Privacy policy
Version 2026-09-29
This Policy describes how personal data of SmileFuture widget users (the “Widget”) is processed and how it is protected. It is published under Article 18.1 of Russian Federal Law No. 152-FZ “On Personal Data”.
1. Personal data operator
Personal data is processed by OOO “BAUART IT SOLUTIONS” (ООО «БАУАРТ АЙТИ РЕШЕНИЯ»), OGRN 1252400004691, INN 2466302057, registered address: 20K 2nd Bryanskaya Street, Krasnoyarsk, Russia (the “Operator”).
2. Data we process
2.1. When you use the Widget, the Operator processes the following categories of personal data:
- a photograph of your face, uploaded voluntarily to generate a visualization;
- a phone number and/or email address, if you choose to provide them in order to receive the result without a watermark and to be contacted by the clinic;
- IP address and technical data (user agent, timestamp), for security and to record that consent was given.
2.2. EXIF metadata and other technical information are removed from the photograph before it is sent to a third-party image-generation service.
3. Purposes
- generating a visualization of a possible orthodontic or dental treatment result from the uploaded photograph;
- passing your contact details to the dental clinic on whose website the Widget is installed, so the clinic can contact you about a consultation;
- keeping the Widget secure and preventing misuse.
4. Legal basis
Processing is based on the data subject’s consent, collected before the Widget is used (Article 6 of Federal Law No. 152-FZ).
5. Where personal data is stored
5.1. Users’ personal data (contact details, IP address, and uploaded photographs) is stored on a server located in the Russian Federation, as required by Article 18(5) of Federal Law No. 152-FZ.
5.2. Only a de-identified photograph — without metadata and without accompanying personal data — is transferred outside the Russian Federation, and only to generate the visualization. See section 6.
6. Cross-border transfer
6.1. To generate the visualization, the de-identified photograph is sent through a relay server in a jurisdiction with access to the Google Gemini API (United States) to Google LLC (United States).
6.2. The cross-border transfer is made under Roskomnadzor permit No. 100427489 dated 18 September 2026, obtained by the Operator under Article 12 of Federal Law No. 152-FZ.
6.3. Google LLC processes the transferred data under the paid Gemini API terms, which state that submitted data is not used to train artificial-intelligence models.
7. Sharing data with the clinic
Your contact details (phone and/or email) are passed to the dental clinic on whose website the Widget is installed only after you expressly agree, and only so the clinic can contact you about a consultation.
8. Retention
- the uploaded photograph and the generated result are deleted automatically no later than 24 hours after upload;
- contact details (the lead) are kept until the purpose of processing is achieved (in particular, until the clinic finishes contacting the prospective patient) or until you withdraw consent, whichever comes first.
9. Your rights
You may request information about how your personal data is processed, ask for it to be corrected, blocked, or deleted, and withdraw consent by writing to smilefuture@bauartit.ru.
10. Safeguards
The Operator uses organizational and technical safeguards, including access limits, encryption in transit, and automatic deletion when the retention period ends.
11. Changes to this policy
The Operator may update this Policy. The current version is always available at smilefuture.bauartit.ru/en/privacy.