Privacy Policy

1. General Provisions

1.1. This Privacy Policy defines the procedure for processing and protecting the personal data of users of the QZy VPN digital service, including the Telegram bot, Mini App, website, support service, and related payment scenarios (the “Service”).

1.2. The Operator processes data to the extent necessary to provide the digital service, perform the agreement with the user, process payments, provide support, protect the Service, and comply with the laws of the Russian Federation.

1.3. Some Service functions may require data to be transferred to Telegram and payment providers. The transferred data is limited to what is necessary for the relevant operation.

2. Data We Process

2.1. The Operator may process the following categories of data:

• Telegram ID, username, first and last name from the Telegram profile, and interface language;
• information about actions in the bot and Mini App, requests, support inquiries, and support messages;
• selected plan, digital key term, price, payment method and status, order numbers, and transaction identifiers;
• payment documents submitted by the user for manual review, including file name, type, size, signature, and review result;
• digital key information: internal identifier, status, validity term, traffic usage, and technical identifiers;
• technical information about devices and connections available to the Service infrastructure: device identifier, model, operating system, last activity time, and traffic usage;
• referral code and information required to award bonuses;
• IP address, User-Agent, request time, and security logs generated when using the website, Mini App, and protected administrative interfaces.

2.2. The Operator does not request users' passport details, Russian individual insurance account numbers, or bank card details. Bank card data is processed by the payment provider on its protected side and is not transferred to the Operator unless expressly stated before payment.

2.3. QZy VPN is not intended to inspect or store the contents of users' network traffic. The technical infrastructure may record traffic volume and service connection data required to operate and protect the Service.

3. Purposes of Processing

• creating, activating, renewing, displaying, and reissuing personal digital keys;
• processing orders, payments, refunds, and supporting documents;
• providing support and notifying users about request, payment, and key statuses;
• maintaining operation history and preventing duplicate charges, fraud, spam, and abuse;
• accounting for devices and enforcing the established connection limit;
• complying with legal requirements, handling claims, and protecting the rights of the Operator and users;
• analysing technical errors and improving Service reliability.

4. Legal Grounds and Processing Methods

4.1. Processing is based on the conclusion and performance of the User Agreement, user consent where required by law, the Operator's statutory obligations, and legitimate interests in ensuring security and protecting the Service, provided that users' rights are respected.

4.2. Processing may include collection, recording, organisation, accumulation, storage, correction, use, transfer in the cases specified by this Policy, anonymisation, blocking, and deletion, with or without automated means.

5. Data Transfer and Processing by Third Parties

5.1. To operate the Service, data may be transferred or made available to the extent necessary to:

• Telegram, for operation of the bot and Mini App and delivery of messages;
• payment providers and banks, for payment creation, status confirmation, refunds, and fraud prevention;
• server, network, and technical infrastructure providers, for providing digital keys and maintaining Service availability;
• government authorities, where and as required by law.

5.2. The Operator does not sell personal data or transfer it to third parties for their independent advertising purposes.

5.3. If cross-border transfer of personal data is required for operation of the Service, it is carried out in compliance with the applicable requirements of the laws of the Russian Federation.

6. Retention and Deletion

6.1. Data is retained no longer than necessary for the purposes of processing, contract performance, handling requests, and compliance with mandatory record-keeping and document-retention requirements.

6.2. Payment and accounting information may be retained for the period prescribed by law. Payment document files are deleted or anonymised under the internal retention policy after processing is completed and the required retention period expires. Information about the fact and outcome of the review may be retained.

6.3. Once the purposes of processing have been achieved or a lawful request has been received, data is deleted, anonymised, or blocked, except where further storage is required by law or necessary to resolve a dispute.

7. Data Protection

7.1. The Operator takes reasonable organisational and technical measures to protect data against unlawful access, alteration, disclosure, blocking, copying, and destruction.

7.2. Users must keep their personal digital key link confidential and must not disclose it to unauthorised persons. If compromise is suspected, the user should contact support.

8. User Rights

8.1. Users may request information about the processing of their data, correction, blocking, or deletion of that data, and may withdraw consent where processing is based on consent. Limitations may apply where processing is required to perform a contract or is prescribed by law.

8.2. Requests may be sent to qzy.nsx@gmail.com or through support at @QZy_help. To protect personal data, the Operator may request confirmation that the Telegram account belongs to the requester.

9. Policy Changes

9.1. The current version is permanently available at https://connect.qzybot.space/en/privacy/.

9.2. The Operator may update this Policy if the Service or applicable law changes. A new version takes effect on its publication date unless otherwise specified in that version.

10. Operator Contact Details

10.1. QZy VPN is the designation of the Service. Support is available through @QZy_help or qzy.nsx@gmail.com.