Privacy Policy for the "HeroDay" Mobile Application
1. General Provisions1.1. This Privacy Policy (hereinafter referred to as the “Policy”) applies to all users who have downloaded, installed and/or use the HeroDay application (hereinafter referred to as the “Application” or the “Service”).1.2. Use of the Application constitutes the User’s unconditional consent to the terms of this Policy and to the processing of personal data in the manner and under the conditions set out in this Policy, in accordance with the Law of the Republic of Kazakhstan “On Personal Data and Their Protection” No. 94-V dated May 21, 2013.1.3. If the User does not agree with the terms of this Policy, the User must stop using the Application.1.4. The rights holder of the Application and the person processing the User’s personal data (hereinafter referred to as the “Operator”) is Vladislav Olegovich Kobzev, an individual authorized to manage the Application, interact with users during their use of the Application, provide user information support, and perform other actions related to the use of the Application.1.5. The Operator has the right to make changes to this Policy. The new version comes into effect from the moment of its publication or after existing Users have been notified. If the User continues to use the Application after changes have been made to the Policy, this means that the User has accepted such changes.2. Terms and DefinitionsUser – an individual who accepts the terms of this Policy and uses the Application.Personal Data – any information relating to the User, including name, date of birth and age, email address, contact phone numbers and other personal data that the User provides during registration or while using the Application.Processing of Personal Data – the collection, recording, organization, storage, modification, retrieval, use, transfer, anonymization, deletion and/or other actions performed with personal data.3. Data Collection and Processing:Depending on the features the User chooses to use, the App may collect and process the following data:– Registration data: nickname/name, password, email address;– Profile data: information voluntarily provided by the User in their profile;– Technical device data: device type, operating system, device identifiers, App version, and, where necessary for the proper functioning of the App, certain metadata such as login date and time and session duration;– App usage data: User activity within the App, including completed tasks, achievements, in-game balance, purchases made with in-game currency, and other data required for the proper operation of the in-game logic;– Subscription and purchase data: subscription status, activation/renewal date, and transaction identifier (Transaction ID). The App does not collect or process payment data, including bank card numbers or billing details. All payments are processed securely through the built-in payment mechanisms of the App Store (Apple Inc.) and Google Play (Google LLC);– Health and physical activity data, where the User has provided explicit permission: a limited set of data from system sources, such as Apple Health or Health Connect. When the free version of the App is used, such data is processed locally. When a paid subscription that includes the “Auto Buffs” feature is activated, physical activity data, including steps, workouts, and sleep parameters, may be transmitted to the server in encrypted form solely for the automatic calculation and activation of in-game effects;– Where necessary, other data voluntarily provided by the User through the App’s functionality, for example when contacting support.Important: The App may allow the User to purchase a paid subscription and access premium features through the built-in payment mechanisms of the App Store (Apple Inc.) and Google Play (Google LLC). The App does not collect or process the User’s payment data, including bank card numbers or billing details. The in-game store operates using in-game currency called “CR”.4. Purposes of Personal Data Processing:The Operator processes the User’s personal data for the following purposes:– To provide and maintain the proper functioning of the App, including registration, user profile, skill system, in-game store, statistics, achievements, progress saving, and the activation of in-game effects and buffs based on the User’s physical activity;– To communicate with the User, including notifications, support, and important service messages;– To improve the quality of the App, including debugging, usage analysis, detection and correction of errors, development of new features, analytics, and statistics;– To comply with legal obligations and ensure the security and protection of the App and User data;– To provide paid services and premium features, including the automatic activation of in-game effects (“Auto Buffs”) based on integration with physical activity monitoring systems;– To create and display an in-game leaderboard showing the weekly experience points earned by Users of the App;– For any other purposes for which the User has provided separate consent.5. Procedure, Legal Grounds, and Principles of Processing 5.1. Personal data is processed on the basis of the User’s consent, which the User provides by accepting this Privacy Policy.5.2. Personal data is used solely for the purposes stated in this Privacy Policy.5.3. Access to personal data is granted only to authorized persons. Such information is not disclosed to third parties except in the following cases:where the User has provided consent to such disclosure;where such disclosure is required by applicable law.The App uses secure server infrastructure and cloud solutions to ensure uninterrupted operation and data storage. The server side of the Service is deployed on server capacity, whether owned or leased, located in a secure data center that provides a high level of encryption and data security.5.4. Specific Features of Data Processing in HeroDay When Using Premium Features:Auto Buffs: When the “Auto Buffs” feature is enabled as part of a paid subscription, the App synchronizes health-related data, including steps, sleep, and workouts, with the App’s server in order to automate the gameplay process. Only aggregated technical indicators required to generate in-game bonuses are transmitted.Leaderboard: The User’s in-game progress, namely the public nickname/name and the total number of experience points earned during the week, is visible to other App participants and displayed in the general leaderboard. Health data, including specific step counts or sleep hours, is not displayed in the leaderboard and is not disclosed to third parties.6. Rights and Obligations of the Parties6.1. The User has the right to: 6.1.1. Receive information about what data is being processed, for what purpose, and to whom it may be transferred;6.1.2. Request clarification, updating or supplementation of their personal data if it has changed;6.1.3. Request the termination of processing and/or deletion of their personal data if it is no longer required for the stated purposes;6.1.4. Withdraw their consent to the processing of personal data, which also contributes to the deletion of information about the User not only from the Operator’s archival sources, but also from the Application’s profile settings and game achievements;6.1.5. Submit a request or complaint regarding the Operator’s actions related to the protection of personal data.6.2. The User is obliged to:6.2.1. Provide the personal data necessary to use the mobile Application and website;6.2.2. Update or supplement the personal data provided if such information changes.6.3. The Operator is obliged to:6.3.1. Use the information received solely for the purposes specified in Section 4 of this Privacy Policy;6.3.2. Keep confidential information secure, not disclose it without the User’s prior written permission, and not sell, exchange, publish or otherwise disclose the User’s personal data, except as provided in Clause 5.3 of this Privacy Policy;6.3.3. Take precautions to protect the confidentiality of the User’s personal data in accordance with the procedures generally used to protect such information in standard business practice;6.3.4. Block personal data relating to the relevant User from the moment of receiving a request from the User, their legal representative or the authorized body for the protection of the rights of personal data subjects for the period of verification, if inaccurate personal data or unlawful actions are identified.7. Liability of the Parties 7.1. If the Operator fails to fulfill its obligations, the Operator shall be liable for damages caused to the User in connection with the unlawful use of personal data, in accordance with the legislation of the Republic of Kazakhstan.7.2. In the event of loss or disclosure of Confidential Information, the Operator shall not be liable if such confidential information:7.2.1. Became publicly available before its loss or disclosure;7.2.2. Was received from a third party before it was received by the Operator;7.2.3. Was disclosed with the User’s consent.8. Data Storage and Deletion 8.1. Personal data is stored no longer than necessary for the purposes for which it was collected.8.2. Once the data loses its relevance or there is no longer a need to store it, it must be anonymized or deleted. This may apply both to user accounts and to additional metadata.8.3. Users’ personal data is stored on servers physically located in Finland.8.4. Data Transfer Features (Proxying): To ensure security, protect against DDoS attacks and improve the performance of the Application, including route optimization, traffic may pass through intermediate proxy servers and distributed edge computing nodes.This means that during transmission, data may temporarily pass through technical gateways located in various regions where the infrastructure provider operates before being recorded on the main server in Finland.Technical logs on such nodes may contain the IP address and device metadata, which are used exclusively for network security purposes.9. Policy Updates 9.1. The Operator has the right to make changes to this Policy.9.2. In the event of significant changes, Users will be notified through in-Application notifications and/or by email.9.3. The new version of the Policy comes into effect from the moment of its publication.10. Contact Information IIf the User has any questions, comments or complaints regarding the processing of personal data, the User may contact the Operator using the following contact details: gavltgameapp@gmail.com 