# Legal Documents — Lawyer Review Checklist

_Status: DRAFT scaffolds in `public/legal/*.md`. None are reviewed by a Russian
privacy lawyer yet. Do NOT publish marketing copy claiming "compliant with
152-ФЗ" until this checklist is fully ticked._

Owner: ____________ Target lawyer review date: ____________

---

## 1. Documents required

| Document | Files | Status | Notes |
|---|---|---|---|
| Terms of Service / Условия использования | `terms-en.md`, `terms-ru.md` | 🔲 draft scaffold | Defines service, user obligations, IP, liability cap, termination, governing law |
| Privacy Policy / Политика конфиденциальности | `privacy-en.md`, `privacy-ru.md` | 🔲 draft scaffold | 152-ФЗ Art. 14 requires it in RU; GDPR Art. 13 in EN |
| Cookie Policy / Политика cookies | `cookies-en.md`, `cookies-ru.md` | 🔲 draft scaffold | Required if any non-essential cookies; we have session + CSRF only (essential), so this can be brief |
| Data Processing Addendum / DPA | `dpa-en.md`, `dpa-ru.md` | 🔲 draft scaffold | Signed when seller integrates buyer-PII workflows; required by some EU customers |
| Public offer / Публичная оферта | `offer-ru.md` | 🔲 not started | RU-specific; combines ToS + price terms when subscription billing launches (P1) |

## 2. Roskomnadzor filing

- [ ] **Уведомление об обработке персональных данных** filed at <https://pd.rkn.gov.ru/>
- [ ] Operator name registered: ___________
- [ ] OGRN/INN entered: ___________
- [ ] Categories of data subjects declared (sellers, employees, future: buyers — but buyers fall under SNOW3 marketplace's separate filing)
- [ ] Categories of PII declared (email, name, password hash, IP for security logs, audit log entries)
- [ ] Purposes declared (account management, audit, support, billing, security)
- [ ] Cross-border transfers declared if any (e.g. SMTP relay outside RF)
- [ ] Filed within 30 days of starting PII processing (if not, note backdating risk to lawyer)

## 3. ToS — must cover

- [ ] Definition of "service", "seller", "snow3seller", "SNOW3 marketplace"
- [ ] Eligibility — who can sign up (legal age, jurisdictional restrictions)
- [ ] Account responsibilities — credentials confidentiality, prohibited use, automated abuse
- [ ] Acceptable use policy — no spam, no illegal goods, no PII not their own
- [ ] **Disclosure that orders are mock-only until SNOW3 marketplace launch** (see PLAN-P0.md E1)
- [ ] Service availability disclaimer — beta status, no SLA in P0
- [ ] Pricing — free-tier-only in P0, billing terms incorporated by reference in P1
- [ ] IP — seller's product data ownership, license to snow3seller for service operation
- [ ] Confidentiality — both directions
- [ ] Limitation of liability — cap at 0₽ during free tier, transitioning to subscription fees in P1
- [ ] Termination — by seller, by snow3seller (with cause + without cause)
- [ ] Governing law — Russian Federation
- [ ] Dispute resolution — arbitration clause (Moscow Arbitration Court? AAA?)
- [ ] Modification clause — how/when ToS can change, notice period (≥30 days for material changes)
- [ ] Effective date and last-updated date

## 4. Privacy Policy — must cover (152-ФЗ Art. 14 + GDPR Art. 13)

- [ ] Operator identity (legal entity name, INN/OGRN, registered address, contact email)
- [ ] DPO contact (Data Protection Officer / уполномоченное лицо)
- [ ] Categories of PII collected:
  - [ ] Account: email, name, password hash, external_ref
  - [ ] Authentication: bcrypt hash, session ID, CSRF token
  - [ ] Security: audit log (IP, UA, action, timestamp)
  - [ ] Communications: support tickets (when ticketing exists, P1)
- [ ] Purposes — match Roskomnadzor filing
- [ ] Legal basis (152-ФЗ: consent + contract; GDPR: consent + legitimate interest)
- [ ] Third-party processors named:
  - [ ] SMTP relay (when configured) — Mailgun / Yandex / etc., country
  - [ ] Hosting — Timeweb / Yandex Cloud / Selectel, RF
  - [ ] Payment processor (P1) — YooKassa
- [ ] Cross-border transfers — only if SMTP/CDN goes outside RF
- [ ] Retention periods — audit log 1 year, account data 7 years post-deletion (RU tax retention), backups 30 days off-site
- [ ] User rights:
  - [ ] Access (data export — implemented at `/portal/account/export`)
  - [ ] Rectification (account form)
  - [ ] Deletion (`/portal/account/delete`, 30-day soft window then anonymisation)
  - [ ] Objection / withdraw consent
  - [ ] Lodge a complaint with Roskomnadzor (152-ФЗ) or local DPA (GDPR)
- [ ] Cookies — link to Cookie Policy
- [ ] Children — service not intended for under-18 users
- [ ] Updates — notice mechanism

## 5. Cookie Policy — must cover

snow3seller's portal currently sets only ESSENTIAL cookies:

- [ ] `ss` — session id (HttpOnly, Secure, SameSite=Lax, 7-day TTL)

That's the entire surface. The cookie policy can be 200 words. Cover:

- [ ] What cookies we set (just `ss`)
- [ ] Purpose (authentication only — not analytics, not advertising)
- [ ] Why no consent banner (essential cookies don't require it under
      152-ФЗ Art. 9 nor GDPR Recital 30 / ePrivacy Art. 5(3))
- [ ] How to clear them (browser settings)
- [ ] Note: when analytics arrives in P1 (Yandex.Metrika / PostHog), update
      this doc and add a consent banner

## 6. DPA — must cover (when buyer-PII flows from SNOW3 marketplace arrive in P1)

For now: stub doc + note that DPA is signed as Schedule X to ToS when a seller
opts into buyer-data-handling features (none exist yet). Re-engage lawyer
when SNOW3 marketplace integration ships.

- [ ] Stub: "DPA available on request — contact legal@isnow3.com"
- [ ] Real version (P1): standard EU SCC + RF cross-border addendum

## 7. Publication

- [ ] Files served at `https://isnow3.com/legal/{terms,privacy,cookies,dpa}-{en,ru}` (HTML rendered from MD)
- [ ] Footer links from portal (login, register, dashboard) to `/legal/`
- [ ] Footer links from `/docs/` pages
- [ ] Sitemap entry
- [ ] "Effective date: ____________" stamp on each document

## 8. Operations

- [ ] Each version archived with date when superseded
- [ ] Changelog kept in `public/legal/CHANGELOG.md`
- [ ] Material changes notified to all sellers ≥30 days in advance (mass email)
- [ ] Annual review reminder in calendar