Privacy Policy

1. Controller and contact person

For personal-data matters relating to this Website, the published contact point is legal@ftlab.space. The English-language site presents FinTechLab as an independent research laboratory. The Russian-language site presents the Laboratory of Modern Financial Technologies in connection with Saint Petersburg State University (SPbU); for that locale the published contact mailbox is behecon.spbu@spbu.ru. Where University rules or mandatory law require a different operator designation, those rules prevail. A separate postal address, tax identifier, or named Data Protection Officer is not published in the Website codebase; rights requests are handled through the contact addresses above.

2. Scope and applicable law

This Policy covers the public Website, including the partnership contact form and the interactive educational anti-fraud simulation. It does not cover offline research projects, separate University information systems, partner platforms, LinkedIn, or other third-party sites linked from the Website. Russian Federation personal-data law (including Federal Law No. 152-FZ) is relevant for the Russian-language site and correspondence with SPbU-related mailboxes. The EU General Data Protection Regulation (GDPR) and UK GDPR may apply when we process personal data of individuals in the EEA or United Kingdom who use the contact form or otherwise communicate with us through the Website. Where more than one regime applies, we apply the requirements that are mandatory for the relevant processing.

3. Categories of personal data

The Website does not require user accounts and has no application database for visitor profiles. Depending on how you interact with the Website, the following categories may be processed:

• Contact-form data you submit: name, organisation, email address, enquiry type, message text, interface locale, and a technical source label (for example, “website”).
• Email correspondence you send to a published laboratory address (legal@ftlab.space or behecon.spbu@spbu.ru), including any personal data you voluntarily include in that message.
• Technical data that hosting or network infrastructure may process to deliver pages and APIs (for example IP address, date/time, requested URL, and user-agent). The Website application itself does not implement analytics identifiers, advertising cookies, or a visitor database.
• Data that is not collected by the Website application: payment data, banking credentials, one-time codes, PINs, account passwords, precise geolocation for tracking, biometric data, or marketing profiles.

4. Purposes of processing

We process personal data only for the following purposes that exist in the Website’s operation:

• Receiving and answering partnership or research enquiries submitted through the contact form or by email.
• Routing an enquiry to the locale-appropriate laboratory mailbox and, where configured by the operator, delivering it through an email API or webhook.
• Operating, securing, and troubleshooting the Website and its contact API (including rejecting automated spam via a honeypot field that is not used for correspondence when filled).
• Complying with applicable legal obligations and responding to lawful requests from competent authorities.

5. Legal bases

Where GDPR / UK GDPR applies, processing of contact enquiries is based on Art. 6(1)(b) (steps at the request of the data subject prior to entering a contract or collaboration) and/or Art. 6(1)(f) (legitimate interests in responding to research and partnership outreach and operating a secure public research site). Technical hosting processing necessary to serve the Website relies on Art. 6(1)(f). Where Russian law applies, processing is carried out to respond to your enquiry and to pursue the laboratory’s lawful research and institutional communication activities; if a specific activity requires consent under that law, consent will be obtained before that activity begins. The Website does not currently run consent-based advertising or analytics tracking.

6. Contact form — collection and transfer path

The only interactive form that collects personal data is the partnership contact form (used on the Agentic AI research pages). It is submitted by HTTPS POST to the Website endpoint /api/contact as JSON (or as form-encoded data if JavaScript is unavailable). Message contents are not placed in the URL, browser history query string, or analytics parameters. On successful delivery the application does not store the enquiry in an application database. Delivery uses the first available configured channel: (1) an operator-configured webhook URL (CONTACT_WEBHOOK_URL), or (2) the Resend email API (api.resend.com) when RESEND_API_KEY is configured, sending to the locale mailbox (legal@ftlab.space for English; behecon.spbu@spbu.ru for Russian) with reply-to set to your email. If neither channel is configured in production, the API reports delivery unavailable and does not persist the message. In local development only, a limited log may be written to the server console. Separately, mailto links open your own email client; that path is controlled by you and your email provider, not by the contact API.

7. Interactive simulation

The anti-fraud educational simulation does not request personal data, banking details, credentials, one-time codes, PINs, or payment information. Choices, timing, click behaviour, results, and experiment state are kept only in browser memory for the active session. They are not stored, logged, or transmitted to our servers, and are discarded when you refresh or leave the page.

8. Cookies and similar technologies

The Website application does not set advertising cookies, marketing trackers, or analytics cookies. Locale routing is handled by URL path and host, not by a first-party preference cookie in application code. Essential technical mechanisms may still be applied by the browser or hosting environment for ordinary delivery and security of a website. Because the site does not deploy non-essential tracking cookies, no cookie-consent banner is required for the current configuration. The Cookie Policy publishes the audited inventory and preference guidance.

9. Analytics

No third-party analytics package (for example Google Analytics, Yandex Metrica, Plausible, or similar) is included in the Website dependencies or pages as of the effective date. If analytics are introduced later, this Policy will be updated before such processing begins.

10. Storage and retention

The Website codebase contains no application database (no visitor tables, CRM, or form archive). Enquiries that are successfully delivered exist thereafter in the receiving mailbox and/or in systems operated by the configured delivery channel (webhook destination or Resend), subject to those systems’ retention settings and laboratory email practice. We retain correspondence only as long as reasonably necessary to respond, complete related follow-up, and meet mandatory record-keeping or legal obligations; the application does not implement an automated deletion schedule. Simulation state is not retained by us. Technical hosting logs, if kept by the infrastructure provider, follow that provider’s retention settings.

11. Recipients and processors

We do not sell personal data. Recipients may include:

• Laboratory staff who read the locale mailbox used for correspondence.
• Resend (email delivery API at api.resend.com), only if RESEND_API_KEY is configured in the deployment environment.
• The operator of any webhook endpoint configured via CONTACT_WEBHOOK_URL, only if that variable is set.
• Hosting and network infrastructure used to serve the Website (deployment documentation contemplates platforms such as Vercel; the live provider is whichever environment actually hosts the deployment).
• Competent authorities where disclosure is required by law, court order, or binding request.
• External sites you choose to open (for example LinkedIn). Those services process data under their own policies; linking does not make FinTechLab the controller of their processing.

12. International (cross-border) transfers

Depending on hosting location and whether Resend or a webhook destination outside your country is used, personal data in an enquiry may be processed in jurisdictions other than your own, including outside the Russian Federation and/or outside the EEA/UK. Where GDPR / UK GDPR requires a transfer mechanism, we rely on the safeguards available for the relevant provider (such as an adequacy decision or standard contractual clauses implemented by that provider) together with organisational measures appropriate to a research laboratory website. Where Russian law on cross-border transfer applies, transfers are carried out in accordance with that law and any mandatory University requirements.

13. Your rights

Subject to applicable law, you may request access to, rectification of, or erasure of personal data you have provided; restriction of or objection to certain processing; and, where GDPR / UK GDPR applies, data portability for data you provided by automated means. You may also lodge a complaint with a supervisory authority (for example, a data-protection authority in your EEA Member State or the UK ICO, or Roskomnadzor in the Russian Federation). To exercise rights relating to this Website, email legal@ftlab.space (English site) or behecon.spbu@spbu.ru (Russian site). We may need to verify your identity before acting. Rights are not absolute; exemptions under applicable law may apply.

14. Security

Contact submissions are accepted only over HTTPS to /api/contact. Reasonable technical and organisational measures appropriate to a public research website are applied. No transmission or storage method is completely secure. Do not send passwords, one-time codes, PINs, or banking secrets through the form or by email.

15. Children

The Website is intended for a research and professional audience. It is not directed at children, and we do not knowingly collect personal data from children through the Website.

16. Changes

We may update this Policy when the Website’s processing changes. The effective date above is revised when updates take effect. Material changes will be reflected on this page before new non-essential processing begins.

17. Contact for privacy questions

Privacy and personal-data requests for the Website: legal@ftlab.space. For the Russian-language site and SPbU-related correspondence: behecon.spbu@spbu.ru.