VITON¹³ Privacy Policy

The operator of your data

Vitalii Alekseevich Tarasov, a self-employed individual in the Russian Federation, payer of the Professional Income Tax (Federal Law No. 422-FZ of 27 November 2018), runs the VITON¹³ brand and the viton13.com website and its sections. The seller's taxpayer number (INN) is printed on every receipt. He decides how and why personal data is processed on viton13.com and its sections (store, studio, journal, market, school and support), in the VIT app for iOS and through the VITON ID account, and is the operator of that data under Russian Federal Law No. 152-FZ of 27 July 2006 “On Personal Data” and, for visitors in the European Union and the United Kingdom, the controller under the GDPR and the UK GDPR.

This policy covers everyone who visits the sites, holds a VITON ID, places an order, sends a request, writes to the direct line, comments in VJOURNAL or applies to VITON¹³ SCHOOL. It is published in English, Russian, Spanish, French and Hindi; if a translation differs from the Russian text, the Russian text applies.

Write to viton13bussiness@gmail.com ›Call or message +7 981 107-82-51 ›

The data we process, by the thing you do

We collect only what a feature needs. The list below is complete: if a page asks for something not listed here, the page says what it is for.

• VITON ID account: name, email address, phone number, a password stored only as a hash by Firebase Authentication, your age range, city and country if you add them, avatar, short bio, your VITON ID handle, your marketing choice, and the VITO bonus balance and history (13 VITO = $1).
• Orders and checkout: name, email, phone, delivery address (street, apartment, city, region, postal code, country), company name if you add it, the delivery and payment route you choose, the items and totals, and the order conversation with the studio. Card numbers, wallet keys and bank credentials are never entered on VITON¹³ pages: they go only to the page of the payment provider you selected.
• Requests and forms: service briefs and the files attached to them, contact-page messages, direct-line messages, VIT MARKET requests, VITON¹³ SCHOOL applications (age, occupation and learning goal), and enquiries about children's work, which an adult sends.
• Messages and public activity: messages and attachments between VITON IDs, VJOURNAL comments, reactions and reports, and the public name shown next to them.
• Health card: if you choose to fill in the medical health card in your cabinet, the health details you enter. They are stored for your account only, shown only to you, and never used for marketing.
• Technical data: IP address, browser and device type, language, the pages you open, the referring page, a random session identifier, the country hint your browser or network sends, and error logs.
• Cookies and browser storage, listed in full in the cookies section below.

Sources of the data

Almost everything comes from you: the forms you fill in, the account you create, the messages you send and the pages you open. Firebase confirms your phone by SMS and Resend delivers the email codes, so both return a verification status. The payment route you choose returns a payment status and reference. The delivery partner or the VIT MARKET supplier fulfilling your order returns tracking updates. The shipping zone suggested in the store is guessed from your browser language and, where present, a country header from the network, never from an IP-geolocation service.

Purposes and legal bases

Each purpose below rests on one of four grounds: the contract you enter with us, your consent, our legitimate interest in running a safe site, or a legal obligation. Under 152-FZ these are the performance of a contract to which you are a party, your consent, the obligations the law places on the operator, and the operator's legitimate interests where they do not infringe your rights and freedoms (Art. 6 of 152-FZ).

• To create and secure your VITON ID and verify your phone and email (contract).
• To take an order, confirm availability and the final total, price delivery for your address, deliver, send order updates and handle returns and refunds (contract).
• To answer requests, quote and deliver studio services, run the direct line, the order conversations and the VIT assistant (contract and legitimate interest).
• To keep the site and accounts safe: rate limits, reCAPTCHA, fraud prevention, moderation of comments and reports, security logs (legitimate interest and legal obligation).
• To measure how the site is used, only after you allow analytics (consent).
• To send news and offers by email, only if you ticked the box at registration or in the cabinet; every such email carries an unsubscribe link (consent).
• To keep accounting, tax and consumer-law records for the period the law requires (legal obligation).
• We do not sell personal data, do not build advertising profiles and do not make automated decisions that have a legal effect on you.

The VIT assistant and automated help

The VIT assistant answers questions about products, services and orders using a language model that VITON¹³ runs on its own infrastructure; your questions are not sent to a third-party AI provider. A conversation is stored only if you leave a contact or ask for a person, in which case it becomes a request and is handled like any other. The assistant never sees your password, card details or messages.

Cookies and browser storage

The site works with a small, fixed set of cookies and local storage. Nothing here tracks you across other websites, and no advertising network sets cookies on VITON¹³.

• viton13_session — signs you in to VITON ID. HttpOnly, set on sign-in, expires after 5 days or when you sign out.
• viton_zone — the delivery zone you chose in the store. Written only after you click a zone, kept for 180 days.
• viton13_cookie_consent (local storage) — your analytics choice, kept until you change it or clear the site data.
• Local storage for the bag, the direct-line thread token, drafts and interface preferences; it stays in your browser and never reaches our servers on its own.
• Analytics cookies from Yandex Metrica, Google Analytics and Microsoft Clarity — set only after you choose “Allow analytics”. Choosing “Only necessary” keeps them off; to change a choice later, clear the site data in your browser or write to us.

Analytics and session replay

With your permission we use Yandex Metrica, Google Analytics 4 and Microsoft Clarity to see which pages are read and where people get stuck; Ahrefs Web Analytics, a cookieless counter, loads under the same consent. Private surfaces are never recorded: the cabinet, messages, the bag and checkout, the admin console, sign-in, registration, recovery and secure requests. Query parameters that could identify a person or a conversation are removed before a page path is reported, and content marked private is masked in session replays.

Independently of those tools, the site keeps its own visit counter: a random session identifier, the page path, the language and the referring page. It stores no form values, names or contact details, and it stops on private surfaces.

How payments are handled

At checkout you choose a payment route: a Russian card or SBP (MIR, SberPay, T-Pay), an international card (Visa, Mastercard, American Express) on the payment provider's PCI page, PayPal, a personal payment link in Telegram, cryptocurrency (USDT, USDC, BTC, ETH, TON) or another route such as YooMoney or a bank transfer. Card and wallet details are entered on the provider's page, never on ours. VITON¹³ keeps the payment reference, amount, status and the route you used, which is what a refund needs.

Who receives data and why

We share data only with providers that do a job for you or for us, and only the part that job needs. They act under contracts, follow their own security programmes and may not use the data for anything else.

• Google Firebase: authentication, account profiles, the database behind orders, requests and messages, reCAPTCHA and the SMS codes for phone verification.
• Resend: email verification and recovery codes, order and request emails, and the newsletters you opted into.
• Hosting providers for the website, the API and their server logs.
• The delivery partner carrying your parcel: name, phone number and delivery address.
• The supplier in the VIT MARKET partner network that fulfils your order: the delivery details for that order only.
• The payment provider you choose: the amount and a payment reference; your card or wallet details go to it directly.
• Yandex Metrica, Google Analytics, Microsoft Clarity and Ahrefs Web Analytics, only after you allow analytics.
• Public authorities, when a law we are subject to requires it.

Messages, secure requests and encryption

Messages between VITON IDs are end-to-end encrypted: the key pair is generated on your device and only the public half is published to the server, so VITON¹³ cannot read the messages or the attachments, which are encrypted before upload. A secure project request is encrypted in your browser before it is sent, and only someone holding the link together with its key can open it. Deleting a request removes the encrypted package; a device that loses its keys starts fresh with new ones.

What other people can see

A VJOURNAL comment shows the name on your account. The member directory that signed-in members can search shows the public slice of a profile only: name, VITON ID, avatar, city and country, tier, bio and wardrobe focus — never your email, phone, orders or messages. Children's work bought by VIT MARKET is published with a first name and an age only; no surname, school, address or photograph of the child. The people profiled in VJOURNAL are editorial subjects, not account holders.

Newsletters, offers and VITO bonuses

Marketing emails go only to accounts that ticked the box at registration or in the cabinet, and every one of them carries a one-click unsubscribe link that needs no sign-in. Service notices — order status, security alerts, changes to these documents — are sent to every account, because they are part of the service. VITO bonuses (13 VITO = $1, 13 granted once to every account) are recorded in your profile so you can see and spend them.

Where the data is stored and processed

The operator works in the Russian Federation, and Old Money orders ship from a warehouse in Primorsky Krai, Russia. Firebase, Resend and the analytics providers run their infrastructure in the United States and the European Union, so the data you give us may be transferred across borders to those countries. Each provider receives only what its service needs, and the rest stays in VITON¹³'s own systems.

How long we keep data

• Account data: while your VITON ID is active, then only as long as security, fraud-prevention, legal or support obligations require.
• Orders, payment references and invoices: for the period accounting and consumer law require in the country of sale.
• Requests, briefs, direct-line and order conversations: while the request is open and for as long as a follow-up, a warranty question or a dispute can reasonably arise.
• Comments and reports: while the story is published, unless you delete them or moderation removes them; reports are kept for moderation records.
• Visit counter and security logs: short, rolling periods used only for statistics and incident investigation.
• Analytics data: according to the retention settings of each tool, which we keep at their shortest reasonable value.

How the data is protected

Every page and API is served over HTTPS. Passwords are hashed by Firebase Authentication and never stored in clear text. Sign-in, registration and mutations are rate-limited and protected by reCAPTCHA. The session cookie is HttpOnly and expires after five days. Private API responses are marked no-store. Admin tools are reachable only with an admin claim. Messages and secure requests are encrypted as described above. No method is perfect: if you find a weakness, write to us and we will treat it as urgent.

Children and young people

A VITON ID can be created from the age of 13; between 13 and 17 it should be used with a parent's or guardian's knowledge and consent. Orders, applications and payments are made by adults, and an adult sends every enquiry about a child's work and receives the payment for it. We do not knowingly collect data from children under 13; if you believe we hold such data, write to us and we will delete it.

What you can ask for, and how

Wherever you live you can ask us what we hold about you, get a copy, correct it, delete it, restrict or object to its use, receive it in a portable format, withdraw a consent you gave, and unsubscribe from marketing. Depending on your country these rights are set out in Russia's Federal Law No. 152-FZ “On Personal Data”, the GDPR and UK GDPR, India's Digital Personal Data Protection Act or California's CCPA.

To use a right, write to viton13bussiness@gmail.com from the email address of your account, or from the account settings in the VIT app. You can delete your VITON ID yourself in the VIT app for iOS under Settings → Delete Account, which removes the Firebase account, the profile and the reserved VITON ID. We answer every request within 10 working days of receiving it; if more time is needed, the period is extended by no more than 5 working days and we tell you the reason. We may ask you to confirm your identity first.

You can withdraw a consent at any time by writing to the same address. In Russia you can complain to Roskomnadzor, the federal authority that supervises personal data; elsewhere, to the data-protection authority of your country.

Send a request ›Privacy and security help ›

Changes to this policy

When a feature, a provider or the law changes, this page changes with it; the “page updated” date at the top shows when. A change that matters to account holders is announced on the site and by a service email. Continuing to use the sites after the date of a change means the updated policy applies.

How to reach us

Email viton13bussiness@gmail.com, phone or WhatsApp +7 981 107-82-51, Telegram @Vitonsupport, or the contact page. Requests are accepted 24/7; a person answers privacy questions in the language you write in.

Contact page ›Help Center ›