doIT Pointer personal data policy

1. Operator and service

The personal data operator is O SPORT LLC (37 Belovezhskaya St., apt. 153, Moscow, Russia; OGRN 1247700191705, INN 9731131284), trading as doIT Agency. Contact e-mail for requests: info@do-it.agency

This policy covers personal data processing in the doIT Pointer service: in the browser extension, on the doIT server and when recordings are given to the client company. An employee of the client company turns the extension on to show a task with the cursor and voice. Data processing on the do-it.agency website is covered by the general policy

2. Purpose

To give the client company its employee’s recordings so that the company’s AI assistant can do the task set in the recording

3. Whose data and what data

Employees of client companies who installed the extension and gave consent

Voice during the recording and its transcript; addresses and titles of open pages; cursor movement, clicks, scrolling; a description of the element under the cursor; screenshots of the visible part of the page while the employee speaks and the cursor stays still (unless screenshots are turned off); recording time, time zone, extension and browser versions; key name; IP address; consent details

The extension does not read the values of input fields, but they may appear in a screenshot. Values of address parameters that look like passwords or tokens are replaced with an ellipsis. Voice is not used to identify the person

Pages shown by the employee may contain other people’s data. The extension warns the employee not to show such pages. If such a page still ends up in a recording, the recording is deleted at the request of the employee or the company

4. Legal basis

Consent of the data subject (clause 1 of part 1 of Article 6 of Federal Law No. 152-FZ). Consent is given separately with the «Даю согласие» (I give consent) button in the extension settings; consent text. The server keeps proof of consent: the employee’s key, the text version, the time the button was pressed, the time the server received the consent and the IP address it came from. Without consent the server does not accept recordings

5. Operations and method

Collection, recording, storage, speech-to-text, systematisation, retrieval, provision to the client company, deletion and destruction, by automated means

6. Where data is stored and who receives it

Recordings are written and stored on the Operator’s server in Moscow. Speech is transcribed by the Operator’s speech recognition server in the same place and is not sent to third-party services

The client company receives, with its read key, only its own employees’ recordings: the report (pages, phrases, pointers), cursor track and marked screenshots. Audio and original screenshots are not provided

The company opens recordings with the AI assistant Claude by Anthropic PBC (USA). It runs outside Russia: during the pilot on a server in the Netherlands, with requests processed in the USA. This is a cross-border transfer of personal data and happens only with the employee’s consent

7. Retention

A recording is kept for 30 days after it ends and is then deleted from the Operator’s server entirely. The company’s program deletes downloaded copies older than 30 days by itself. Fragments the AI assistant has already opened may remain in its conversation history

Consent details are kept as proof while consent is in force and for 3 years after withdrawal

8. Rights of the data subject

The employee may obtain information about the processing of their data, request deletion of a recording and withdraw consent. Requests are accepted at info@do-it.agency. Consent can also be withdrawn with the «Отозвать» (Withdraw) button in the extension settings. A single recording can be deleted early through the company’s AI assistant by naming its code. The Operator replies within 10 working days (Articles 14 and 20 of 152-FZ)

9. Security

Recordings are accessible only with keys. An employee key writes recordings; a company key reads only its own company’s recordings and has no access to others. Connections are encrypted (HTTPS). Keys are not written to request logs. A revoked key stops working immediately

Incident response follows the general policy: notification of Roskomnadzor within 24 hours and a report within 72 hours

10. Changes

The Operator may update this policy; the current version is at do-it.agency/ru/ukazka/privacy/. If the consent text changes, the extension asks for consent again