Privacy policy

1. General

This policy sets out how the personal data of individuals (“Users”) who use the unitvr.ru and unitvr.online websites, the account at account.unitvr.ru, the venue panel at app.unitvr.ru, the school panel at school.unitvr.ru, and the support chat and support calls on these websites (the “Platform”) is processed and protected.

Data controller: Mikhail Shakirov, sole proprietor, Tax ID (INN) 027404197037, Registration No. (OGRNIP) 322028000112998, e-mail info@unitvr.ru.

Using the Platform means you agree with this policy. If you do not agree, please stop using the Platform. For certain kinds of processing (web analytics, voice calls to support) consent is requested or confirmed separately — see sections 4 and 14.

2. Terms and categories of people

“Personal data” — any information relating directly or indirectly to an identified or identifiable individual.

“Processing” — any operation performed on personal data, with or without automated means.

Categories of people whose data is processed: VR arcade owners and schools registered in the account; representatives of companies and sole proprietors who have entered into an agreement; people who contact us through the website forms, the support chat or a voice call to support; people paying for a subscription; visitors of the unitvr.ru and unitvr.online websites; students of schools using UnitVR School (only to the extent described in section 4).

Registration is intended for people aged 18 or over. The controller receives personal data of minors only from a school using UnitVR School — the student's first name and, if the “live teacher” feature is enabled, the student's voice (sections 4 and 10); the legal basis is the consent of parents or guardians obtained by the school.

3. Principles

Processing is lawful and fair, and limited to specific, predefined and lawful purposes.

Databases processed for incompatible purposes are not combined.

Only data that matches those purposes is processed; its content and volume are not excessive.

Data is destroyed or anonymized once the purposes are achieved or the need for them is gone.

The controller keeps the data accurate and, where necessary, up to date.

4. What data is processed

On registration: e-mail address, name, phone number (if given), and the password as an irreversible hash — the password itself is not known to the controller.

Through the contact form: name, e-mail address or phone number, and the text of the message. Through the custom development form: in addition, information about the project and any files you attach.

In the support chat: the conversation, any files you attach, and an anonymous browser identifier that lets the chat recognize you on your next visit.

In a voice call to support from the website: your voice and the content of the conversation. The call is recorded (both sides); you are told so by a notice on the call screen before and during the call, and by continuing the call you agree to the recording. Outside business hours the call is answered by a voice assistant based on Google Gemini (section 10), which processes your voice in real time. The recording and a short summary of your request are saved in the support conversation.

When paying by bank card (Customers in the Russian Federation): e-mail address or phone number for the fiscal receipt, amount and purpose of the payment, and the bank's transaction ID. The controller never receives card details.

When paying in USDT (Customers outside the Russian Federation): the sending wallet address, the network (TRON, BNB Chain or Ethereum), the amount and the transaction ID (hash), and the result of screening the sending address against sanctions lists and the USDT issuer's blocklist. The controller never asks for or stores private keys or any other information about your wallet.

In UnitVR School: the student's first name that the teacher or school administrator assigns to a headset for a lesson, and lesson progress (tasks, answers, time) containing no other information about the student. If the “live teacher” feature is enabled — the student's voice during the lesson (section 10).

Automatically while the Platform is used: IP address, date and time of requests, the page requested, and technical information about the browser and device — needed to run the service and to protect it against password guessing and abuse.

If a website visitor consents to web analytics — the information collected by Yandex Metrica (section 14).

Special categories of data (health, religious or political beliefs and the like) and biometric data are NOT processed: voice and call recordings are not used to identify anyone.

The controller does not collect personal data about the guests of the Customer's VR arcade: the Platform records anonymous session data (time, rate, game launched, headset) that does not identify a particular guest.

5. What is done with the data

The following operations are performed: collection, recording, structuring, accumulation, storage, updating, retrieval, use, transfer (provision, access) — including cross-border transfer in the cases listed in section 11 — anonymization, blocking, deletion and destruction.

Processing is mixed: both by automated means (the Platform's software and databases) and without them (for example when a message received by e-mail is reviewed).

No decision producing legal effects for the User is taken solely on the basis of automated processing. The support voice assistant only answers questions and passes the request to a specialist; it takes no decisions about the agreement, payments or access. Automated screening of the sender of a crypto payment only holds the payment pending review by the controller.

Users are not profiled for advertising purposes.

6. Purposes

Providing access to the Platform, identifying the User and operating the account, the venue panel and the school panel.

Performing the agreement: invoicing, processing and crediting payments, sending documents and payment notifications.

Screening the sender of a crypto payment against sanctions lists and the USDT issuer's blocklist — to comply with anti-money-laundering law and to avoid accepting frozen funds.

Answering messages and providing technical support, including by voice; recording support calls — to pass the request to a specialist, check the quality of answers and resolve disputes.

Running lessons in UnitVR School: showing the student's name to the teacher, counting lesson results, operating the “live teacher” feature.

Keeping the Platform secure: detecting and stopping unauthorized access attempts, password guessing and abuse.

Analysing website traffic and usability (only with the visitor's consent, section 14).

Informing the User about changes in the Platform (service messages). No marketing mailings are sent without separate consent.

7. Legal basis and retention

Legal basis: the User's consent, the agreement concluded (the public offer), and requirements of applicable law, including accounting, tax and anti-money-laundering law.

Account data is processed for as long as the account exists and is deleted or anonymized within 30 days after it is deleted, except for records that must be kept by law.

Payment records (including the sending wallet address and transaction hash) and accounting documents are kept for the period required by law (at least 5 years).

Website form messages, support conversations and recordings of support calls are kept for no longer than 3 years after the last message in the conversation.

A student's first name in UnitVR School is kept while it is used in lessons and deleted if it has not been used for 30 days; the school can change or delete it at any time.

Server request logs (IP address, date and time, page address) are kept for no longer than 30 days.

Your voice in a call with the voice assistant and a student's voice in the “live teacher” feature are processed only during the conversation; apart from the support call recording described above, the controller does not store them.

8. When processing stops and how data is destroyed

Processing stops when any of the following occurs: the purposes are achieved or no longer needed; the User withdraws consent; the consent expires; unlawful processing is discovered; the controller ceases to operate.

Data is then destroyed or anonymized within no more than 30 days, unless another period is required by law or by the agreement.

Destruction excludes any further processing or recovery: records are deleted from the databases and then from the backups, within the backup retention period (30 days).

Records that must be kept by law (in particular payment documents) are retained for the statutory period regardless of a withdrawal of consent.

9. Where the data is stored

Personal data of Russian citizens is recorded, structured, stored, updated and retrieved using databases located in the Russian Federation (servers in Moscow), as required by Russian law. These databases hold the accounts, venue and school data, payments, support conversations and support call recordings.

Database backups are additionally kept for no longer than 7 days on the controller's server in the Netherlands, to restore the Platform if the main server is lost. Backups are not used for any other processing.

Voice calls with the support voice assistant are processed on the controller's server in the Netherlands: there the call audio is passed to Google Gemini and mixed into a recording, which is immediately sent to the support conversation in the Russian Federation and is not kept on the server in the Netherlands.

Access to the databases is restricted to the controller and the people engaged by the controller, to the extent needed to do their work.

10. Sharing with third parties

Personal data is never sold, and it is not shared with third parties except as described below.

Card payments are processed by the acquiring bank (T-Bank JSC); the data needed to take the payment and issue a fiscal receipt is passed to it (e-mail address or phone number, amount, payment purpose). Card details are never passed to or stored by the controller.

USDT payments are made by you on a public blockchain (TRON, BNB Chain or Ethereum) to the controller's wallet address; by the nature of a blockchain, the transfer details (wallet addresses, amount, time) are public and not controlled by the controller. To credit the payment and screen the sender, the controller includes the sending wallet address in requests to public nodes of the relevant network (including the TronGrid service) and checks it against the public OFAC sanctions list; no other information about you is shared in the process.

E-mail is delivered through a mail service provider.

Outside business hours a voice call to support is handled by a voice assistant: your voice and the assistant's speech are passed in real time to Google Gemini (Google LLC, USA) solely to recognize speech and produce the answer. Information identifying the caller (name, contact details, account) is not passed to the service unless you say it yourself during the call.

In UnitVR School, if the school enables the “live teacher” feature (a voice dialogue with a virtual teacher), the student's voice and the first name given by the teacher when starting the lesson are passed in real time to Google LLC's speech service (Gemini) solely to produce the virtual teacher's answer. The controller does not store the dialogue; the data is passed on the basis of consent obtained by the school from parents or guardians. The feature can be switched off and is off by default.

If a venue owner has connected Telegram notifications, messages about their venue and payments are delivered to them through Telegram (Telegram Messenger Inc.).

The web analytics service Yandex Metrica (Yandex LLC, Russian Federation) receives information about visits to the websites and the account only with the visitor's consent, and information about the use of the venue and school panels (section 14).

Data may be disclosed to competent state authorities on the grounds and in the manner established by law.

11. Processors and cross-border transfers

Where processing is entrusted to another party, this is done under a contract that defines the data, the operations, the purposes, the duty of confidentiality and the protection requirements.

The controller remains responsible to the User for the acts of any party processing data on its instructions.

The Platform's main databases are located in the Russian Federation (section 9). Personal data is transferred across borders in the following cases and to the following extent:

— to the Netherlands (a party to the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data): database backups (kept for no longer than 7 days) and processing of the audio of voice calls with the support voice assistant on the controller's server;

— to the USA, to Google Gemini (Google LLC): your voice during a call with the support voice assistant, and a student's voice and first name when the “live teacher” feature of UnitVR School is enabled — in real time only, not stored by the controller outside the Russian Federation;

— to public blockchain networks: the details of a USDT payment that you publish on the network yourself when making the transfer, and the sending wallet address in requests used to verify the payment;

— to Telegram: notifications to a venue owner who has connected them.

The transfer is based on the User's consent (a call to support after the on-screen notice, connecting notifications, paying in USDT) or is necessary to perform the agreement with the User; for students — on the consent of parents or guardians obtained by the school.

12. Security measures

Data travels between your device and the Platform over HTTPS; the audio of support calls is transmitted encrypted.

Passwords are stored only as irreversible hashes and cannot be recovered by the controller.

Organizational and technical measures protect against unauthorized access, including login attempt limits, separation of access rights and regular backups.

In line with Article 18.1 of Law 152-FZ, the controller has appointed a person responsible for organizing personal data processing, adopted and published this policy, carries out internal compliance control, has identified security threats and applies the measures required by Article 19 of the law, and gives access to data only to those who need it for their duties.

Support access to a User's account is possible only for a limited time, is written to a log the User can see, is accompanied by a notification and can be revoked by the User at any moment.

13. Your rights

You may obtain information about the processing of your personal data and require it to be corrected, blocked or destroyed if it is incomplete, out of date, inaccurate, unlawfully obtained or not necessary for the stated purpose.

You may withdraw your consent by writing to info@unitvr.ru. Withdrawal ends access to the Platform where the data is necessary to perform the agreement. Consent to web analytics is withdrawn as described in section 14; you can decline call recording by ending the call and writing to the support chat instead.

Requests are answered within no more than 30 days of receipt.

You may complain about the controller's actions to the Russian supervisory authority (Roskomnadzor) or in court.

14. Cookies and similar technologies

The Platform stores technical data in your browser that is needed for it to work: the sign-in token, the selected venue, interface settings, the support chat identifier and, on the websites, your web analytics choice.

This data is not used for advertising profiles and is not shared with third parties. Deleting it signs you out.

The public websites unitvr.ru and unitvr.online use Yandex Metrica web analytics (Yandex LLC), including its session recording feature (“Webvisor”): page views, scrolling and clicks. The service collects information about the visit: page address, referrer, device and browser type, region by IP address, and Yandex cookies. The content of form fields (name, phone, e-mail, message text) is not recorded by Webvisor.

The same service is used in the account at account.unitvr.ru, to see where users struggle when registering and setting up a venue: it records navigation and actions on the account pages. It is not loaded on the password reset and e-mail confirmation pages.

Yandex Metrica is loaded ONLY after you click “Accept” on the cookie notice (separately on the websites and in the account). If you decline or make no choice, the service is not loaded and nothing is sent to it.

In the venue panel at app.unitvr.ru and the school panel at school.unitvr.ru the same service records which panel screens and buttons the venue's or school's staff use — to fix errors and improve the interface as part of performing the agreement with the Customer. No external analytics is used in the VR headset applications.

You can withdraw consent to web analytics at any time: clear the site data (cookies and local storage) in your browser settings — the notice will appear again on your next visit and you can choose “Decline”. You can also install the official Yandex Metrica opt-out browser add-on.

15. Responsible person and how to get in touch

The person responsible for organizing the processing of personal data is the controller, Mikhail Shakirov; the duties of keeping personal data secure are performed by the controller personally.

Requests about personal data are sent to info@unitvr.ru, stating your name, information confirming your relationship with the controller (for example the e-mail address of your account) and the substance of the request.

The controller reviews the request and replies within no more than 30 days of receipt. The period may be extended by up to 5 business days, with notice of the reasons.

You may obtain information about the processing of your personal data, including its legal basis and purposes, retention periods and the parties to whom it may be disclosed.

Where information is refused, the controller sends a reasoned answer stating the grounds for the refusal.

16. Changes to this policy

The controller may change this policy. The current edition is always available at this address.

Material changes are communicated through the account or by e-mail.