monkeymachine™ — LEGAL CHANGELOG

We keep a log of changes to Terms/Privacy/Cookies/AUP/DPA/etc.

Format: [YYYY‑MM‑DD] Version X.Y — Summary of changes; Effective date [YYYY‑MM‑DD]; Notice sent via email + in‑app banner.

[2026‑08‑19] Privacy Policy v2.4, Terms of Use v1.3, RF PD Policy v2.1, DPA v1.3, Sub‑Processors v2.2, Sanctions & Export v1.2 — Effective: 2026‑08‑19

• Removed all provisions describing cross‑border transfers of personal data: Privacy Policy §8.2/§8.3, RF PD Policy §6.3–6.4, DPA §4, Sanctions Policy §5.4;
• Privacy Policy §8 renamed to "Data Hosting & Localisation": infrastructure, primary databases, object storage and backups are located in the Russian Federation;
• Removed references to the GDPR and to EEA supervisory authorities — the documents now follow the legal framework of the Russian Federation (Federal Law No. 152-FZ);
• Privacy Policy §5 reframed: the Customer connects its own pre‑existing accounts and channels; the Customer's relationship with those services is governed by those services' own policies accepted by the Customer;
• Registered addresses and countries of sub‑processors removed from the register;
• The separate registration consent to cross‑border transfer has been discontinued.

[2026‑07‑13] Privacy Policy v2.3 — Effective: 2026‑07‑13

• Clarified conditional use of the Sentry SDK and managed self-hosted GlitchTip for privacy-safe mobile crash diagnostics;
• Documented diagnostic data categories, disabled-by-default PII and screenshots, retention of up to 90 days, and no advertising profiling.

[2026‑03‑22] Privacy Policy v2.0 — Effective: 2026‑04‑21

• Section 5.1 (Meta Platform): Added all 8 prohibited data actions per Meta Platform Conditions (anti‑discrimination, anti‑eligibility, anti‑surveillance, anti‑reverse‑engineering, anti‑profiling, no data sales, no cross‑client sharing, no profiling without consent);
• Section 5.2 (WhatsApp): Expanded to cover opt‑in requirement, roles of the parties, VoIP‑only restriction, HIPAA prohibition, payment card data prohibition, cross‑client data isolation, 90‑day deletion on WABA disconnect;
• Restructured Russian locale (section 5) to mirror English structure.

[2026‑03‑22] Sub‑Processors v2.0 — Effective: 2026‑04‑21

• Added new Section 1 "Communication Platforms": Meta Platforms, Inc. (WhatsApp Business API, Facebook Messenger, Instagram Direct) and Telegram FZ‑LLC;
• All existing sections renumbered accordingly.

[2026‑03‑22] DPA v1.1 — Effective: 2026‑04‑21

• Section 1 (Roles): Added WhatsApp/Meta data processing chain (Customer→Meta→MM);
• Section 2 (Instructions): Added MGPT reference for WhatsApp data;
• Section 3 (Sub‑Processors): Added Meta cross‑reference.

[2026‑03‑22] AUP v1.1 — Effective: 2026‑04‑21

• Section 1: Added WhatsApp‑specific prohibitions (opt‑in, card numbers, cross‑client data, Commerce Policy, anti‑spam).

[2026‑03‑22] Security TOMs v1.1 — Effective: 2026‑04‑21

• Section 2: Added API credentials protection per Meta Platform Conditions §6.a.iv.

[2026‑03‑22] Sanctions v1.1 — Effective: 2026‑04‑21

• Added Section 4: WhatsApp‑specific restrictions (sanctioned parties, proxy prohibition, weapons prohibition).

[2026‑03‑22] Third‑Party v1.1 — Effective: 2026‑04‑21

• Added Section 3: Meta Platforms & WhatsApp — links to all applicable Meta/WhatsApp terms and policies.

[2026‑03‑22] Data Deletion — Effective: 2026‑04‑21

• Added WhatsApp data deletion section (90‑day process on WABA disconnect).

[2026‑03‑23] Terms of Use v1.1 — Effective: 2026‑04‑22

• Section 12: fully reworked — added: 12.4 (third-party integration disclaimer), 12.5 (Customer indemnification), 12.6 (Customer's responsibility as Data Controller);
• Expanded limitation of liability clauses (12.1–12.3).

[2026‑03‑23] Privacy Policy v2.1 — Effective: 2026‑04‑22

• Section 5: Added subsection 5.6 «CRM Systems and Business Automation Platforms» (YCLIENTS, amoCRM, RetailCRM);
• Section 6 (Product Data Matrix): Added «CRM Integrations» row.

[2026‑03‑23] Sub‑Processors v2.1 — Effective: 2026‑04‑22

• Added Section 8 «CRM and Business Automation Systems»: YCLIENTS, amoCRM, RetailCRM with legal details;
• «Notice of Changes» renumbered to Section 9.

[2026‑03‑23] DPA v1.2 — Effective: 2026‑04‑22

• Section 1 (Roles): Added CRM integration data processing chain (Customer→CRM System→monkeymachine™).

[2026‑03‑23] RF Personal Data Policy v2.0 — Effective: 2026‑04‑22

• Complete rewrite: expanded from 10 to 13 sections per Art. 18.1 of Federal Law No. 152-FZ;
• Added: processing purpose table with legal bases, detailed PD composition, retention periods, security measures, Art. 22(2) notification exemption rationale, processing-on-instruction section.

[2025‑11‑02] Initial publication v1.0 — All documents.