AI Features Consent and Privacy

Two ExtMoney features send your data to external AI services, so we ask for separate consent before you use them:

• Voice input — your voice recording is sent to a speech recognition service to convert it into a transaction.
• Receipt scanning — a photo of your receipt is sent to an AI service to read it and prepare a transaction draft.

Consent for each feature is separate and voluntary. You can consent to one and opt out of the other.

Where This Is Requested

In the initial setup wizard (onboarding), on the last three steps — after creating an account: voice input, receipt scanning, and AI expense analytics. This is available in both the web and mobile app.

Each step shows the exact consent text (what is sent and where) and a checkbox "I agree…".

Key Principles

• Opt-in by default. The checkbox is unchecked. If you don't select anything and click "Next"/"Done", no consent is recorded — the feature simply remains disabled.
• Optional. These steps don't prevent you from completing the setup: you can go through them without enabling anything. This doesn't affect other aspects of using ExtMoney.
• Voice requires special consent. Voice data may be considered sensitive, so consent for voice input is explicit (a separate, conscious checkbox).
• Text is always in your language and unchanged. The wording is taken from a secure version store and displayed in the interface language. If the text isn't available in your language yet, the feature remains disabled (we do not substitute another language), and you'll be able to enable it when the translation is ready.
• Where data goes and to whom. Processors are named explicitly in the consent text itself, along with the country of processing: in the global version, it's AssemblyAI and Google Cloud (Vertex AI) in the European Union; in the Russian version, it's Yandex (SpeechKit / Vision / Alice AI) and GigaChat within the Russian Federation. The list is received from the server along with the wording, so it always matches where the data is actually going.

What "Agree" and "Disagree" Mean

• Agreed — the feature is available: you can dictate operations by voice / scan receipts. A record of consent (with text version and language) is saved as proof.
• Disagree / Skipped — the feature is disabled. The corresponding button (microphone, receipt scan) will not work until consent is given.

Your Rights

• Revocation at any time. Consent can be revoked; revocation takes effect immediately. The previous consent is not "erased" — a history is maintained (what you authorized and when), as required by law.
• Re-prompt upon changes. If the wording or purpose of data processing changes significantly, we will ask for consent again — the old consent will cease to be valid.
• Consent ≠ notification settings. These are separate: consent for AI features is not related to which notifications you receive.

If You Skipped During Onboarding

You can give (or revoke) consent for voice and receipts at any time.

In the mobile app: Settings → "Privacy and AI". This lists voice input, receipt scanning, and AI analytics — each with a toggle. When enabled, the exact consent wording is displayed (in your language; if the text is not available in this language, the feature will remain disabled); disabling revokes consent. Each item has a link "What is sent and to whom" — this opens the same wording at any time, regardless of whether consent is enabled.

Additionally, if you tap "Voice" or "Receipt" without consent, the app will immediately show the wording — what is sent, to whom, and where it's processed — with "Cancel" and "Agree" buttons. If you agree, you stay on the same screen and the feature activates immediately; you don't need to go to settings. Until you tap "Agree", no recording or image is sent anywhere.

On the web: Settings → "Privacy and AI". The section lists voice input, receipt scanning, and AI analytics — each with a toggle. When enabled, the exact consent wording is shown first (in the interface language; if the text is not available in this language, a notification appears and the feature remains disabled), and consent is recorded only after confirmation. Disabling revokes consent immediately. If the terms change, the item will have a "confirm again" notice. As in the mobile app, tapping voice input or receipt scan without consent brings up a prompt on the AI screen with a button leading to this settings section.

Marketing Messages

Separate from AI features, you can configure consent for marketing messages (product promotional news). This is a per-channel consent: separate for email, push, weekly digest, and messenger — enable only the channels we can use. The messenger depends on the version: Telegram in the international version, MAKS in the Russian version — one version offers exactly one, and never both. Management is in the same place, under Settings → "Privacy and AI", the "Marketing messages" block (on the web). This is not the same as regular notification settings: promotional messages by channel are sent only with enabled consent. You can revoke at any time.

Server-side checks are in place on both clients: a feature cannot be launched without consent, and a promotional message won't be sent via a channel without it.

See also: "Voice Input for Transactions" section above (how to use voice input), docs/consolidated/DEV-ru.md → Consent model (technical description for developers).

Cookie Banner on the Website

When you first visit the public website (landing page), a small window appears at the bottom about cookies with two buttons:

• Accept — you agree to non-essential cookies.
• Reject — you refuse them.

After making a choice, the window closes, and your selection is remembered for a year — the banner won't show up on subsequent visits. The choice is stored in your browser (cookie em_cookie_consent); nothing is sent to the server at the moment of selection.

This is not the same as the AI feature consents above: the cookie banner only concerns technical website cookies. Strictly necessary cookies (those that keep you logged in) always work and are not subject to this choice — rejecting them doesn't disable them, otherwise, the site would be unusable.