance with the laws of the Russian Federation and this Policy.

Data subjects' personal data is kept confidential. The Operator and any other party that gains access to personal data must not disclose it to third parties or distribute it without the data subject's consent, unless federal law provides otherwise.

The Operator takes the necessary legal, organizational, and technical measures to protect personal data from unlawful or accidental access, destruction, modification, blocking, copying, disclosure, or distribution, and from other unlawful actions regarding personal data. These measures include: using secure data transfer protocols (TLS), restricting physical and logical access to servers, regularly installing software updates, and using firewalls.

7. Where personal data is processed and stored

Personal data is processed and stored using technical means located in the Russian Federation, on the infrastructure of a Russian hosting provider.

Personal data can end up outside the Russian Federation only as a result of actions the data subject chooses to take:

• signing in with Google (Google LLC, USA) or GitHub (GitHub, Inc., USA): the data subject authenticates with the chosen service, and the service sends the Operator their email address, whether it is verified, and the account identifier;
• paying for practice access with a card issued outside Russia through Lava.top: the Operator sends the service the data subject's email address and the order details, and the service and its payment partners process them under their own rules, including outside the Russian Federation.

A data subject may, on their own initiative, connect a third-party AI agent (for example, Claude Code, Cursor, Codex) to the Site using a personal access token. In that case, the lesson content, learning plan, and progress data that the agent requests from the Site are received by the program installed by the data subject, and processed by its provider under its own rules, including outside the Russian Federation. The data subject carries out that transfer themselves, through the program they chose, and can stop it at any time by revoking the token in the dashboard.

8. Processing and storage periods

Entries in the web server's technical logs that contain personal data listed in Section 5 of this Policy are automatically deleted after thirty (30) calendar days from their creation, through standard system log rotation. The Operator does not back up these logs.

Personal data processed in connection with the data subject's use of the dashboard is kept for as long as the data subject's account is active. A data subject may initiate deletion of their account at any time, through the dashboard ("Account settings" section, "Delete account" action). On receiving such a request, the Operator automatically de-identifies and deletes the account's data in the following order: the email address, display name, and password hash are removed from the main user record; all active sessions and links to external authorization services are terminated; notification logs and consultation session booking data are de-identified. The authentication events log is kept in de-identified form for as long as needed to meet legal requirements on recording actions in an information system, and is then destroyed.

Before the account is deleted, a data subject may request a machine-readable export of the personal data processed about them, through the dashboard ("Account settings" section, "Export data" action).

Short-lived technical data related to protection against password guessing (the log of failed sign-in attempts), as well as one-time links for confirming an email address and resetting a password, are automatically deleted once the applicable technical period expires (from five minutes to one hour, depending on the record type).

9. Transferring personal data to third parties

The Operator does not distribute or disclose personal data to third parties, except as set out in this section and/or directly required by the laws of the Russian Federation.

To provide personal data processing services on the Operator's behalf, the following parties are engaged as processors under agreements concluded with them and/or the public offer of the relevant service:

• Yandex LLC (OGRN 1027700229193, 16 Lva Tolstogo St., Moscow, 119021), for transferring de-identified data as part of using the "Yandex Metrica" service, as described in Sections 5 and 10 of this Policy;
• Yandex.Cloud LLC (OGRN 5167746432040, 16 Lva Tolstogo St., Moscow, 119021), for providing computing capacity and the "Yandex Cloud Postbox" transactional email delivery service, which the Operator uses to send the data subject messages related to using the dashboard (registration confirmation, passwordless sign-in links, reminders, and other transactional notifications). Sending a message to this service shares the recipient's email address, the message content, and its subject;
• Selectel LLC (OGRN 1089847357126, 21A Tsvetochnaya St., Saint Petersburg, 196084), for providing server infrastructure hosting for the Site within the Russian Federation;
• the YooKassa and Lava.top payment services, for accepting payment for the Operator's services. The service receives the order amount and identifier and the data subject's email address for the receipt and payment notifications. The data subject enters card details directly on the payment service's side. Lava.top is used for cards issued outside Russia, as described in section 7;

The Operator ensures that the processors it engages keep personal data confidential and apply protection measures that meet the requirements of the laws of the Russian Federation.

Besides the above, personal data may be transferred to third parties in cases directly provided for by the laws of the Russian Federation, including on a reasoned request from authorized government bodies, where grounds provided by law exist.

10. Use of cookies and similar technologies

The Site uses the "Yandex Metrica" web analytics service, which sets cookies and stores a de-identified visitor identifier in the data subject's browser. These cookies are used only to collect traffic statistics and improve the Site. The Operator does not build advertising behavioral profiles, show targeted ads, or pass data to ad networks.

The "Yandex Metrica" scripts and cookies are loaded only after the data subject gives explicit consent, by clicking "Accept" in the information banner shown on first visiting the Site. Until that consent is given, "Yandex Metrica" cookies are not set. The data subject's choice is saved in the browser's local storage (localStorage) and applied on later visits; to withdraw consent, it is enough to clear the relevant domain's local storage through the browser.

A data subject may independently opt out of data collection by "Yandex Metrica" in any of the following ways: configure the browser to block cookies from the mc.yandex.ru domain, use browser extensions that block web analytics scripts, or use the opt-out tool provided by Yandex LLC at yandex.ru/support/metrica/general/opt-out.

No other third-party web analytics services (including Google Analytics) or font, script, or content delivery services (including Google Fonts) are used on the Site. The fonts, styles, and scripts needed to display the Site are hosted on the Operator's own resources and loaded from the izidevops.com domain.

11. Rights of the data subject

Under Chapter 3 of Federal Law No. 152-FZ "On Personal Data" dated July 27, 2006, a data subject has the right to:

• get information about the processing of their personal data, to the extent set out in Article 14 of 152-FZ;
• require the Operator to correct, block, or destroy their personal data if it is incomplete, outdated, inaccurate, unlawfully obtained, or not necessary for the stated purpose of processing;
• withdraw consent to the processing of personal data;
• appeal the Operator's actions or inaction in the manner established by the laws of the Russian Federation.

Data subjects should send requests to the Operator by email at partners@izidevops.com. A reply is provided within ten business days of receiving the request, and, if needed, sent to the reply address given in the request.

12. Final provisions

The Operator has the right to change this Policy without the data subjects' consent. A new version of the Policy takes effect from the moment it is published on the Site at the address given in the preamble, unless the new version provides otherwise.

If the Operator starts offering services on the Site that involve collecting additional categories of personal data not listed in Section 5 of this Policy, the current version of this Policy must be amended and published as set out in this section before such personal data is processed.