Privacy Policy — ASRP.tech

Document: Privacy Policy — ASRP.tech
Version: 0.19c
Effective date: 2026-10-30

1. Who is responsible

The operator of ASRP.tech is Perspective Scientific Research and Development LLP (English translation of the registered name; the Russian name is authoritative), registration number BIN 240140033296, registered address Komarova 37-56, Baikonyr. Contact for privacy questions: info@asrp.tech. No data protection officer has been appointed. Contact: info@asrp.tech.

2. Scope

This policy describes the personal data processed by ASRP.tech. It applies to visitors, account holders and, where relevant, authors, curators, experts and staff.

3. Data we process

Account and identity

• The account record can hold: full, first and last name, username, e-mail, phone, avatar, date of birth, gender, language, time zone, country/region/city, Telegram ID, balance, last-activity time, role and permissions. Passwords are kept as credentials by the identity service.
• ASRP.tech operates the central ASRP ID (OpenID Connect) used by ASRP.art, ASRP.media, ASRP.science and Arcanum12th; it issues authorization codes and refresh tokens, supports password and Telegram sign-in, and serves accreditation and employment records to those products.
• Login session records store the token, its lifetime, the browser user-agent and the IP address.

Content and activity you create

• The dream journal stores the dream text (original, summary, refined and translated versions), notes, flags (lucid, nightmare, etc.), sleep and wake-up times, location identifiers, a generated image and a prediction.

Communications

• The Telegram bot integration schedules sleep reminders and processes dream jobs; partner (referral) reports are produced for partners.
• The help form stores first and last name, e-mail, phone, selected tariff and message. Staff see letters with the applicant e-mail masked.

Marketing source and usage data

• Marketing source data (UTM) is saved with the user and in per-user records of initial source; donate pages record visits, clicks and UTM data.

Roles, permissions and staff access

• Staff roles, permissions and an accreditation status are kept per account; staff can view user records through staff panels, with e-mail addresses masked in lists.

Server logs

• The API writes application logs through a logger module; their content and retention are set by the operator.

Special-category data (health, neural and dream data) is described in the section “Health, neural and research data” below.

4. Cookies and browser storage

• The website sets the cookies token, autoGeneratedToken, currencyId, utm and user, and keeps the chosen theme in local storage under the key theme.

ASRP.tech sets these cookies: token, autoGeneratedToken, currencyId, utm, user. It also keeps this data in the browser local storage: theme.

Cookie notice. On your first visit the site shows a notice that it uses cookies, with the button “Got it” (“Понятно” in the Russian version). The notice is informational: it does not let you choose cookie categories and does not switch cookies or scripts on or off. After you press the button, the notice is not shown again: your acknowledgement is stored in the browser local storage under the key asrp_cookie_notice_ack (no expiry) and in the first-party cookie asrp_cookie_notice_ack (400 days, renewed on each visit). The notice is shown again only if both entries are missing.

Google Tag Manager. Every page of the site loads Google Tag Manager (container GTM-5VDP7D4S), a script from Google LLC. The cookie notice described above does not switch it on or off. Tags for analytics (for example audience statistics) and advertising (for example ad measurement) may be added to the container; such tags can set their own cookies and are governed by the terms and privacy notices of Google or of the tag provider. When Google Tag Manager and its tags load, Google receives technical data: your IP address, device and browser data, the pages you visit and cookie identifiers; this data is transferred to the United States (see section 7). To refuse, block or delete cookies in your browser settings, use a tracker or content blocker that blocks googletagmanager.com, or use Google's opt-out tools (for example the Google Analytics opt-out browser add-on at https://tools.google.com/dlpage/gaoptout and the ad settings at https://adssettings.google.com). Blocking cookies that the site needs, such as those used for sign-in, may stop parts of the site from working.

5. Payments

• The payment layer integrates these providers: Stripe, plus internal balance and cash records. Which are active in production is set by the operator.
• For recurring payments a saved-card record holds the card type, a masked card number, a recurring token and its expiry; full card numbers are not part of this record.
• Orders, purchases, subscriptions, transactions, coupons and gifts are recorded against the account.

Payment providers process payment details under their own terms and privacy notices. Payment provider: Stripe. Card payments via Stripe are received by ADVANCED SCIENTIFIC RESEARCH PROJECTS LLC, a Florida limited liability company, registration L17000209665, EIN 82-3065295, registered address 7901 4th St N Ste 300, St. Petersburg, FL 33702, United States (registered agent: Registered Agents Inc, at the same address). This US company is only the recipient of these payments; the data operator remains the Kazakhstan LLP named in this document. Payments via the Unicorn Lab payment system are received by the Kazakhstan LLP named in this document.

6. AI processing and other recipients

• The visitor IP address is sent to the MaxMind GeoIP2 web service to estimate country and city.
• Where dream-analysis features are switched on, dream text is processed by OpenAI language models for analysis, interpretation, translation and language handling.
• Event pages can embed YouTube videos. Google Tag Manager is described in section 4.

Staff of the operator and its technical service providers can access data as needed to run the service. All servers are located in the United States; hosting and infrastructure providers are hosting providers in the United States.

7. International transfers

Some recipients named in this policy are located outside the operator's country. Personal data is transferred to and stored in the United States.

8. Retention and deletion

• Accounts are soft-deleted (a deletion timestamp is set and sign-in is refused). Self-service deletion is described below.

Retention: account data is kept while the account is active and for 3 years afterwards; logs are kept for 1 year; payment records are kept for 5 years (accounting law).

You can delete your ASRP account in the whole ASRP ecosystem yourself, in your account settings in ASRP.tech. After you start the deletion you have 24 hours to cancel it. Works you have published stay on the site signed “Deleted author”, and your comments are anonymized. If you have unpaid income, the deletion is delayed until the payout. Payment records are kept for 5 years. Requests are handled within the period required by law.

9. Your rights and how to exercise them

Subject to the applicable law (law of the Republic of Kazakhstan; supervisory authority: Ministry of Digital Development of the Republic of Kazakhstan) you can ask for access to, correction, deletion, restriction or transfer of your data and object to its processing. Send requests to info@asrp.tech. We handle requests within the period set by the law of the Republic of Kazakhstan on personal data, without undue delay.

10. Minimum age

Minimum age to use the service: 18 years. The service is not intended for persons under 18, and we do not knowingly process their personal data. Your age is checked only when you register an ASRP ID in ASRP.tech, by date of birth; registration is blocked under 18, and other ASRP products receive only the age result from your ASRP.tech account. We store only the date of birth needed for this check, keep it for the same period as the account, and never show the full date in public profiles. Accounts whose age is unknown (for example, created through Telegram) cannot use sensitive features until a date of birth is provided in ASRP.tech. If you believe that data of a person under 18 was provided, write to info@asrp.tech.

11. Security

Security measures actually found in the code are stated in the sections above (for example HttpOnly cookies and log redaction).

12. Changes to this policy

Material changes are sent to users by e-mail, and a new version with a new date is published on the site with an entry in the change log. Minor edits (typos, non-substantive wording) are published on the site without e-mail. The effective date of each version is the date of its publication on the site.

13. Health, neural and research data

Dream records. When you register you accept this policy, including the processing of the dream text you enter, as described here and in section 6: dream text is sent to OpenAI for analysis, interpretation and translation; OpenAI processes it on our behalf. Dream text is stored on ASRP servers in the USA (cross-border transfer from Kazakhstan).

Medical analyses and neural (EEG) data are not collected at present. Before they are, you will be asked for a separate explicit consent for each data type; it is never pre-ticked and never combined with other consents. Such data is not passed to third parties.

Neural data is described by category: signals recorded by a neural device whose source is either ASRP’s own device or a partner’s device. No device is connected to the product at present.

Medical and neural data belong to special categories of personal data. Before you upload or connect medical analyses or neural data, you are asked for a separate explicit consent for that data type; consents are never pre-ticked and are not combined with other consents. The consent screen links to this section.

Visibility: only you and named ASRP experts; experts see the data only with your permission for each case, and every such access is logged.

Neural-device providers are described only by category (ASRP’s own devices and devices of partner manufacturers); a partner device is added only after a signed agreement with its manufacturer is in place.

Retention: until you delete the data and for 1 year after that.

Users under 18 cannot use these features.

Medical analysis and neural data features are not offered at present.

14. Change log

Version	Date	Change
0.15	2026-10-30	Text first published on the site.
0.16	2026-10-30	Owner decision of 30 Oct 2026 applied: the US limited liability company is verified; its registered address is stated in the verified form and the registered agent is named.
0.17	2026-10-30	Provider lists trimmed (owner decision of 30 Oct 2026): providers not offered to users are no longer named.
0.18	2026-10-30	Wording updates (owner decision of 30 Oct 2026): the commission is deducted from the author payout; provider lists and some statements clarified. Follow-up (owner approval of 30 Oct 2026): payment-provider list trimmed; providers not offered to users are no longer named.
0.19	2026-10-30	Cookie section updated (owner decision of 30 Oct 2026): Google Tag Manager is loaded on every page and tags for analytics and advertising may be added; the data Google receives and ways to refuse are described. The cookie notice and the storage keys of your acknowledgement are also described.
0.19c	2026-11-01	Section 13 dream data and OpenAI wording (Tech, School); version header fix