Operator: Sole proprietor Koziy Andrey Anatolyevich, INN 472600391500, OGRNIP 325774600178529
Contact for enquiries: support@misteriavale.com (first response within 3 working days)
Permanent address of the document: https://misteriavale.com/legal/privacy/
1.1. This Policy describes how sole proprietor Koziy Andrey Anatolyevich (hereinafter the "Operator") processes the personal data of users of the browser game Misteria Vale (hereinafter the "Game") and of visitors to the website misteriavale.com (hereinafter the "Website").
1.2. The Policy is drawn up in accordance with Federal Law No. 152-FZ of 27.07.2006 "On Personal Data" (hereinafter "152-FZ").
1.3. By using the Website and the Game, and by purchasing a Package of Mana, the user confirms that they have read this Policy. Mana is an in-game resource; the purchase of a Package means the acquisition of the right to use the additional functionality of the Game (for detail, see the Public Offer at https://misteriavale.com/legal/offer/).
1.4. The fact of acceptance of each contractual document (the Public Offer, the Terms of Use, the Payment and Refund Policy) is recorded by the Operator, stating the version of the text of the document, the date and time of acceptance, and the user's IP address and user-agent. The versions of this Policy and of the AI Usage Policy are also recorded as part of the order; their acceptance is not effected by a tick (see clause 6.4).
2.1. Account — the user's account in the Game.
2.2. Mana — an in-game resource in units of which the scope of the right to use the additional functionality of the Game is expressed.
2.3. Package — a fixed quantity of units of Mana offered for purchase at the price given in the catalogue of Packages on the Website.
The Operator processes the data of the following categories of subjects:
3.1. Visitors to the Website — persons viewing the public pages of the Website without registration.
3.2. Registered users — persons who have created an Account in the Game.
3.3. Buyers — registered users who have placed an order to purchase a Package.
4.1. For registered users:
— the email address given when the Account was created; it also serves as the login and as the address to which the link for restoring access to the Account is sent;
— the in-game nickname chosen by the user and displayed in the game;
— technical logs of the operation of the Game and the Website (records of actions, errors, times of requests);
— the text of the lines the user enters in the Game when talking to characters;
— the log of Mana operations (credits and charges on the Account). The log is kept for all registered users: basic access to the Game includes a starting stock of free Mana, and free and paid Mana are accounted for separately.
4.2. Additionally, for buyers:
— the email address for sending the fiscal receipt (requested in the purchase form; it may differ from the Account email);
— the IP address and user-agent at the moment the legal documents were accepted;
— information about orders: order number, contents of the Package, sum, date, payment status, versions of the documents accepted.
4.3. For visitors to the Website: technical data automatically transmitted by the browser (IP address, user-agent) within the scope of standard server logs, and also the data of the web analytics service (clause 9.6): the browser identifier it assigns in a cookie file, the addresses of the pages viewed, the address of the referring page and the advertising campaign parameters (utm tags), information about the device and browser, the approximate region determined from the IP address, and, on the pages of the Website (other than the Game), a recording of actions in the browser window (pointer movements, scrolling, clicks). The name, email address, Account identifier and the text of lines in the Game are not transferred to the web analytics service.
4.4. Bank card details are not collected or stored by the Operator. Payment is made on the bank's page (payment link); the payment details are processed by Tochka Bank LLC as an independent participant in the settlement.
4.5. Special categories of personal data and biometric data are not processed or requested by the Operator.
5.1. Creation and maintenance of the Account, provision of access to the Game, sign-in to the Account and restoration of access to it (sending a one-time password-change link to the email address given).
5.2. Performance of the contract on the purchase of a Package: accepting payment, crediting Mana, sending the fiscal receipt, handling refunds (including cancellation of Mana on a refund), and considering claims.
5.3. Recording the fact of acceptance of the legal documents (evidence of the conclusion of the contract).
5.4. Generating the answers of the Game's characters using artificial-intelligence technologies (processing the text of lines).
5.5. Ensuring the operability and security of the Website and the Game, detecting and preventing abuse and fraud.
5.6. Compliance with the requirements of tax and accounting legislation and of the legislation on the use of cash register equipment.
5.7. Sending advertising and informational messages — only where separate voluntary consent has been given. Such consent is never a condition of purchase, is recorded separately and may be withdrawn at any time.
5.8. Collection of anonymised statistics of visits to the Website and the Game: how many people come, from which sources, which pages they use and at which step they stop. The purpose is to assess the working of the Website and the effectiveness of advertising; no decisions in respect of any particular user are taken on the basis of this data, and no profiling within the meaning of part 1 of Article 3 of 152-FZ is carried out.
6.1. Performance of a contract to which the data subject is a party (provision of access to the Game, sale of the right to use the additional functionality of the Game) — clause 5 of part 1 of Article 6 of 152-FZ.
6.2. Performance of duties imposed on the Operator by law (fiscalisation of settlements, tax and accounting records) — clause 2 of part 1 of Article 6 of 152-FZ.
6.3. Consent of the data subject — for advertising messages and other purposes not covered by clauses 6.1–6.2.
6.4. Processing for the purposes stated in section 5 (other than advertising messages and visit statistics) is carried out on the grounds in clauses 6.1–6.2 and does not require separate consent of the data subject. Familiarisation with this Policy is confirmed by the line placed under the payment button in the purchase form ("By paying you confirm that you have read the Personal Data Policy"); the version of the Policy is recorded in the order. Such confirmation records the fact that the user has been informed about the processing (Article 18.1 of 152-FZ) and does not constitute consent to the processing of personal data.
6.5. Pursuit of the Operator's legitimate interests — for the purpose stated in clause 5.8 (visit statistics) — clause 7 of part 1 of Article 6 of 152-FZ. The processing is limited to anonymised statistical indicators, is not used to take decisions in respect of any particular user and does not affect their rights and freedoms. The opt-out procedure is in clause 12.4.
7.1. Account data (the Account email, game data, the text of lines) is kept until the Account is deleted by the user or by the Operator, unless a different period follows from the law.
7.2. Records of orders and payments, the log of Mana operations and the records of acceptance of the legal documents are kept for 5 years from the moment of the operation — in accordance with the requirements of tax and accounting legislation on the retention of primary documents and settlement data. If the legislation establishes a different retention period for a particular category of records, the period established by legislation applies.
7.3. Server technical logs are kept for the period necessary to ensure security and to investigate incidents, after which they are deleted or anonymised.
8.1. The user is entitled to delete their Account. On deletion of the Account, the data stated in clause 7.1 is deleted or anonymised.
8.2. Records of orders and payments and the log of Mana operations are not deleted when the Account is deleted and continue to be kept for the period stated in clause 7.2. The ground for this is the Operator's duty to keep the documents necessary for the calculation and payment of taxes and the data on settlements with buyers (clause 2 of part 1 of Article 6 and part 2 of Article 9 of 152-FZ: processing without the subject's consent is permitted where it is necessary for the performance of duties imposed by law; see also part 5 of Article 21 of 152-FZ on the continuation of processing after consent is withdrawn). Once the retention period has expired, such records are deleted or anonymised.
8.3. A request for deletion is sent to support@misteriavale.com; the Operator sends a first response within 3 working days and carries out the deletion within the periods established by 152-FZ.
The Operator engages the following persons:
9.1. Cloud.ru — hosting provider; the servers are located in the territory of the Russian Federation. Processes all categories of data within the scope of hosting the infrastructure of the Game and the Website.
9.2. Tochka Bank LLC — acceptance of payments (internet acquiring: the Faster Payments System and bank cards). Receives the data necessary to carry out the payment; card details are entered on the bank's side and are not transferred to the Operator.
9.3. The cash register service (TSIB LLC, INN 1655439168) and the fiscal data operator ("Platforma OFD", INN 9715260691) — the issuing and transfer of fiscal receipts in accordance with 54-FZ. They receive: the buyer's email for the receipt, the name of the item, the sum, the order number. The cash register service is connected through Tochka Bank LLC; the cash register equipment on which the receipts are issued belongs to TSIB LLC, and "Platforma OFD" acts as the fiscal data operator — the composition of the participants has been confirmed by the bank in writing. The email given for the receipt is used to send fiscal receipts and is not used for advertising messages unless the user has given separate voluntary consent to receive news about the Game (clause 5.7).
9.4. VK LLC (the VK WorkSpace corporate mail service, formerly "Mail.ru for Business") — sending the Game's service (transactional) letters on the Operator's instructions. A service letter is a letter with a link for restoring the Account password, sent in response to a request from the user themselves. The minimum necessary for delivery is transferred: the recipient's email address and the text of the letter; no data is exported from the Operator's information systems into the mail service. The processing is carried out in the territory of the Russian Federation, and no cross-border transfer takes place when letters are sent (see section 10).
9.4.1. Email correspondence. The Operator does not use its own bulk mailing service; fiscal receipts are sent by the cash register service (clause 9.3). Correspondence with support is conducted at the email address stated in the section "Details of the Operator" (section 17). By sending an enquiry, the user themselves transmits the information they have included in the letter. In its replies the Operator confines itself to the information necessary for the reply (order number, status of the enquiry). If another provider is chosen for transactional or advertising letters, it will be named in the edition of the Policy then in force.
9.5. Google (the Gemini API) — generation of the answers of the Game's characters. Only the text of the user's lines together with the game context is transferred to Google (see section 10).
9.6. YANDEX LLC (the "Yandex Metrica" web analytics service) — collection of anonymised visit statistics on the Operator's instructions on the terms of use of the service published at https://yandex.ru/legal/metrica_termsofuse/. Receives the data listed in clause 4.3. The processing is carried out in the territory of the Russian Federation; no cross-border transfer takes place in the course of it (see section 10). The recording of actions in the browser window ("Webvisor") is enabled only on the pages of the Website and does not operate in the Game: on the Game's screen there is the user's correspondence with the characters, and it is not transferred to the web analytics service.
9.7. Google LLC (Google Sign-In) — signing in to the Account through a Google account, at the user's option. On loading the authorisation script into the Game's page it receives the visitor's IP address and user-agent; on a confirmed sign-in the Operator receives from Google the email address and the account identifier. The recipient is located in the USA — see clause 10.4. Use of this method of signing in is not obligatory: access to the Account is fully provided by signing in with an email address and password.
9.8. No other external analytics services are used on the Website or in the Game. Advertising networks, advertising pixels and trackers of third-party services are not connected by the Operator, and the Operator does not carry out retargeting; the data collected by the web analytics service (clause 9.6) is not used by the Operator to show advertising to any particular user. The requests made by the counter itself to the services of YANDEX LLC are described in clause 12.3.
10.1. Cross-border transfer of personal data carried out by the Operator is limited to two channels: requests to the Gemini API (Google) for the generation of the answers of the Game's characters (clauses 10.2–10.3) and signing in to the Account through a Google account (clause 10.4). There are no other channels; in particular, the web analytics service (clause 9.6) processes data in the territory of the Russian Federation, and no cross-border transfer takes place in the collection of visit statistics.
10.2. What is transferred is minimised: the requests to the model include only the text of the user's lines and the game context (a description of the scene, the character, the course of the investigation); the game context is composed by the Game (the Operator) and contains no personal data of the user. The email, full name, telephone number and Account identifier are not included in the requests to the model.
10.3. The said transfer is a cross-border transfer of personal data: the recipient is Google LLC, the recipient's country is the USA; the purpose of the transfer is the generation of the answers of the Game's characters. The legal ground for the transfer is the performance of a contract to which the user is a party (clause 5 of part 1 of Article 6 of 152-FZ); the law does not provide for separate consent of the user to a cross-border transfer. The transfer is carried out in compliance with the procedure established by Article 12 of 152-FZ, including notification of the authorised body of the cross-border transfer before it begins. The data transferred is additionally minimised (clause 10.2); the user should not state their own or another person's personal data in their lines — the Game does not need it in order to work.
10.4. Signing in to the Account through a Google account. The recipient is Google LLC, the recipient's country is the USA. What is transferred: the IP address and user-agent on loading the authorisation script into the Game's page, and also the information Google communicates to the Operator upon the sign-in (the email address and the account identifier). The purpose of the transfer is to confirm that the user owns the account stated. The legal ground is the performance of a contract to which the user is a party (clause 5 of part 1 of Article 6 of 152-FZ). A separate notification in respect of this channel is filed by the Operator under the procedure of Article 12 of 152-FZ. The user is entitled not to use this method of signing in: signing in with an email address and password is equivalent and always available.
11.1. In performance of part 5 of Article 18 of 152-FZ, the initial collection, recording, systematisation, accumulation and storage of the personal data of citizens of the Russian Federation are carried out using databases located on servers in the territory of the Russian Federation (the Cloud.ru infrastructure).
12.1. Strictly necessary technical means, without which the service does not work:
— the authorisation cookie (maintaining the user's session);
— the browser's localStorage (technical settings of the Game's client).
12.2. Cookie files of the web analytics service (clause 9.6), set in the visitor's browser on behalf of the domain misteriavale.com: _ym_uid — the browser identifier (retention period — 1 year), _ym_d — the date of the first visit (1 year), _ym_isad — an indicator of the presence of an ad blocker (about 2 days), _ym_visorc — a service identifier for the recording of actions on the pages of the Website (about 30 minutes). They make it possible to tell a repeat visit from a new one, but contain no name, email address or Account identifier.
12.3. The Operator does not set advertising pixels or trackers of third-party advertising networks and does not carry out retargeting; the counter's data is not used by the Operator to show advertising to any particular user. At the same time, in the course of its normal operation the web analytics counter (clause 9.6) makes requests to the services of YANDEX LLC (including to the nodes mc.yandex.ru and hdrc.yandex.net): it checks for the presence of an ad blocker and matches the browser identifier with other Yandex services, in the course of which Yandex may use its own cookie files of its own domains. The composition and purpose of such requests are determined by the terms of use of the Yandex Metrica service stated in clause 9.6.
12.4. How to opt out of the collection of statistics. The processing under clause 5.8 is carried out on the ground of the Operator's legitimate interest (clause 6.5), and therefore the user is entitled to object to it, and the opt-out is effected without giving reasons:
— install the official browser add-on "Yandex Metrica Blocker" (https://yandex.ru/support/metrica/general/opt-out.html) — it disables collection on all websites, including the Operator's Website;
— prohibit cookie files for the domain misteriavale.com in the browser settings, or delete them;
— send an enquiry to support@misteriavale.com — the Operator will cease processing the data of the person who applies for this purpose.
Opting out of the collection of statistics does not affect access to the Game or the performance of the contract: not a single function of the Game depends on it.
The user is entitled to:
13.1. Obtain information about the processing of their data (composition, purposes, periods, recipients).
13.2. Demand the correction, blocking or deletion of the data if it is incomplete, out of date, inaccurate or processed in breach of the law.
13.3. Withdraw consent to processing — in the part where the processing is based on consent (primarily advertising messages). Withdrawal of consent to advertising is effected by the link in the letter or through an enquiry to support and does not affect access to the Game.
13.4. Appeal against the Operator's actions to Roskomnadzor or to a court.
13.5. Enquiries are sent to support@misteriavale.com, stating the Account email and, on purchase matters, the order number. First response within 3 working days.
The Operator takes the necessary legal, organisational and technical measures (Article 19 of 152-FZ), including:
14.1. Transferring data only over secure channels (HTTPS).
14.2. Segregating access to data and logging the administrator's actions.
14.3. Keeping the log of Mana operations and the records of acceptance of documents in append-only mode — records cannot be altered retrospectively.
14.4. Storing data on servers in the territory of the Russian Federation (section 11).
14.5. Minimising the composition of the data transferred to third parties (sections 9–10).
15.1. On detecting an incident that has resulted in an unlawful transfer of personal data, the Operator:
— notifies Roskomnadzor within the periods established by 152-FZ (the initial notification within 24 hours, the results of the internal investigation within 72 hours);
— takes measures to contain and remedy the consequences of the incident;
— where necessary, informs the users affected.
16.1. The Operator is entitled to amend this Policy. A new edition is published at the permanent address https://misteriavale.com/legal/privacy/ with a new version number and effective date; previous editions are kept in the archive.
16.2. The version of the Policy accepted by the user when placing an order is recorded in the order record and is not altered retrospectively.
16.3. The Policy is drawn up in Russian. Where a translation into another language appears, the Russian version prevails: the translation is for reference only and does not create rights or obligations of its own.
Sole proprietor Koziy Andrey Anatolyevich
INN 472600391500
OGRNIP 325774600178529
Email: support@misteriavale.com (first response within 3 working days)
Website: https://misteriavale.com