Privacy Policy

Version of 22 October 2026

1. Who processes the data

The controller is the owner of the Karma VPN service, an individual registered as a self-employed taxpayer (the "Controller"). Contact on data questions: support in the bot @karma_vpnbot. Full details of the Controller are provided on request.

2. What data we process and why

• Telegram data: account ID, name and username, interface language. To issue your key, recognise you and send notifications.
• Subscription and payment data: plan, dates, payment history (amount, date, method, payment number in Telegram or Crypto Bot). To extend your subscription, handle payment questions and keep tax records. We do not receive card or wallet details.
• Donation data: amount, method, date, payment number. To credit the donation to the Jar, keep records and fix payment errors. We do not publish who donated or how much.
• Gift data: who bought a gift and who accepted it (Telegram ID and name). The buyer sees the recipient's Telegram name once the gift is accepted.
• Device data: technical device identifier (HWID), model and operating system. To enforce the device limit.
• Technical connection data: connection IP address and traffic volume. Kept for no more than 7 days to protect the Service from abuse and key sharing.
• Answers to "Is everything working?" and support messages: carrier, network type, text of requests. To help you and improve the Service. Support messages are kept for 12 months.
• Referral data: who invited whom. To credit bonus days.
• Language: the language you chose in the bot or the Mini App. To show texts in it.

3. What we do not do

• We do not log which websites you visit and do not store the content of your traffic.
• We do not sell data or share it with advertisers.

4. Legal bases

Performance of the agreement (the offer) you enter into when you start using the Service; our legitimate interest in protecting the Service from abuse; legal obligations (tax records). News messages are sent with your consent, and you can turn them off in the Mini App profile.

5. Who receives the data

• Telegram and Crypto Bot — as needed for payments and the bot to work.
• Hosting providers of our servers (Finland, Georgia). Data may be processed outside your country; we use providers that apply security measures appropriate to the data.
• Government authorities — only on a request based on law.

6. How long we keep data

Account and payment data — while you use the Service and 3 years after the last payment (tax records). IP addresses — no more than 7 days. Support messages — 12 months. Backups — 14 days.

7. Your rights

You can ask what data we hold about you, get a copy, correct it, object to processing, withdraw consent to news messages or delete your account. Write to support in the bot; we reply within 30 days, usually much faster. Payment data needed for tax records is deleted after the retention period ends. If you live in the EU, you may also complain to your local data protection authority.

8. Security

Servers are accessible only with keys, data is transmitted encrypted, backups are encrypted, and only the Controller has access to the database.

9. Changes

A new version is published on the website, and we announce changes in the bot. This policy is published in Russian and English; if the texts differ, the Russian version prevails.