Privacy policy
Version 2026-10-12
This Policy describes how personal data of SmileFuture widget users (the “Widget”) is processed and how it is protected. It is published under Article 18.1 of Russian Federal Law No. 152-FZ “On Personal Data”.
1. Personal data operator
Personal data is processed by OOO “BAUART IT SOLUTIONS” (ООО «БАУАРТ АЙТИ РЕШЕНИЯ»), OGRN 1252400004691, INN 2466302057, registered address: 20K 2nd Bryanskaya Street, Krasnoyarsk, Russia (the “Operator”).
2. Data we process
2.1. When you use the Widget, the Operator processes the following categories of personal data:
- a photograph of your face, uploaded voluntarily to generate a visualization;
- the generated visualization;
- a phone number and/or email address, if you choose to provide them in order to receive the result without a watermark and to be contacted by the clinic;
- IP address and technical data (user agent, timestamp), for security and to record that consent was given.
2.2. EXIF metadata and other technical information are removed from the photograph before it is sent to a third-party image-generation service.
3. Purposes
- generating a visualization of a possible orthodontic or dental treatment result from the uploaded photograph;
- the Operator’s quality control of generations;
- showing the original photograph and the result again in the personal account of the clinic whose widget produced the generation;
- passing your contact details to the dental clinic on whose website the Widget is installed, so the clinic can contact you about a consultation;
- keeping the Widget secure and preventing misuse.
4. Legal basis
Processing is based on the data subject’s consent, collected before the Widget is used (Article 6 of Federal Law No. 152-FZ).
5. Where personal data is stored
5.1. Contact details, the IP address, the original photograph, and the generated result are stored on a server in the Russian Federation for the periods in section 8, as required by Article 18(5) of Federal Law No. 152-FZ.
5.2. Only a de-identified photograph — without metadata and without accompanying personal data — is transferred outside the Russian Federation, and only to generate the visualization. See section 6.
6. Cross-border transfer
6.1. To generate the visualization, the de-identified photograph is sent through a relay server in a jurisdiction with access to the Google Gemini API (United States) to Google LLC (United States).
6.2. The cross-border transfer is made under Roskomnadzor permit No. 100427489 dated 18 September 2026, obtained by the Operator under Article 12 of Federal Law No. 152-FZ.
6.3. Google LLC processes the transferred data under the paid Gemini API terms, which state that submitted data is not used to train artificial-intelligence models.
7. Sharing data with the clinic
7.1. Your contact details (phone and/or email) are passed to the dental clinic on whose website the Widget is installed only after you expressly agree, and only so the clinic can contact you about a consultation.
7.2. The generated visualization, without the original photograph as an attachment, is emailed to the clinic and to the Operator’s internal address for consultation follow-up and quality control. The original photograph is not attached to that email.
7.3. For the period in section 8, the clinic whose widget produced the generation can view the original photograph and the result in its personal account, so it can show the result again. The clinic sees only its own generations. The Operator views the same files for quality control.
8. Retention
- the original photograph and the generated result are kept for 90 days from upload for quality control and for the clinic-account history, then deleted automatically. They are deleted sooner if you withdraw consent or request erasure, or if that clinic’s account is closed, whichever comes first;
- data collected under the Policy edition of 2026-09-30 is kept and deleted on the terms of that edition;
- contact details (the lead) are kept until the purpose of processing is achieved (in particular, until the clinic finishes contacting the prospective patient) or until you withdraw consent, whichever comes first.
9. Your rights
You may request information about how your personal data is processed, ask for it to be corrected, blocked, or deleted, and withdraw consent by writing to support@smilefuture.ru. A request for erasure is carried out within 30 days of receipt.
10. Safeguards
The Operator uses organizational and technical safeguards, including access limits, encryption in transit, and automatic deletion when the retention period ends.
11. Changes to this policy
The Operator may update this Policy. The current version is always available at smilefuture.ru/en/privacy.