Privacy policy

1. General

This policy sets out how the personal data of individuals (“Users”) who use the unitvr.ru and unitvr.online websites, the account at account.unitvr.ru, the venue panel at app.unitvr.ru, the school panel at school.unitvr.ru, and the support chat and support calls on these websites (the “Platform”) is processed and protected.

Data controller: Mikhail Shakirov, sole proprietor, Tax ID (INN) 027404197037, Registration No. (OGRNIP) 322028000112998, e-mail info@unitvr.ru.

Using the Platform means you agree with this policy. If you do not agree, please stop using the Platform. For certain kinds of processing (voice calls to support) consent is requested or confirmed separately; you can opt out of web analytics at any time — see sections 4 and 14.

2. Terms and categories of people

“Personal data” — any information relating directly or indirectly to an identified or identifiable individual.

“Processing” — any operation performed on personal data, with or without automated means.

Categories of people whose data is processed: VR arcade owners and schools registered in the account; representatives of companies and sole proprietors who have entered into an agreement; people who contact us through the website forms, the support chat or a voice call to support; people paying for a subscription; visitors of the unitvr.ru and unitvr.online websites; students of schools using UnitVR School (only to the extent described in section 4).

Registration is intended for people aged 18 or over. The controller receives personal data of minors only from a school using UnitVR School — the student's first name and, if the “live teacher” feature is enabled, the student's voice (sections 4 and 10); the legal basis is the consent of parents or guardians obtained by the school.

3. Principles

Processing is lawful and fair, and limited to specific, predefined and lawful purposes.

Databases processed for incompatible purposes are not combined.

Only data that matches those purposes is processed; its content and volume are not excessive.

Data is destroyed or anonymized once the purposes are achieved or the need for them is gone.

The controller keeps the data accurate and, where necessary, up to date.

4. What data is processed

On registration: e-mail address, name, phone number (if given), and the password as an irreversible hash — the password itself is not known to the controller.

Through the contact form: name, e-mail address or phone number, and the text of the message. Through the custom development form: in addition, information about the project and any files you attach.

In the support chat: the conversation, any files you attach, and an anonymous browser identifier that lets the chat recognize you on your next visit.

In a voice call to support from the website: your voice and the content of the conversation. During business hours the call is answered by a specialist, and such calls are not recorded. Outside business hours the call is answered by a voice assistant based on Google Gemini (section 10), which processes your voice in real time; a call with the assistant is recorded (both sides), you are told so by a notice on the call screen during the call, and by continuing the call you agree to the recording. The recording of a call with the assistant and a short summary of your request are saved in the support conversation.

When paying by bank card (venues whose billing currency is the Russian rouble): e-mail address or phone number for the fiscal receipt, amount and purpose of the payment, and the bank's transaction ID. The controller never receives card details.

When paying in USDT (venues whose billing currency is not the Russian rouble): the sending wallet address, the network (TRON, BNB Chain or Ethereum), the amount and the transaction ID (hash), and the result of screening the sending address against sanctions lists and the USDT issuer's blocklist. The controller never asks for or stores private keys or any other information about your wallet.

In UnitVR School: the student's first name that the teacher or school administrator assigns to a headset for a lesson, and lesson progress (tasks, answers, time) containing no other information about the student. If the “live teacher” feature is enabled — the student's voice during the lesson (sections 9 and 10).

Automatically while the Platform is used: IP address, date and time of requests, the page requested, and technical information about the browser and device — needed to run the service and to protect it against password guessing and abuse.

Information about visits to the websites and the account collected by the Yandex Metrica web analytics service, unless the visitor has opted out (section 14).

Special categories of data (health, religious or political beliefs and the like) and biometric data are NOT processed: voice and call recordings are not used to identify anyone.

The controller does not collect personal data about the guests of the Customer's VR arcade: the Platform records anonymous session data (time, rate, game launched, headset) that does not identify a particular guest.

5. What is done with the data

The following operations are performed: collection, recording, structuring, accumulation, storage, updating, retrieval, use, transfer (provision, access) — including cross-border transfer in the cases listed in section 11 — anonymization, blocking, deletion and destruction.

Processing is mixed: both by automated means (the Platform's software and databases) and without them (for example when a message received by e-mail is reviewed).

No decision producing legal effects for the User is taken solely on the basis of automated processing. The support voice assistant only answers questions and passes the request to a specialist; it takes no decisions about the agreement, payments or access. Automated screening of the sender of a crypto payment only holds the payment pending review by the controller.

Users are not profiled for advertising purposes.

6. Purposes

Providing access to the Platform, identifying the User and operating the account, the venue panel and the school panel.

Performing the agreement: invoicing, processing and crediting payments, sending documents and payment notifications.

Screening the sender of a crypto payment against sanctions lists and the USDT issuer's blocklist — to comply with anti-money-laundering law and to avoid accepting frozen funds.

Answering messages and providing technical support, including by voice; recording support calls — to pass the request to a specialist, check the quality of answers and resolve disputes.

Running lessons in UnitVR School: showing the student's name to the teacher, counting lesson results, operating the “live teacher” feature.

Keeping the Platform secure: detecting and stopping unauthorized access attempts, password guessing and abuse.

Analysing traffic and usability of the websites and the account (you can opt out, section 14).

Informing the User about changes in the Platform (service messages). No marketing mailings are sent without separate consent.

7. Legal basis and retention

Legal basis: the User's consent, the agreement concluded (the public offer), and requirements of applicable law, including accounting, tax and anti-money-laundering law.

Account data is processed for as long as the account exists and is deleted or anonymized within 30 days after it is deleted, except for records that must be kept by law.

Payment records (including the sending wallet address and transaction hash) and accounting documents are kept for the period required by law (at least 5 years).

Website form messages, support conversations and recordings of calls with the support voice assistant are kept for no longer than 3 years after the last message in the conversation.

A student's first name in UnitVR School is kept while it is used in lessons and deleted if it has not been used for 30 days; the school can change or delete it at any time.

Server request logs (IP address, date and time, page address) are kept for no longer than 30 days.

Your voice in a call with the voice assistant and a student's voice in the “live teacher” feature are processed only during the conversation; apart from the support call recording described above, the controller does not store them.

8. When processing stops and how data is destroyed

Processing stops when any of the following occurs: the purposes are achieved or no longer needed; the User withdraws consent; the consent expires; unlawful processing is discovered; the controller ceases to operate.

Data is then destroyed or anonymized within no more than 30 days, unless another period is required by law or by the agreement.

Destruction excludes any further processing or recovery: records are deleted from the databases and then from the backups when the backup retention period ends (section 9: no longer than 3 months). One-off copies made manually before maintenance are deleted within 30 days.

Records that must be kept by law (in particular payment documents) are retained for the statutory period regardless of a withdrawal of consent.

9. Where the data is stored

Personal data of Russian citizens is recorded, structured, stored, updated and retrieved using databases located in the Russian Federation (servers in Moscow), as required by Russian law. The same databases in Moscow also hold the data of Users from other countries, including the EU/EEA and the UK: accounts, venue and school data, payments, support conversations and call recordings.

Database backups are additionally kept on the controller's server in the Netherlands, to restore the Platform if the main server is lost: daily copies for 7 days, weekly copies for 4 weeks and monthly copies for 3 months, after which they are deleted automatically. Only the controller has access to the backups; they are not used for any other processing.

Voice calls with the support voice assistant are processed on the controller's server in the Netherlands: there the call audio is passed to Google Gemini and mixed into a recording, which is immediately sent to the support conversation in the Russian Federation and is not kept on the server in the Netherlands. The server of the UnitVR School “live teacher” feature also runs there: it receives the student's voice and first name from the headset, passes them to Google Gemini and does not store the conversation.

Access to the databases is restricted to the controller and the people engaged by the controller, to the extent needed to do their work.

10. Sharing with third parties

Personal data is never sold, and it is not shared with third parties except as described below.

Card payments are processed by the acquiring bank (T-Bank JSC); the data needed to take the payment and issue a fiscal receipt is passed to it (e-mail address or phone number, amount, payment purpose). Card details are never passed to or stored by the controller.

USDT payments are made by you on a public blockchain (TRON, BNB Chain or Ethereum) to the controller's wallet address; by the nature of a blockchain, the transfer details (wallet addresses, amount, time) are public and not controlled by the controller. To credit the payment and screen the sender, the controller includes the sending wallet address in requests to public nodes of the relevant network (including the TronGrid service) and checks it against the public OFAC sanctions list; no other information about you is shared in the process.

E-mail is delivered through a mail service provider.

Outside business hours a voice call to support is handled by a voice assistant: Google Gemini (Google LLC, USA) receives in real time your voice and the assistant's speech and also — so that the assistant does not ask again what you have already said — the name you gave in the support chat (for a venue owner, the venue name) and the latest messages of your support conversation (up to 8 messages). These messages may contain contact details if you wrote them yourself. The data is used solely to recognize speech and produce the answer.

In UnitVR School, if the “live teacher” feature is enabled (a voice dialogue with a virtual teacher; it is switched on in the headset menu and is off by default), the student's voice and the first name given by the teacher when starting the lesson are passed in real time, through the controller's server in the Netherlands, to Google LLC's speech service (Gemini) solely to produce the virtual teacher's answer. The controller does not store the dialogue; the data is passed on the basis of consent obtained by the school from parents or guardians.

If a venue owner has connected Telegram notifications, messages about their venue and payments are delivered to them through Telegram (Telegram Messenger Inc.).

The web analytics service Yandex Metrica (Yandex LLC, Russian Federation) receives information about visits to the websites and the account unless the visitor has opted out of web analytics (section 14).

Data may be disclosed to competent state authorities on the grounds and in the manner established by law.

11. Processors and cross-border transfers

Where processing is entrusted to another party, this is done under a contract that defines the data, the operations, the purposes, the duty of confidentiality and the protection requirements.

The controller remains responsible to the User for the acts of any party processing data on its instructions.

The Platform's main databases are located in the Russian Federation (section 9). Personal data is transferred across borders in the following cases and to the following extent:

— to the Netherlands (a party to the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data): database backups (retention — section 9), and processing of the audio of voice calls with the support voice assistant and of a student's voice and first name in the “live teacher” feature on the controller's server;

— to the USA, to Google Gemini (Google LLC): your voice during a call with the support voice assistant, the name from the support chat and the latest messages of the conversation (section 10), and a student's voice and first name when the “live teacher” feature of UnitVR School is enabled — in real time only, not stored by the controller outside the Russian Federation;

— to public blockchain networks: the details of a USDT payment that you publish on the network yourself when making the transfer, and the sending wallet address in requests used to verify the payment;

— to Telegram: notifications to a venue owner who has connected them.

The transfer is based on the User's consent (a call to support after the on-screen notice, connecting notifications, paying in USDT) or is necessary to perform the agreement with the User; for students — on the consent of parents or guardians obtained by the school.

12. Security measures

Data travels between your device and the Platform over HTTPS; the audio of support calls is transmitted encrypted.

Passwords are stored only as irreversible hashes and cannot be recovered by the controller.

Organizational and technical measures protect against unauthorized access, including login attempt limits, separation of access rights and regular backups.

In line with Article 18.1 of Law 152-FZ, the controller has appointed a person responsible for organizing personal data processing, adopted and published this policy, carries out internal compliance control, has identified security threats and applies the measures required by Article 19 of the law, and gives access to data only to those who need it for their duties.

Support access to a User's account is possible only for a limited time, is written to a log the User can see, is accompanied by a notification and can be revoked by the User at any moment.

13. Your rights

You may obtain information about the processing of your personal data and require it to be corrected, blocked or destroyed if it is incomplete, out of date, inaccurate, unlawfully obtained or not necessary for the stated purpose.

You may withdraw your consent by writing to info@unitvr.ru. Withdrawal ends access to the Platform where the data is necessary to perform the agreement. Consent to web analytics is withdrawn as described in section 14; you can decline the recording of a call with the assistant by ending the call and writing to the support chat instead.

Requests are answered within no more than 30 days of receipt.

You may complain about the controller's actions to the Russian supervisory authority (Roskomnadzor) or in court.

If you are in the EU/EEA or the UK (GDPR / UK GDPR). The controller is Mikhail Shakirov, sole proprietor, Russian Federation (details in section 17); contact for any privacy request: info@unitvr.ru. The controller has no establishment or appointed representative in the EU/EEA or the UK.

Legal bases (Art. 6 GDPR): performance of the contract and steps before entering into it (account, venue, subscription, payments, support) — Art. 6(1)(b); legal obligations (accounting and tax records, anti-money-laundering screening of crypto payments) — Art. 6(1)(c); our legitimate interests in keeping the Platform secure, preventing abuse, answering support requests efficiently (including passing the support chat context to the voice assistant) and analysing how the websites and the account are used (web analytics, which you can object to at any time with “Opt out”) — Art. 6(1)(f); for registered users, also their consent to web analytics given in the registration form, and your consent for the recording of a call with the voice assistant — Art. 6(1)(a). Consent can be withdrawn at any time without affecting the lawfulness of processing before withdrawal.

Your rights: access to your data and a copy of it; rectification; erasure; restriction of processing; data portability (a copy of the data you provided, in a structured machine-readable format); objection to processing based on legitimate interests; withdrawal of consent; and not being subject to decisions based solely on automated processing (we take none). Send requests to info@unitvr.ru; we answer within one month (extendable by two months for complex requests, with notice).

International transfers: the Platform's databases are in Moscow, Russia, and the processing locations listed in section 11 (the Netherlands, the USA) are also used. There is no EU adequacy decision for Russia; your data is transferred to Russia because it is necessary to perform the contract you request (Art. 49(1)(b) GDPR) and, for optional features, on the basis of your explicit consent (Art. 49(1)(a)). If you do not agree to this, please do not use the Platform.

Retention periods are set out in section 7. You have the right to lodge a complaint with the data protection supervisory authority of your country of residence or work, or of the place of the alleged infringement (in the UK — the Information Commissioner's Office).

14. Cookies and similar technologies

The Platform stores technical data in your browser that is needed for it to work: the sign-in token, the selected venue, interface settings, the support chat identifier and, on the websites and in the account, a note that you have seen the web analytics notice or opted out of it.

This data is not used for advertising profiles and is not shared with third parties. Deleting it signs you out.

The public websites unitvr.ru and unitvr.online and the account at account.unitvr.ru use Yandex Metrica web analytics (Yandex LLC), including its session recording feature (“Webvisor”): page views, scrolling and clicks. The service collects information about the visit: page address, referrer, device and browser type, region by IP address, and Yandex cookies. The content of form fields (name, phone, e-mail, message text) is not recorded by Webvisor.

The same service is used in the account at account.unitvr.ru, to see where users struggle when registering and setting up a venue: it records navigation and actions on the account pages. It is not loaded on the password reset and e-mail confirmation pages.

Yandex Metrica is loaded when you visit the websites or the account; on your first visit the cookie notice tells you about it and lets you opt out. If you click “Opt out”, sending stops immediately, the counter's cookies are deleted and the service is not loaded on later visits. Users who register an account consent to web analytics in the registration form. Yandex Metrica is not used on the password reset, e-mail confirmation and invoice pages.

No external analytics is used in the venue panel at app.unitvr.ru, the school panel at school.unitvr.ru or the VR headset applications.

You can opt out of web analytics or withdraw your consent at any time with the “Cookie settings” link at the bottom of every page of unitvr.ru and unitvr.online: the notice opens again and you can choose “Opt out” — the counter stops loading and its cookies are deleted. In the account, clear the site data of account.unitvr.ru in your browser settings and the notice will appear again. You can also install the official Yandex Metrica opt-out browser add-on.

15. Responsible person and how to get in touch

The person responsible for organizing the processing of personal data is the controller, Mikhail Shakirov; the duties of keeping personal data secure are performed by the controller personally.

Requests about personal data are sent to info@unitvr.ru, stating your name, information confirming your relationship with the controller (for example the e-mail address of your account) and the substance of the request.

The controller reviews the request and replies within no more than 30 days of receipt. The period may be extended by up to 5 business days, with notice of the reasons.

You may obtain information about the processing of your personal data, including its legal basis and purposes, retention periods and the parties to whom it may be disclosed.

Where information is refused, the controller sends a reasoned answer stating the grounds for the refusal.

16. Changes to this policy

The controller may change this policy. The current edition is always available at this address.

Material changes are communicated through the account or by e-mail.