Athar app consent to personal-data processing

CONSENT to the processing of personal data by users of the "Athar" mobile app

Version of 9 November 2026. In force from its publication on athar.ac.

Translation. The legally binding original is the Russian text. If there is a discrepancy, the Russian text prevails.

I, a user of the "Athar" mobile app (the "App"), identified by the e-mail address given when registering the account, acting freely, of my own will and in my own interest, give specific, substantive, informed, conscious and unambiguous consent to the processing of my personal data on the terms set out below.

---

Part A. Main consent (required to create an account)

A.1. Operator. Abdelrahman Yahya, an individual; e-mail: [email protected].

A.2. Purposes: 1. registering and maintaining my account and signing me in to the App; 2. keeping the opportunities I save and personalising the opportunity catalogue and App notifications; 3. keeping my "My journey" plan, tracked opportunities and checklists (where available); 4. delivering notifications in the App; 5. keeping accounts secure and the rules respected (including account restrictions); 6. handling my enquiries and feedback about the App, and my requests as a data subject; 7. keeping the App working and fixing errors (technical error reports); 8. taking part in the community, if I join it: my public profile, posts, comments and replies with their photos, "helpful" marks, saved and followed posts and follows; blocking accounts and reporting content and accounts; 9. delivering push notifications to my device, if I turn them on; 10. answering my questions in Athar AI (Beta) through the operator's server and Cloudflare Workers AI, and applying the daily limit on AI answers; 11. registering me for live sessions and sending me notices about my registration (by e-mail and, if I link it, through the Athar Telegram bot); 12. linking my Telegram account to my account, if I start the link myself, and sending me notifications through the Athar Telegram bot.

A.3. Personal data: - e-mail address, display name, interface language, registration date, authentication data (password hash or Google sign-in identifier); - saved opportunities; general location ("in Russia" or "outside Russia"); interests; notification settings (including quiet hours for push notifications: start, end and the device's time zone); an avatar chosen from a ready-made set; reactions to quick opportunities; sign-ups for launch notices; - study stage, target level, fields, tracked opportunities with my notes, checklist marks (where available); - inbox notifications and read marks; device data (platform, App version, language; the push token only after push notifications are turned on); - information about restrictions on my account; - early-access request: status and dates of submission and review; - the text of feedback about the App that I send myself, its type and the App version; - technical error reports: error type, the error text after personal data is automatically removed from it, screen name, App version and platform (e-mail addresses, links and long numbers are removed automatically). - if I join the community: the data described in sections 3.7–3.8 of the Policy — my public profile and its fields, the profile and post photos I upload, posts, comments and replies, marks, saved and followed posts, follows, blocks, reports and moderation decisions about my account or content; - my Athar AI questions, with the interface language, random request and conversation identifiers and an encrypted context of the previous question (before a question is sent to Cloudflare, e-mail addresses, phone numbers, messenger and social-network links and identifiers starting with @ are removed from it automatically); the daily number of AI answers for my account; and the ratings and answer reports I send myself (questions and answers are not stored, except what I send in a report); - if I register for a live session: the session, my answers to its registration questions, the status of my registration, the reason for a review decision and the team's notes, the time I opened the join link, and attendance if recorded; - if I link Telegram: my Telegram account identifier and the bot's record (first name, language and what I tell the bot, such as study level, field, study language, funding need and alert settings), the time of linking, one-time link records (stored as a hash) and notification delivery records;

Data of features that are turned off in the current App version (mentoring and private messages, group communities, and the Smart Assistant with the User's own Google Gemini key) is not part of Part A — see Part C.

A.4. Operations: collection, recording, systematisation, accumulation, storage, clarification (updating, changing), retrieval, use, transfer (provision, access) to the parties listed in A.5, blocking, deletion, destruction. Method: automated processing.

A.5. Processors acting for the operator, and storage location: - the hosting provider (database, authentication, file storage): the provider's name and the country where its servers are located are stated in the Personal Data Processing Policy (sections 6 and 7), the current version of which is published at https://athar.ac/en/app/privacy/; - Cloudflare, Inc. (USA): website hosting and the api.athar.ac network gateway through which the App reaches the server; and processing Athar AI questions through Workers AI to compose the answer (the question with contact details removed and excerpts from Athar's public sources, without my account data); - Brevo (Sendinblue SAS, France): service e-mails; - Google LLC: Google sign-in, if I choose it; - Google LLC (Firebase Cloud Messaging): delivering push notifications (the device token, a short generic title and an in-app link), only after I turn them on; - Telegram: delivering the bot's messages to my Telegram account, only if I link it (under Telegram's own terms); - Railway Corp. (USA): hosting the Athar Telegram bot and the service that sends e-mail and Telegram notifications;

I have been informed that the storage location of my personal data and its cross-border transfer (if any) are described in section 7 of the Policy and, if they change, are updated in its current version on the website.

A.6. Term: until my account is deleted or I withdraw consent. After that, data is deleted within the periods in the Personal Data Processing Policy, and no later than 30 days (Law, art. 21 part 5), except where processing is allowed without consent. Backups are kept within a target period of 30 days.

A.7. How to withdraw: in the App, "Your data & privacy → Request account deletion"; or by e-mail to [email protected] from the account's e-mail address. Consequences of withdrawal: the account stops working and its data is deleted. Without an account the App is not used (the public opportunities catalogue is available on the athar.ac website).

A.8. I have read the Personal Data Processing Policy (the version in force on the date of consent), including the retention periods and my rights as a data subject.

☐ I consent to the processing of my personal data on the terms of Part A

---

Part B. Additional consents (asked separately before using the related feature)

Each Part B consent has its own checkbox and can be withdrawn on its own, without deleting the account. Declining a Part B consent does not limit the App's other features.

Consents B.1 and B.3 are requested in the App separately, each with its own checkbox, before the related data is processed or shown: B.1 before an acceptance letter is uploaded, and B.3 before I first post or comment in the community. Until I give B.3, other users do not see my community profile or contributions; until I give B.1, the "verified" badge and my university are not shown to anyone else. Neither consent is assumed from earlier use of the App; for profiles and badges that existed before this version, this applies once the updated App is available to all users and older versions are required to update. Consent B.2 is not requested in the App, because new translation orders cannot be placed in it. No Part B consent is a condition for using the App.

B.1. Proof of admission (where available)

Purpose: checking that I am admitted to a university and showing the "verified" badge (which also qualifies me as a mentor and to post a "student experience").

Data: university, city, study level and field, academic year; the acceptance-letter file (PDF or image) and any information about me it contains.

Access: only me and an operator reviewer using two-factor authentication. Every opening of the file is logged.

Term: the file is deleted no later than 30 days after the decision (earlier if I withdraw the request). The verification details are kept until the account is deleted or this consent is withdrawn.

Operations and method: as in A.4.

Withdrawal: withdraw the consent in "Consents & blocked users → Withdraw", withdraw the request while it is pending, or write to the operator. Withdrawing consent removes the "verified" badge.

☐ I consent to the processing of data for proof of admission (B.1)

B.2. Documents for the translation service (where available)

Purpose: carrying out my document translation order; receiving and checking payment; delivering and correcting the translation.

Data:

the documents I upload and the information in them (including a passport with a photo, education documents, medical documents);

my name in Russian; notes; order correspondence;

proof of payment, amount, currency, payment method.

Access:

the assigned translator sees the documents, the name in Russian, notes and the deadline, as well as the order correspondence after payment is confirmed, but not my e-mail, the prices or the proof of payment;

the operator and the staff who check payments.

Term: files (except proofs of payment) are kept until the order is completed and are deleted manually at the weekly review after the order is closed (if there is no dispute or open correction), earlier at the User's request, and also when the account is deleted.

Operations and method: as in A.4.

Withdrawal: write to the operator. Withdrawing before the order is complete means it cannot be carried out; refunds follow the Terms of Use.

☐ I consent to the processing of documents and data for a translation order (B.2)

B.3. Consent to processing personal data the subject allows to be disseminated (Law, art. 10.1), for communication features (where available)

Purpose: showing my data to other users in mentoring, communities and posts.

Data other users will see:

display name, username if I choose one, profile photo if I upload one (or the chosen avatar), and the "verified", "approved" and "moderator" badges;

always in my community profile: bio, languages, interests, joining month, counts of my posts, replies, "helpful" marks and best answers, and whom I follow and who follows me;

links in my profile, once my first contribution has been approved;

only if I choose to show them (hidden by default): country, studies (university, field, stage, year), "My study journey", and admissions I added;

university (if verified); for mentors, also city, level, field, profile headline and bio, languages and topics;

the text and photos of my posts and comments, and my community messages.

Who sees it: only users signed in to the App, inside the App (community messages: that community's members); none of it is published on a public website. Private messages are not disseminated.

Conditions and prohibitions (art. 10.1 part 9): my e-mail address is never disseminated; I can hide the optional fields and change or remove my name and photo at any time.

Term: until I withdraw consent or delete the account.

Withdrawal: "Consents & blocked users → Withdraw", writing to the operator, or deleting the account. Withdrawal immediately hides my public profile, posts and comments from other users (I still see them; Policy, 13.2).

☐ I consent to the dissemination of the data listed above among App users (B.3)

---

Part C. Features that are currently turned off

In the current App version the following are turned off: mentoring and private messages, group communities, and the Smart Assistant with the User's own Google Gemini key. Their data is not processed. If a feature is turned on, the operator will announce it in advance and, where needed, ask for a separate consent (naming the providers). That consent will not be a condition for using the App's other features.

---

Separate from this consent

The "I am 18 or older" age confirmation and acceptance of the Community Rules / Mentor Rules are separate declarations. They are not part of the consent to personal-data processing. Age 18+ is confirmed by accepting the Terms of Use (clause 3.3); a separate age confirmation is requested only before communication features. Acceptance of the Community Rules / Mentor Rules is recorded separately.

Consent to data processing