monkeymachine™ — THIRD-PARTY SERVICES AND INTEGRATIONS POLICY

rules for connecting external services, exchanging data,
integration security and cross-border data flows

Platform operator

Individual entrepreneur Rabadan Ibragimovich Izabakarov

TIN 051127783109 · OGRNIP 316057100052211

monkeymachine.ru · monkeymachine.ai

1.1. This Policy sets out the rules for connecting and using third-party services, information systems, APIs, SDKs, communication channels and other integrations in monkeymachine.

1.2. The Policy applies to monkeymachine's own integrations, to integrations that a Client connects to its project, and to external services used in websites and applications built with the platform.

1.3. The Policy supplements the Terms of Use, the Public Offer, the Privacy and Personal Data Processing Policy, the Cookie Policy and the Policy on the Use of Artificial Intelligence Technologies.

1.4. The terms of a particular external service apply alongside this Policy. monkeymachine does not alter the rules, prices, restrictions or technical requirements of a third-party provider.

1.5. The mere technical possibility of connecting a service does not mean that the integration is suitable for every category of data or for every purpose of the Client.

2.1. The list of available integrations may change as the platform develops. The actual set of external services in a given project is determined by the modules and settings the Client has connected.

2.2. A new integration does not gain access to the data of other modules merely because it has been connected. Access is determined by the purpose of the integration, the project settings and the permissions granted.

2.3. Where Meta services are used*, their legal status in the Russian Federation is taken into account. The Ministry of Justice of Russia states that Meta Platforms Inc. is included in the list of organisations recognised as extremist in respect of its activity in distributing the Facebook and Instagram products; the court decisions banning that activity do not extend to the WhatsApp messenger, as it has no functions for the public dissemination of information.

3.1. For the purposes of personal data legislation, what matters is not the name of the technology — "API", "SDK", "integration" or "webhook" — but what information the external participant actually receives. Article 3 of Federal Law No. 152-FZ treats disclosure, access and transfer of data as processing of personal data.

3.2. Where only technical information is passed to an external service and it does not make it possible to identify a natural person directly or indirectly, that exchange may fall outside the regime governing transfers of personal data.

3.3. Where a request or event also carries contact details, an IP address, identifiers, the content of correspondence, images, audio, information about an order, a candidate, an employee or other data that makes a person identifiable, the flow concerned is treated as processing of personal data.

3.4. The assessment covers the entire actual flow, including metadata, technical logs, diagnostic messages and telemetry, and not only the main body of the API request.

4.1. Where the processing of personal data is entrusted to another party, part 3 of article 6 of Federal Law No. 152-FZ applies: the instruction must specify the list of data, the operations, the purposes, confidentiality, localisation and security requirements, confirmation of the measures taken and the procedure for notifying incidents.

4.2. The same party may hold different roles in different processes. The role is determined separately for each specific purpose of processing.

5.1. A Client may connect its own accounts, communication channels, CRM systems, accounting systems, stores, external services, API keys and other supported integrations to its project.

5.2. By connecting its own external service, the Client confirms that it is entitled to use the account concerned and to pass data to that service to the extent required by the chosen function.

5.3. The Client determines the settings of its own external service where those settings are outside monkeymachine's control, including user rights, retention periods, advertising or analytics functions and other parameters of the external system.

5.4. monkeymachine is not responsible for the Client's own actions inside a third-party service, for changes to that service's terms, for the blocking of an account or for the discontinuation of support by the external provider, except where the breach arose directly on the monkeymachine side.

5.5. Where a Client connects a service that creates a new flow of personal data or a cross-border transfer, the lawfulness of that flow must be established before it is used in the configuration concerned.

6.1. monkeymachine may bring messages from connected communication channels together in a single project interface and store the information the Client needs in order to work with enquiries, orders and customer history.

6.2. An external communication channel may process user information independently under its own rules. Passing a message between such a channel and monkeymachine does not make monkeymachine the owner of the messenger, e-mail or telephony service concerned.

6.3. The scope of synchronisation depends on the capabilities of the particular channel: it may include text, a contact, a user identifier, attachments, images, voice messages, delivery status and other technically necessary information.

6.4. Service notifications and advertising messages are governed separately. The rules for advertising and informational mailings are set out in the separate monkeymachine Informational and Advertising Mailings Policy.

7.1. Integration with CRM, 1C and other accounting systems may provide for two-way synchronisation of records, orders, product catalogues, organisations, statuses and other data provided for by the project configuration.

7.2. The access of the integration user must be limited to the minimum necessary rights. Where the external system allows a separate account to be created or the set of accessible objects to be restricted, that mode should be used.

7.3. VPNs, dedicated IP addresses, API tokens and other means of access may be used for secure connections. Publishing connection secrets, tokens and keys in the public domain is not permitted.

7.4. Synchronisation must not automatically include fields and databases that are not required for the process chosen.

8.1. monkeymachine may provide the technical connection to external payment services and the exchange of commands, identifiers and payment statuses.

8.2. The mere fact of integration with a payment gateway does not make monkeymachine a money transfer operator, a payment agent or any other regulated participant in a payment system. That role is determined by the actual settlement scheme and by the contracts between the participants.

8.3. The configuration of each project must establish: the recipient of the funds, the payment provider used, the refund procedure, the issuing of the cash receipt and the set of data each participant receives.

8.4. Full bank card details must not be stored in monkeymachine without an objective need and a specifically designed secure process. Where technically possible, the infrastructure of a specialised payment provider and tokenised identifiers are used.

8.5. The rules on prices, charges and refunds for the platform's own services are set out in the Public Offer and in the separate Rules on Payment, Pricing, Charging and Refunds.

9.1. Connecting an AI provider, a speech recognition technology or another intelligent function is governed by the monkeymachine Policy on the Use of Artificial Intelligence Technologies.

9.2. An external AI service is not automatically given the entire body of project data. The set of data is determined by the particular function and, where personal data is involved, the requirements of this Policy apply in addition.

9.3. The use of web analytics, cookies, SDKs and similar identifiers is also governed by the Cookie Policy and Similar Technologies. Optional analytics and marketing technologies are enabled in accordance with the legal ground established for them and with the settings.

9.4. Replacing an AI model, an analytics service, an SDK or a recognition technology is treated as a change of integration where the recipient, the country, the set of data transferred or the storage conditions change.

10.1. A Client may build websites and applications with monkeymachine and connect external channels, SDKs, analytics, payments, push services and other integrations to them.

10.2. For a Client's website or application, the legal configuration is determined by the project itself: who owns the resource and is the operator for the purpose concerned, which modules are active, which external services are connected and what data is passed to them.

10.3. Where a Client adds an external script, SDK, pixel or other component outside the standard monkeymachine configuration, the Client is responsible for correctly declaring its purpose and for having a legal ground for the data flow concerned.

10.4. Where a mobile application is published through a monkeymachine account or through the Client's own account, the application publisher, external SDKs, system permissions, push services, analytics and the app store rules are each taken into account separately.

11.1. APIs and webhooks make it possible to transfer data and events automatically between monkeymachine and external systems. Their use does not remove the requirements as to legal ground, data minimisation and access security.

11.2. A Client must not transfer more data through an API than the declared function requires, and must restrict the rights of integration accounts.

11.3. API keys and tokens are means of access and must be kept confidential. They are not placed in public code, user-facing text, AI prompts or ordinary technical logs.

11.4. When an integration ceases to be used, its token, key or other means of access must be revoked or deactivated where it is no longer required.

11.5. Additional rules for users granted programmatic access to the monkeymachine API are set out in the separate API Terms of Use.

12.1. Where personal data of citizens of the Russian Federation is collected, including via the Internet, the requirements of part 5 of article 18 of Federal Law No. 152-FZ apply to recording, systematisation, accumulation, storage, updating and retrieval of data using databases located in the territory of the Russian Federation, unless the law provides for an exception.

12.2. Having a Russian database and making a subsequent cross-border transfer are two different legal questions. Complying with the localisation requirement does not in itself replace the cross-border transfer procedure.

12.3. An external integration must not create a hidden primary collection of personal data directly into a foreign database merely because a third-party SDK, analytics tool or API loads automatically together with the resource.

13.1. Before beginning cross-border transfer activity, the operator responsible for the purpose concerned complies with article 12 of Federal Law No. 152-FZ, including a separate notification to Roskomnadzor of the intention to carry out a cross-border transfer. That notification is submitted separately from the notification of personal data processing under article 22.

13.2. Before submitting the notification, the operator obtains the information required by law about the foreign recipient, the protective measures it applies, the conditions for terminating processing and, where required, the applicable foreign regulation.

13.3. The procedure for starting a transfer depends, in particular, on whether the recipient's state is included in the current list of states providing adequate protection of the rights of personal data subjects. The status of the country is checked as at the date the route concerned actually goes live.

13.4. The current procedure and the notification service are available on the Roskomnadzor cross-border transfer portal.

13.5. The consent of the data subject is not a universal or sole ground for every cross-border transfer. The legal ground for processing is determined by the specific purpose, and the requirements of article 12 apply in addition wherever a cross-border transfer takes place.

13.6. Where monkeymachine acts under the instruction of a Client, the operator's obligations in respect of a cross-border process are allocated according to the actual role, the contract and the party that determines the purpose and initiates the transfer concerned.

14.1. monkeymachine applies protective measures having regard to article 19 of Federal Law No. 152-FZ and article 16 of Federal Law No. 149-FZ, to the extent that those provisions apply to the process concerned.

• integrations are granted the minimum necessary access rights;
• separate keys, tokens and accounts are used for different clients and services wherever possible;
• access secrets are not exposed in user interfaces or technical logs beyond what is necessary;
• inbound and outbound data is validated having regard to the purpose of the integration and to the risk of erroneous transfer;
• access is terminated when an integration is disconnected or when a user's authority ends;
• changes to critical settings and administrative access are logged to the extent necessary.

14.2. The Client must keep its own accounts and external service keys secure and must promptly revoke access from persons who have lost their authority.

15.1. Disconnecting an integration stops any new data exchange once the operation has been completed technically, unless something further is required in order to complete a process that has already begun.

15.2. Data previously received and lawfully stored in monkeymachine is not deleted automatically merely because an external channel has been disconnected. Its further storage is determined by the purpose concerned, the retention period and the contractual terms.

15.3. Data remaining with the external provider is deleted or retained under that provider's terms and contractual model. Where an external service acts under instruction, the procedure for terminating processing and for deletion must be provided for in the corresponding terms.

15.4. When an integration ends, unused keys, tokens, webhook secrets and other means of access must be revoked.

16.1. Before a new external integration is connected, the purpose of the service and the minimum necessary volume of data are established.

16.2. For an integration that receives personal data, at least the following are taken into account: the recipient, its role, the set of data transferred, the purpose, the country, the storage conditions, sub-processors, security, localisation, cross-border aspects and the termination of processing.

16.3. A reassessment is carried out where the recipient legal entity, the country of processing, the AI model, the SDK, the set of fields transferred, the purposes of data use or other material parameters change.

16.4. A new technical version of an API does not in itself require a change to the public Policy where the legally significant parameters of the processing remain the same.

17.1. monkeymachine maintains an up-to-date record of the external services and integrations involved in processing data of the platform and of projects.

17.2. For each material external service the following are recorded: purpose, recipient, category of data transferred, contractual role, country of processing where a foreign element exists, retention periods and the conditions for terminating processing.

17.3. Public documents may describe external services by category where the particular provider depends on the project configuration or may be chosen by the Client. That does not relieve either monkeymachine or the Client of the need to know the actual recipient of a given flow.

17.4. Where a change to an external service affects users' rights, the purposes of processing, a cross-border route or other material conditions, the relevant information and related documents are updated before the new configuration is applied.

• connect only those external services and accounts that the Client is entitled to use;
• not expand the volume of data transferred beyond what is necessary;
• ensure a lawful ground for processing the data of its own customers, employees, candidates and other data subjects;
• not transfer special categories, biometric data, payment secrets or other high-risk data to third-party services without a specifically designed lawful process;
• comply with the external provider's terms and with the legislation applicable to the Client's own activity;
• disconnect unused integrations and revoke granted access rights in good time.

Privacy and Personal Data Processing Policy: https://monkeymachine.ru/en/legal/privacy

Terms of Use: https://monkeymachine.ru/en/legal/terms

Cookie Policy and Similar Technologies: https://monkeymachine.ru/en/legal/cookies

Public Offer: https://monkeymachine.ru/en/legal/implementation-offer

The Policy on the Use of Artificial Intelligence Technologies and the API Terms of Use apply to the corresponding platform functions.

20.1. Federal Law No. 152-FZ of 27 July 2006 "On Personal Data" — in particular articles 3, 5–7, 12, 18, 18.1, 19 and 22, depending on the process concerned.

20.2. Article 6 of Federal Law No. 152-FZ — conditions for processing personal data and requirements for entrusting processing to another party.

20.3. Article 12 of Federal Law No. 152-FZ — requirements for cross-border transfers of personal data, including separate notification of the supervisory authority.

20.4. Article 18 of Federal Law No. 152-FZ — the operator's obligations when collecting personal data, including localisation requirements.

20.5. Article 19 of Federal Law No. 152-FZ and article 16 of Federal Law No. 149-FZ of 27 July 2006 — the applicable requirements for the protection of personal data and information.

20.6. Other requirements of the legislation of the Russian Federation apply depending on the particular function, the category of data, the roles of the participants, the type of external service and the Client's industry.