Privacy policy

The controller is Aleksandr Sergeevich Petrov, a self-employed NPD taxpayer and Russian tax resident; tax ID 505012965345, address for notices: info@vela-multi.com; the postal address is provided on request to this e-mail.

This policy covers VELA, its site and subdomains, account page, launcher and connected services. This version is effective from 21 October 2026. Consent does not replace other required legal grounds.

The servers are hosted by Hostkey (the Netherlands). Russian personal-data requirements, including Roskomnadzor notification and the recording of Russian citizens’ data, apply to the extent they are relevant to the controller.

• Account and sign-in: login, e-mail, authentication details, registration and sign-in history. The password is not stored in plain text; account-page sign-in tokens are stored as a hash, and the cookie is protected with the HttpOnly and SameSite=Strict flags.
• Security: IP address, action timestamps and types, browser details; hardware ID (HWID) and the launcher’s client check results (file integrity, presence of prohibited programs such as cheats and bots). They serve only protection against cheats, bots and circumvention and are not used for advertising.
• Game: characters, inventory, clans, operations, chat and moderation logs to the extent necessary. Public rankings and the Chronicle show character and clan names and in-game achievements; e-mail, IP address and account details are not published.
• Payments: order and transaction identifiers, amount, currency, date, status, credits, refunds and NPD receipt. Card details are entered on the payment service’s page and are not sent to VELA; the service returns the payment number and status, amount and currency.
• Support: contact details, request text and necessary attachments. Do not send passwords, codes, CVV/CVC, full card details or unnecessary documents.
• Optional features: Telegram — chat identifier and the notifications you choose, only if you link the bot yourself; Discord — the public world Chronicle in the community channel, with no account personal data; voice chat — audio passes through our voice server during the conversation; AI features — the text of your request and game context (e-mail, passwords and payment data are not included in such requests). Enabling one feature does not automatically authorise unrelated processing.

• Account operation, ordered features, service messages and support — contract performance to the necessary extent. Financial records and lawful requests — legal obligations.
• Protection against compromise, bots and abuse: sign-in and action logs, anticheat, chat moderation; the ground is the controller’s legitimate interest in service security and contract performance. Account bans and disputed payments must allow human review.
• Consent-based processing uses separate, purpose-specific consent. Advertising and promotion require a separate optional opt-in for the relevant channel. Refusing advertising does not prevent registration or payment.
• Sign-in codes, receipts, order updates and support replies are service messages by purpose. They do not authorise promotions or advertising. Selling personal data is not a processing purpose.

Data is retained only as necessary for its stated purpose or a mandatory legal period. Retention by category:

• Account and game data: while the account exists; after deletion on your request, a further 30 days, then deleted.
• Sign-in, security and anticheat logs: up to 90 days; penalty records while needed for appeals.
• Chats: 30 days, private messages: 7 days; support requests: while the matter is handled and up to 90 days after.
• Payments and receipts: 5 years (accounting and tax obligations), if payment acceptance is enabled.
• Database backups: nightly copies are kept on a 7 days + 4 weeks cycle and then deleted; when restoring from a copy, data previously deleted on request is deleted again.

Account deletion does not immediately erase records required by law or necessary for a specific dispute. Access to retained records is restricted and their retention separately justified. Indefinite precautionary retention is not prescribed.

Data goes only to contractors without which the service cannot run:

• hosting provider Hostkey (the Netherlands): game, database, site and backup servers;
• e-mail service Resend: sending confirmation and service e-mails (e-mail address and message text);
• Cloudflare: domain DNS records only, no traffic proxying; no player data is passed;
• Telegram: only if you linked the bot to your account yourself;
• payment services ENOT and Crypto Pay: only when payment acceptance is enabled; order number, amount, currency and payment status;
• AI provider (OpenAI or Anthropic): only the text of in-game AI feature requests.

The Discord community and Telegram channel are public venues under their own terms. Yandex Metrica is described below. AI requests may contain what you write yourself, so do not put personal data in them.

Cross-border transfers (hosting in the Netherlands, e-mail and AI services) are limited to what the service needs. Consent to processing does not replace other procedures required by law.

Authorities receive data only on a lawful basis and to the necessary extent. Listing a contractor does not grant unlimited access.

The site uses sign-in and browser preference storage. The account cookie holds the session token (HttpOnly, SameSite=Strict; a session ends after 14 days without a visit and in any case after 60 days); browser storage holds the interface language, the hero remote token and minor display preferences. Clearing storage may sign you out and reset preferences.

These pages reference Google Fonts; font requests disclose the visitor’s IP address to Google. We send Google no other data.

Public pages use Yandex Metrica (Yandex LLC, Russia): visit statistics and a click map. Session Replay (Webvisor) is switched off. Metrica sets its own cookies (_ym_*). The counter does not load in the account cabinet or the hero remote, nor when the browser sends Do Not Track or Global Privacy Control. Terms: yandex.ru/legal/metrica_termsofuse.

Measures match the risks: key-based access to servers, secure transport (HTTPS), hashing of passwords and tokens, limits on connections and sign-in attempts, access logs, nightly backups with restore checks, and incident response.

For an incident, the controller identifies affected data, takes action and fulfils notification duties within applicable statutory periods. No absolute immunity from a breach is promised.

You may request processing information, correction, lawful blocking or deletion, withdraw consent, and complain to Roskomnadzor or a court.

Contact: info@vela-multi.com; the postal address is provided on request to this e-mail. Proportionate requester verification may be required. Statutory response and action periods apply; any permitted extension is explained.

Withdrawing a specific consent, such as advertising consent, does not automatically delete the account. Processing for a feature stops if no lawful basis remains; necessary contract or legally required records may remain on a separate ground. The requester is informed of the consequences.

The game is open from age 14; paid orders from age 18 or with a guardian’s consent (see the terms). We do not intend to knowingly collect data of children under 14; if you notice such an account, write to info@vela-multi.com. A guardian may request review of a child’s registration or data processing. Unnecessary documents are not requested.

This is the version of 21 October 2026; new versions are published with a date. New purposes, data or recipients are reviewed before implementation; fresh consent is obtained where necessary. Contact support.