Consent to the Processing of Personal Data

The separate consent you give when you register with Lorra: who processes your personal data, why, what data, and how to withdraw the consent.

Version 2026-09-25 · Effective September 25, 2026

By registering with Lorra and ticking the separate box giving consent to the processing of personal data, I — the user who provided a login and an email address at registration — freely, of my own will and in my own interest give the operator named in section 1 my consent to the processing of my personal data on the terms below. This consent is given under Article 9 of Russian Federal Law No. 152-FZ of 27 July 2006 "On Personal Data" and is set out separately from the Terms of Use and any other document.

1. Operator

• Name: LIMITED LIABILITY COMPANY “DERALIGN” (ООО «ДЕРАЛАЙН»), Russian TIN 5904419034
• Address: Russia, Perm Krai, Perm, 80 Pushkina Street
• Contact for requests: info@deralign.com

2. Purposes of processing

• creating my account, signing in to the Service (the Lorra browser extension and mobile app) and restoring access, including sending a password reset code to my email address;
• keeping my library, watch history, notes, collections and folders and showing them to me on the devices where I am signed in;
• automatic tracking in the browser extension — only if I turn that feature on;
• handling the reviews and collaboration requests I send, and replying to them;
• keeping the Service secure, preventing abuse and fixing faults;
• recording that and when the Terms of Use were accepted and this consent was given.

3. Personal data covered

• login, email address, password hash (the password itself is not stored), and an avatar — an image or a link, if I add one;
• the date and time I accepted the Terms of Use and gave this consent, and the versions of those documents;
• library entries: title, media type, status, poster link, season and episode, playback position and duration, rating, notes, collections and folders, and the page address (URL) and domain;
• watch history: start and end position, time actually watched, season and episode, page address, rating, date and time;
• with automatic tracking on — what the extension reports about the video being played: page address and domain, title, poster link, site name, season and episode, position, length, seconds watched and a random identifier of the viewing (details in section 4 of the Privacy Policy);
• reviews and collaboration requests: the message, and the contact details and rating if I give them;
• the password reset code (stored as a hash) and the email address it was sent to;
• the IP address of my device and details of requests to the API recorded in the server's technical logs.

4. Actions and methods of processing

I consent to the following actions: collection, recording, systematisation, accumulation, storage, clarification (updating, changing), retrieval, use, transfer (provision, access) to the parties listed in section 5, blocking, deletion and destruction. Processing is automated and involves transmitting data over the internet. Personal data is not disseminated — that is, not disclosed to an indefinite number of people.

5. Parties processing data on the operator's behalf

• The hosting provider whose servers host the Service and its database: name — LIMITED LIABILITY COMPANY “TIMEWEB.CLOUD” (ООО «ТАЙМВЭБ.КЛАУД»), Russian TIN 7810945525, address — Russia, 420500, Republic of Tatarstan, Verkhneuslonsky District, Innopolis, 7 Universitetskaya Street, office 605. Stores all the data listed in section 3.
• Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA — delivers password reset emails through Gmail. It receives the email address, login and code at the moment the email is sent; this is a cross-border transfer of data to the USA.

6. How long the consent is valid

The consent is valid from registration until I withdraw it or delete my account. How long each kind of data is kept is set out in section 10 of the Privacy Policy.

7. How to withdraw the consent

I can withdraw the consent at any time, in either of these ways:

• send the operator a withdrawal request at info@deralign.com from the email address of my account, or stating my account login;
• delete my account in the extension or the app: Profile → Delete account. Deleting the account also withdraws the consent.

The Service cannot work with an account without processing this data, so withdrawing the consent means the account is deleted. If I delete the account myself, the deletion happens at once and cannot be undone: the account, library, folders, collections, history and notes are removed from the database immediately. If I withdraw the consent by writing to the operator, the operator stops the processing and destroys the personal data within 30 days at the latest, unless federal law provides otherwise. Withdrawal does not affect the lawfulness of processing carried out before it.

Two things outlive the account, and I am told so plainly. A review or collaboration request I sent stays, without the link to my account, together with any contact details I typed into the message myself. And a backup made before the deletion may still contain my data until it is rotated out, which takes up to 30 days. Both are described in section 10 of the Privacy Policy.

Automatic tracking can be switched off separately, without withdrawing the consent: Profile → Automatic tracking.

8. Other terms

How the data is processed, how long it is kept and my rights are described in detail in the Privacy Policy. This consent is a separate document and is not part of the Terms of Use. The version of this consent and the date and time it was given are stored with my account.