Base VPN privacy policy

This is an English translation. If it differs from the Russian version, the Russian version prevails.

1. General

1.1. This policy describes how personal data of Base VPN users is processed: the Telegram bot @basevpnapp, the website basevpn.app, the VPN servers and subscription links (the "Service").

1.2. The data controller is individual entrepreneur Dello Denis Sergeevich (INN 770980945851, OGRNIP 326774600254874), the "Operator".

1.3. The policy follows Federal Law No. 152-FZ of 27.07.2006 "On Personal Data".

1.4. By using the Service the User agrees to this policy. A User who does not agree should stop using the Service.

2. Data we process

2.1. Telegram account data: Telegram ID, username, first and last name from the Telegram profile, interface language.

2.2. Payment data: amounts, dates, statuses, payment and transaction IDs received from Telegram and payment providers, the bot balance, the e-mail for the cash receipt if the User entered it on the payment page. The Operator never receives or stores the full card number or CVC.

2.3. Auto-renewal data (section 5 of the offer): the technical card token from CloudPayments, the masked card number (first 6 and last 4 digits), card type and expiry date, the log of the auto-charge consent (text version, time, amounts, order number), notices, charges, bank declines and cancellation. The token is used only for auto-renewal and is deleted when the User turns auto-renewal off.

2.4. Subscription data: plan, dates, Key (subscription link), device limit, traffic used, referral links.

2.5. Technical data: IDs and models of connected devices, operating system and app version, IP address and time of requests to the subscription link, website and servers, time of the last connection.

2.6. Support conversations and anything the User provides, for example an e-mail address.

2.7. The Operator does not record traffic content, browsing history or DNS queries.

3. Purposes

• registration in the bot and access to the Service;
• payments, auto-renewal with the User's consent, refunds, accounting of payments;
• cash receipts and tax obligations;
• tracking subscription periods, device and traffic limits;
• subscription and charge notices, support;
• security and abuse prevention (section 7 of the offer);
• handling disputed transactions with banks and payment systems;
• compliance with the law.

4. Legal grounds

• performance of the agreement with the User (public offer, including the Auto-renewal terms) — Art. 6(1)(5) of 152-FZ;
• legal obligations of the Operator, including cash receipts under 54-FZ — Art. 6(1)(2) of 152-FZ;
• legitimate interests of the Operator: handling disputed transactions and fraud prevention — Art. 6(1)(7) of 152-FZ;
• the User's consent — for data the User provides voluntarily.

5. Processing and retention

5.1. Processing is automated: collection, recording, organisation, storage, correction, use, transfer as listed in section 6, anonymisation, deletion.

5.2. The Operator applies legal, organisational and technical safeguards: access control, encrypted connections, backups, separation of privileges.

5.3. Retention:

• account and subscription data — while the User uses the Service and 3 years after the last activity, or until deleted on request;
• payment data and the auto-renewal log — 5 years, as required by accounting and tax law;
• technical data — no longer than 12 months.

After that, data is deleted or anonymised.

6. Third parties

6.1. The Operator does not sell personal data. Data is shared only as needed to run the Service:

• Telegram — the bot and Telegram Stars payments;
• payment providers, including CloudPayments (CloudPayments LLC) — card, T-Pay and Mir Pay payments, card data storage, auto-charges and refunds;
• CloudKassir and the fiscal data operator — cash receipts: issuing, transfer to the Federal Tax Service, sending by e-mail;
• banks and payment systems — processing payments and handling disputed transactions;
• hosting providers — servers for the bot, database and VPN, including outside Russia;
• Cloudflare — website DNS and e-mail forwarding;
• public authorities — on lawful request.

6.2. Some of these companies are outside Russia, so cross-border transfer is possible. Only the data needed for the purposes above is transferred.

7. User rights

The User may request information about the processing, ask to correct, block or delete data, withdraw consent, and complain to Roskomnadzor or a court.

Send requests to admin@qalqan.app or @qalqan_support with your Telegram ID. The Operator answers within 10 working days. After deletion, access to the Service ends; payment records are kept for the period required by law.

8. Cookies

8.1. The website basevpn.app uses no cookies, analytics or ad trackers.

8.2. Web interfaces of the Service (subscription page, account) may use strictly necessary cookies and browser local storage for sign-in and settings. They can be removed in the browser settings.

9. Contacts

E-mail: admin@qalqan.app

Telegram: @qalqan_support

Operator details: basevpn.app/en/requisites

10. Changes

The Operator may change this policy. The new version is published at basevpn.app/privacy and applies from publication.