Privacy Policy

1. General provisions

1.1. This Privacy Policy (the “Policy”) sets out how personal data of users of the “Wet Tortle” service is processed and protected: the website dnd-dm.ru, the Telegram bot @dnd5char_bot and its Mini App (together, the “Service”).

1.2. The data operator is Individual Entrepreneur Novikov Vladislav Sergeevich, OGRNIP 326237500014325, INN 236104430726 (the “Operator”).

1.3. The Policy has been drawn up in accordance with Federal Law No. 152-FZ of 27 July 2006 “On Personal Data”.

1.4. By using the Service the user confirms that they have read this Policy and agree with the way data is processed as described here.

2. Data processed

2.1. The Operator processes the following data of Service users:

• Telegram account data: the identifier (telegram_id), username, the first and last name shown in the profile, and the interface language code. This data is supplied by Telegram itself when the bot or the Mini App is launched;
• game data: characters created by the user, inventory, adventure log, game settings, as well as the texts the user sends to the AI dungeon master and the generated replies;
• purchase data: the fact, date, amount and status of a payment, the purchased “mana” package, and the payment identifier in the payment system. Bank card details are neither transferred to nor stored by the Operator;
• technical data: IP address, browser and device information, date and time of requests, addresses of the pages viewed.

2.2. The Operator does not request passport data, postal address or phone number, and does not process special categories of personal data.

2.3. Users should not disclose personal data — their own or that of third parties — in conversations with the AI dungeon master: the texts of game messages are transferred to an external language model provider (clause 5.1).

3. Analytics and cookies on dnd-dm.ru

3.1. The website runs Yandex Metrica counter No. 110744350. Metrica collects depersonalised information about visits: the referral source, the pages viewed, the type of device and browser, and the region derived from the IP address.

3.2. Session Replay (Webvisor) is enabled in the counter — a technology that records visitor actions on the page: cursor movement, clicks, scrolling and navigation. The recordings are used solely to evaluate the usability of the website. The website has no data entry forms.

3.3. Metrica stores its own cookies in the browser. The operator of Metrica is Yandex LLC; processing takes place within the Russian Federation under the Yandex terms.

3.4. Page fonts are loaded from Google Fonts servers, so when the website is opened the IP address and browser information become known to Google LLC (USA).

3.5. The Telegram bot and the Mini App carry no traffic counters and no advertising cookies; authentication in the Mini App relies on the data supplied by Telegram itself.

4. Purposes and legal grounds for processing

4.1. Data is processed in order to:

• provide access to the Service and recognise a returning user;
• run the game: store the character, the progress and the adventure history;
• perform the contract for the purchase of “mana” concluded under the public offer, and comply with the legislation on the use of cash register equipment;
• respond to support enquiries;
• evaluate the usability of the website and fix errors.

4.2. Legal grounds: the consent of the user expressed by action (launching the bot, continuing to use the website, making a payment), performance of the contract with the user, and the requirements of the legislation of the Russian Federation.

5. Transfer of data to third parties

5.1. The Operator transfers data to the following parties and to the following extent:

• Telegram Messenger Inc. — as part of the operation of the bot and the Mini App: user messages and Service replies pass through Telegram infrastructure;
• OpenRouter, Inc. (USA) and the language model providers connected through it — the texts of game messages and the adventure context needed to generate the AI dungeon master’s reply. Account and payment data is not transferred to them;
• Railway Corp. (USA) — as the provider of the infrastructure that runs the bot, the Mini App and the database;
• NKO YuMoney LLC (YooKassa) — the data required to carry out the payment and issue the fiscal receipt;
• Yandex LLC — depersonalised website visit data through the Metrica counter (clause 3);
• Google LLC — the IP address and browser information when the website fonts are loaded.

5.2. Data is not transferred to any other parties, except in the cases directly provided for by the legislation of the Russian Federation.

5.3. The Operator does not sell user data and does not use it for advertising targeting.

6. Storage location and cross-border transfer

6.1. The bot, the Mini App and the Service database are hosted on Railway infrastructure; the data centres used are located outside the Russian Federation (the USA and European Union countries — the exact set of sites is determined by the provider).

6.2. The dnd-dm.ru website is hosted on a rented server in Finland (Helsinki).

6.3. The texts of game messages are processed by the language model provider in the territory of the USA.

6.4. Payment data is processed by YooKassa within the Russian Federation, and Yandex Metrica data is processed within the Russian Federation.

6.5. Consequently, using the Service involves a cross-border transfer of personal data, including to states that are not parties to the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data. By starting to use the Service the user consents to such transfer on the terms of this Policy. Consent may be withdrawn by ceasing to use the Service and sending a data deletion request (clause 8).

7. Retention periods

7.1. Account and game data is stored while the user uses the Service and for 3 (three) years from the last activity.

7.2. Payment records are stored for 5 (five) years — the period established by law for accounting and tax documents.

7.3. Yandex Metrica data, including Session Replay recordings, is stored on the Metrica side for the periods it establishes.

7.4. At the user’s request data is deleted earlier than the periods above, except for information the Operator is required by law to retain.

8. User rights

8.1. The user has the right to:

• obtain information about the processing of their personal data;
• demand that data be corrected, blocked or destroyed;
• withdraw consent to the processing of data;
• refuse analytics cookies by disabling them in the browser settings or by installing the Yandex Metrica opt-out add-on;
• appeal against the Operator’s actions to Roskomnadzor or in court.

8.2. Enquiries are sent to work@sunm8.ru or to Telegram @sunm8. The response time is up to 30 days.

9. Data protection

9.1. The Operator applies technical and organisational protection measures: access to the database is restricted, connections to the Service are protected by HTTPS, and payment details never reach the Operator.

9.2. The Service does not guarantee absolute protection against unlawful acts of third parties, but undertakes to remedy identified vulnerabilities and to notify users of significant incidents.

10. Changes to the Policy

10.1. The Operator may amend the Policy. The current version is always published at https://dnd-dm.ru/privacy/; the date of the version is stated at the top of the document.

Operator details