Privacy Policy

1. General provisions

This Personal Data Processing Policy has been prepared in accordance with Law of the Republic of Kazakhstan No. 94-V of 21 May 2013 “On Personal Data and Their Protection” (the “Personal Data Law”) and sets out the procedure for processing personal data and the measures taken to ensure the security of personal data by Paloma365 LLP (ТОО «Paloma365») (the “Operator”). Official text of the Law: https://adilet.zan.kz/rus/docs/Z1300000094.

The Operator’s most important goal and condition of its activities is respect for the rights and freedoms of individuals when processing their personal data, including the protection of the right to privacy.

This Policy applies to all information that the Operator may receive about visitors to the website https://paloma365.com, as well as when a user interacts with the forms, requests and other communication channels available on the website.

For users from CIS countries this Policy applies to the extent permitted by applicable law, with the Republic of Kazakhstan being the base (priority) jurisdiction.

2. Principles of personal data processing

Minimisation

The Operator collects only the data necessary for the operation of the website, handling of requests and provision of the Paloma365 service. The Operator does not collect “excess” data unrelated to these purposes.

Purpose limitation

Personal data are processed only for the predetermined and lawful purposes set out in this Policy and are not used for other purposes without a legal basis.

Transparency

The user is informed of the types of data collected, the purposes of processing, the categories of cookies and the available choice (consent/refusal) through the consent banner.

No covert identification

The Operator does not use covert identification methods (fingerprinting), does not embed scripts that run unverified code from third-party sources, and does not sell personal data.

3. Definitions

Personal data

any information relating to an identified or identifiable user of the website https://paloma365.com.

Processing of personal data

any action (operation) or set of actions with personal data, including collection, recording, systematisation, accumulation, storage, clarification, use, transfer (provision of access), depersonalisation, blocking, deletion and destruction.

Automated processing of personal data

processing of personal data by means of computer technology.

Depersonalisation

actions as a result of which it becomes impossible to attribute personal data to a specific user without the use of additional information.

Cross-border transfer

transfer of personal data to the territory of a foreign state, to a foreign individual or legal entity.

4. Rights and obligations of the Operator

• The Operator has the right to process the user’s personal data where there is a legal basis (consent, performance of a contract, requirements of the legislation of the Republic of Kazakhstan, legitimate interest — to the extent permitted).
• The Operator must take legal, organisational and technical measures to protect personal data against unlawful access, alteration, destruction, blocking, copying and other unlawful actions.
• The Operator must provide the user, upon request, with information relating to the processing of personal data, within the requirements of the legislation of the Republic of Kazakhstan.

5. Rights and obligations of users

• The user has the right to receive information about the processing of their personal data and to request clarification, blocking or destruction of personal data in the cases and in the manner provided for by the legislation of the Republic of Kazakhstan.
• The user has the right to withdraw consent to the processing of personal data where the processing is based on consent.
• The user must provide accurate information and report changes to it in a timely manner (where data need to be corrected).

6. What data the Operator may process

Data provided directly by the user: name (if given), email address, phone number (if given), the content of requests/messages, and other data the user voluntarily enters in forms on the website or sends by email.

Technical and depersonalised data: IP address, browser and device information, data on page visits, referral sources and actions on the website; these data may be collected using cookies and web analytics tools.

The Operator does not process special (sensitive) categories of personal data (for example, information about racial/ethnic origin, political views, religious beliefs or intimate life) unless the user provides such information on their own initiative in the text of a request. In that case the Operator treats such information as excessive and not requiring processing for the purposes of the service.

7. Purposes of personal data processing

• Handling requests and applications: clarifying the details of the user’s request, contacting the user, consultations on Paloma365 products and services.
• Provision of services and user support: providing access to the services, support, informing about the status of requests.
• Improving the website and the quality of the service: analysis of depersonalised data on user actions on the website to improve the interface, content quality and stability.
• Informational messages: the Operator may send the user notifications about new features and services if the user has consented or if this is permitted by applicable law. The user may opt out of such messages by writing to info@paloma365.com with the subject “Unsubscribe from notifications”.

8. Legal grounds for personal data processing

• The Personal Data Law of the Republic of Kazakhstan (official source: https://adilet.zan.kz/rus/docs/Z1300000094).
• User consent: the Operator processes personal data when the user fills in and submits forms on the website or sends data by email, thereby consenting to this Policy.
• Performance of a contract: processing of personal data may be necessary to conclude and perform the contract (public offer) for the provision of services/the service.
• Legitimate interest: ensuring the security of the website, preventing abuse, correct operation of the service — to the extent permitted by law and without violating the user’s rights.

9. Cookies, the consent banner and managing settings

The website uses a consent banner (cookie banner) that allows the user to choose categories of cookies: necessary, analytics and advertising.

By default (before the user makes a choice) analytics and advertising cookies are disabled, and analytics and advertising tags work in a mode limited by the consent settings. The mechanism is implemented through Google Consent Mode (official documentation: developers.google.com/tag-platform/security/guides/consent).

After the user clicks “Agree/Confirm” or selects cookie categories, the settings are updated and the corresponding categories of cookies may be activated. If the user clicks “Disagree/Reject”, analytics and advertising cookies remain disabled.

A detailed list of cookies, their purposes, retention periods and links to official sources is given in the Cookie Policy on the Paloma365 website (in Russian).

In addition, the user can manage cookies through the browser settings (deleting, blocking, restricting third parties). In the EU and countries with similar requirements, the ePrivacy standards apply (official text of the directive: eur-lex.europa.eu/eli/dir/2002/58/oj/eng).

Third-party cookies are used only with the User’s consent given through the cookie banner on the website. Data are processed with such cookies in accordance with the applicable legislation of the Republic of Kazakhstan and taking into account generally accepted international data protection standards, including the principles of the General Data Protection Regulation (GDPR) and the ePrivacy Directive. Third-party cookies are governed by the privacy policies of the respective service providers, and the Operator does not control the processing of data by such third parties beyond the purposes set out in this Policy.

10. Third-party services used

• Analytics: Google Analytics (Google’s policy: policies.google.com/privacy) and/or Yandex Metrica.
• Advertising and performance measurement (with the user’s consent): Google Ads, Meta (Facebook), TikTok, LinkedIn — to the extent necessary to measure conversions and the effectiveness of advertising campaigns.
• Embedded content (where present on pages): for example, YouTube videos, which may set functional cookies for correct playback.

11. Storage, transfer and security measures

The Operator ensures the safety of personal data and takes measures that prevent access by unauthorised persons.

The Operator does not transfer personal data to third parties, except: (a) in cases provided for by the legislation of the Republic of Kazakhstan; (b) where the user has given consent; (c) where the transfer is necessary for the operation of the service (for example, to infrastructure providers and, with consent, to analytics/advertising services).

Personal data retention periods are determined by the purposes of processing and legal requirements. Data are kept no longer than necessary to achieve the purposes of processing, unless a different period is established by law or contract.

The user may withdraw consent to the processing of personal data by writing to info@paloma365.com with the subject “Withdrawal of consent to personal data processing”.

12. Cross-border transfer of personal data

Where cross-border transfer of personal data is necessary, the Operator takes measures aimed at ensuring an adequate level of personal data protection in accordance with the legislation of the Republic of Kazakhstan and general international standards.

Cross-border transfer may be carried out where there is a legal basis (consent, performance of a contract, or other grounds provided for by law).

13. AI connectors and the ChatGPT plugin

13.1. What this section covers

This section describes how data is processed when a user connects an AI assistant to their Paloma365 account through the Paloma365 AI connector (the Model Context Protocol, MCP), including the Paloma365 app (plugin) for ChatGPT by OpenAI. Connecting is optional: Paloma365 works without it, and no account data is shared with an AI service until the user connects one.

13.2. Who can connect

Only the account owner (signing in with the account login) or an employee who has been assigned the “Administrator (management mode)” interface in the account can connect an AI assistant. Cash register, workstation and time-clock logins are not accepted. An employee’s eligibility is checked on every request from the assistant: if the employee is dismissed or deleted, loses that interface, or their password is changed, their connection stops working.

13.3. Sign-in and consent

The connection is started in ChatGPT (or another AI assistant), while sign-in and the confirmation of permissions take place on a Paloma365 page in the user’s browser (for the ChatGPT plugin — mcp.paloma365.com). The Paloma365 login and password are entered on that page, are checked by Paloma365 and are not passed to ChatGPT (OpenAI): the AI service receives only access tokens for the account, not the password. The consent screen shows which account and on whose behalf access is requested, and the address the connection will return to.

13.4. Permissions

By default the access is read-only. Additional permissions are enabled by the user with checkboxes, which are unticked by default:

• write — editing and creating items and creating drafts of warehouse documents;
• analytical reports (read-only) — stock balances, cash and bank account balances, sales;
• viewing app settings — appearance, receipt, shift, delivery, region.

An employee’s access is also limited by their rights in the account: for example, cash balances are available to an employee only with the “Cash report” permission.

13.5. What data the plugin can read

• Always (base access): items and item groups, units of measurement; the reference lists needed for documents and settings — warehouses, organizations, suppliers, buyers, price types, cash-flow categories, trade points and workplaces; the account’s documents (warehouse and financial documents — view only) and calculations (recipes).
• With the reports permission: stock balances, balances and turnover of cash desks and bank accounts, sales for a period.
• With the settings permission: a limited set of app settings.

The plugin’s reference lists do not include employees, roles, positions, halls, tables, payment types, cash desks or bank accounts; login and phone-number fields are removed from all plugin responses.

13.6. What the plugin can change — only with confirmation

With the write permission the plugin can: edit an item card (name, price, article code, description); create an item or an item group; create a draft warehouse document — goods receipt, stock entry, write-off, transfer, return from a buyer, return to a supplier, stock count.

Every change takes two steps: first the assistant prepares a preview, which writes nothing; then the change is applied by a separate confirmation step, which the assistant calls after the user has seen the preview and agreed. A preview is valid for about 5 minutes and can be used once; one confirmation changes or creates exactly one record. A draft does not change stock or money — it is conducted by a person in the Paloma365 dashboard.

The plugin cannot: conduct documents; create or change cash, bank or sales documents; create suppliers or calculations; set up the account (trade points, workplaces, employees, logins, passwords, permissions); change settings; delete records.

13.7. Who receives the data

When the assistant uses the connector, Paloma365 sends the result of the request to the AI service connected by the user (for the ChatGPT plugin — OpenAI), so that it can answer the user. The results may contain personal data stored in the account (for example, names of suppliers and buyers) and business data — prices, stock, sales. Paloma365 does not receive the user’s conversation with the assistant — only the requests the assistant sends to the connector (for example, a search phrase or the values of a change).

Data received by the AI service is processed by its provider under the provider’s own terms and privacy policy (for ChatGPT — the OpenAI privacy policy: openai.com/policies/privacy-policy) and may be processed outside the Republic of Kazakhstan (section 12). Paloma365 does not control how the AI service provider processes the data. The decision to connect an AI service and which permissions to grant is made by the user.

13.8. What Paloma365 stores about a connection

• Connection record: the account; who connected (the owner or an employee); the app (the name and return address it registered with); the permissions granted; the dates of creation and last use; the expiry date; whether it has been revoked. When an app registers, the IP address it registered from is also stored.
• Tokens: an access token is valid for about one hour and is renewed with a single-use refresh token; a connection that has not been used for 90 days expires. Apps that do not use refresh tokens receive a token valid for 90 days. Refresh tokens are stored only as a hash.
• Call log (“MCP log”): one entry for each request from the assistant — date and time, account, employee, app, a pseudonymous reference to the connection, operation name, required permission, stage (read, prepare, apply), outcome and a short reason for a refusal, duration, the affected record (type and identifier) and a shortened copy of the request parameters: values longer than 120 characters are cut, the whole copy is limited to 2,000 characters, and fields with passwords, secrets and tokens are masked. The content of responses (the data returned to the assistant) and IP addresses are not recorded in this log.
• Account system log: changes made through the connector, like changes made in the dashboard, are recorded there together with the network address the request came from and the server name.
• Prepared changes (previews) are stored on Paloma365 servers; a preview can be applied only within about 5 minutes.
• Request rate counters — per connection and per account, per minute, without IP addresses; they are deleted after about 10 minutes.
• Failed sign-in attempts on the connection page: the IP address and a hashed identifier of the account or employee (without the login or password), to protect against password guessing; these entries are deleted after about one day.

As with any request to Paloma365 servers, technical data (including IP addresses) may be processed in server logs for security and troubleshooting (section 6).

13.9. Retention

Connection records, the call log and prepared changes are kept no longer than necessary for the operation of the connector, security, review of the changes made and dispute resolution, unless a longer period is required by law or contract (section 11). Account system log entries are kept together with the rest of the account’s data (clause 11.3 of the public offer). After a connection is revoked, its record and the call log remain available to the user in the dashboard.

13.10. User controls

• Choosing permissions when connecting (read-only by default).
• Viewing and revoking connections: Paloma365 dashboard → “Settings” → “AI Connector (MCP)” → “Active tokens”: the “Revoke” button for one connection or “Revoke all”. The account owner sees and can revoke all connections of the account, including those made by employees; an employee sees and revokes their own. Once a connection is revoked, its tokens stop working.
• Viewing what the assistant did: “Settings” → “MCP log”. The owner sees the log of the whole account; an employee sees their own actions.
• Changing an employee’s password or removing the “Administrator (management mode)” interface from them ends their connections.
• Requests to access, correct or destroy data — at info@paloma365.com (sections 5 and 14).

14. Contacts and requests

Operator: Paloma365 LLP (ТОО «Paloma365»), BIN 160940016674, registered address: 62 Muratbayev St., Almaly District, Almaty, 050004, Republic of Kazakhstan; phone: +7 747 391 26 66.

For questions about the processing of personal data the user may contact the Operator by email: info@paloma365.com.

It is recommended that the request include: (a) full name (if any); (b) a contact email; (c) the substance of the request; (d) where necessary, links to website pages or a description of the situation.

15. Final provisions

The Operator may amend this Policy. The current version of the Policy is published on the website and is valid indefinitely until replaced by a new version.

This Policy is the base policy for the Republic of Kazakhstan and applies to users from CIS countries to the extent permitted by applicable law.