Privacy Policy

1. General Provisions

— (Tax ID: —) processes personal data in accordance with applicable data protection laws.

Country: — Registered Address: —

2. Data We Collect

We collect a minimal set of data: name, Telegram contact information, and order details. Data is transmitted through secure channels.

Categories of personal data processed: full name; email address; phone number; delivery address; messenger identifiers (Telegram, MAX, VK); order, booking and event registration data; technical data (IP address, device and browser type); strictly necessary cookies and browser local storage data (section 5).

The data controller is —. The platform on whose servers this site runs processes the data on the controller's behalf.

3. Purpose of Processing

Personal data is used for: order processing, customer communication, and service improvement.

Personal data is processed on the basis of your consent (the "Consent to personal data processing" document, `/consent`) and to perform the contract (the terms of service, `/terms`). Advertising and informational mailings are sent only with a separate consent (`/marketing-consent`).

4. Storage and Protection

Data is stored on secure servers. Retention periods comply with applicable legislation. We implement technical and organizational measures to protect your data.

Personal data is stored in databases located in the Russian Federation.

Data is kept until the purposes of processing are achieved or consent is withdrawn, unless the law requires a longer period (for example, accounting records of orders).

Data is shared with third parties only as far as needed to fulfil your order: with payment providers to process the payment, and with messengers (Telegram, MAX, VK) to deliver the messages you initiated.

5. Cookies

This site uses **strictly necessary cookies only** — those without which the actions you request cannot be performed. We do not set advertising, analytics, or tracking cookies; data about your visit is not shared with third parties and is not used to build an advertising profile.

| Cookie | Purpose | Retention | | -------------------- | ---------------------------------------------------------------------------------------------- | ---------------------------------------------------------- | | Session | keeps you signed in to your account | up to 15 minutes, extended on activity | | Session renewal | signing in again without re-authenticating | 7 days | | Sign-in verification | protects the authentication flow | 5 minutes | | `sf_visit` | functional session identity for the correct operation of multi-step forms within one visit | until the browser is closed; no `Max-Age` attribute is set | | `sf_cart` | functional opaque address of a server-side cart; returns the buyer to the cart already created | 30 days (`Max-Age=2592000`) |

Both cookies use `Secure`, `HttpOnly`, `SameSite=Lax`, and `Path=/`, and are isolated at the relevant tenant boundary. `sf_cart` carries only an opaque cart address and remains in the Russian Server A/Postgres perimeter: it is never sent to Server B, ClickHouse, or third parties. `sf_visit` is neither cart composition nor a durable customer identity; where technical diagnosis needs it, only an ephemeral identity for one browser session may cross to Server B.

Browser `localStorage` holds only three functional carriers:

- a local deferred cart proposal before sign-in: an opaque product code, quantity, selected options, and a note. It contains no prices, payment-provider data, server identifiers, quotes, or analytics data and is not transferred to third parties. The proposal is cleared only after a successful merge into a server cart or an explicit buyer clear; - the first name, last name, and photo link of your messenger profile, for the mini app launch screen, so that the next opening can show at once whose account it is. This copy stays on your device only, and we do not receive it from your device. It is deleted when you sign out of your account; a copy older than 30 days is not used and is deleted at the next mini app opening. The photo itself is loaded from the messenger's servers; - the chosen color theme (light or dark), so that the page opens in it right away.

For this functional processing, the tenant is the controller of personal data and the platform is the processor. These carriers create no independent tracking purpose, use no third-party pixels or advertising counters, and require no separate consent banner solely for their functional use.

The cookies above are inaccessible to third-party scripts. Data in `localStorage` is readable by scripts running on this same site and is not available to other sites. You can disable cookies and `localStorage` in your browser settings, but signing in and placing an order will not work.

6. Your Rights

You have the right to access, rectify, and delete your personal data. To exercise your rights, contact us using the information below.

You may withdraw your consent to the processing of personal data at any time by contacting us below. Processing then stops and the data is deleted within the statutory period, except for data the law requires us to keep.

7. Contact Information

Email: — Support: —

Published: 10/18/2026