Privacy and personal data policy

1. Operator and scope

The personal data operator for visitors to tonight.avlinegames.com is Nikulina Vlada Andreevna (Никулина Влада Андреевна), Russian taxpayer number (ИНН) 500512515013, a self-employed individual applying the Professional Income Tax regime (the Operator). Contact for data enquiries: avline797@mail.ru.

This policy covers using the game, contacting the Operator and purchasing access. Purchase and refund conditions are in the purchase terms. Visiting the website alone does not constitute consent to advertising or to every form of data processing.

2. Data used

• Game and browser preferences. Your language, category, favourite and current playlist card numbers, position and viewing state are stored locally on your device. You do not need to enter answers or information about your partner; the game does not record these. Preferences do not automatically sync between devices.
• Website operation. When pages load, the hosting platform may process IP addresses, request time and address, browser and device information, and technical errors to deliver pages, operate the service and protect it. The game itself loads no third-party analytics or advertising scripts and does not request precise location.
• Support requests. If you email the Operator, the contact details and message you provide are used, together with information needed to locate an order where relevant. Avoid sending personal answers to game questions, documents or other unnecessary information.
• Orders and access. For YooMoney orders, the Buyer’s email address is used to deliver access and the tax receipt and provide purchase support. Orders use a random order number, payment method, price region, amount, currency, receiving details, supplied operation reference / TXID, and verification dates and statuses. The Seller verifies incoming YooMoney transfers and cryptocurrency payments manually. A supplied operation reference or transfer declaration does not itself confirm payment. Protected records of one-time links and sessions are stored on the server; access secrets are stored as cryptographic hashes. An HttpOnly access cookie is necessary to check entitlement to the full deck. This site does not collect card answers or payment screenshots; you send screenshots directly through your chosen contact channel.
• Owner access and protection. Owner sign-in through ChatGPT provides the site with the owner account ID and email. Buyers do not need this sign-in. Short-lived request counters with a hashed technical identifier limit abuse; raw IP addresses are not stored in those counters.

Once payment is connected, bank card details are entered on the payment provider's page. The Operator does not request CVC/CVV codes, banking passwords or one-time codes. Do not email them.

Partner program. Registration and program operation use the partner’s name or nickname, email, random public code, private-dashboard secret hash, accepted terms date and version, order attribution, verified receipts, rewards, refunds and payout amounts, request dates and statuses, and verified payout references. The partner dashboard does not disclose buyers’ names, emails, payment receipts or secret access links. Necessary details supplied by the participant to the Seller are used for communication and payout arrangements. The browser processes the private dashboard link and keeps its secret in tab memory (sessionStorage); the server receives it to check access but stores only its hash. No separate advertising cookie tracks referrals: the code in the link address is passed at checkout. Program data is processed to perform accepted terms, prevent misuse and settle payouts; retention follows the need to fulfil obligations, handle claims and meet applicable recordkeeping duties.

3. Purposes and legal grounds

Local preferences support your language choice, progress and favourites. Technical information supports page delivery and security. Support correspondence is used to respond, provide help and resolve the visitor's request. Purchase information is used to enter into and perform the contract, verify payment, provide and restore access, keep transaction records and handle refunds.

Legal grounds include steps requested by the visitor before entering into a contract, performance of a contract, applicable legal duties and, where required by law, separate consent. Processing needed for operation and security is limited to what is necessary, must have an applicable legal ground and must respect visitor rights. Data is not used for advertising mailings, sold to advertisers or used to build an advertising profile.

Where the law requires consent for particular processing, it is requested separately before that processing. Choosing not to purchase or contact the Operator does not prevent access to the free cards. The free game does not require your name, email address number.

Payments through lava.top. When this method is selected, the server sends lava.top the buyer email, product offer ID, amount, currency, payment-message language and the website return address with a random order number. Verification receives the invoice ID, status, amount, currency, fee and buyer email. The order-page secret, persistent access cookies, partner codes and manual activation links are not included in invoice creation. Card details are entered on the payment service page and are not stored by this website. Necessary payment identifiers and verification results are saved with the order. The random order-page secret is held in tab storage (sessionStorage) and, for automatic checkout, in a necessary secure HttpOnly cookie and this website’s localStorage for up to seven days. This restores a purchase when a banking app returns to the home page or a new tab in the same browser. The local copy is removed after the full deck is successfully opened, or on the next check after expiry; clearing this website’s data also removes it. The server verifies the secret and confirmed payment; an order number alone grants no access. The secret is not sent to the payment provider. For automatic return after payment, lava.top receives a separate random one-use handoff in the successful return address. It lasts up to seven days, is stored on the server only as a hash, and can open only the game after confirmed payment is verified. It cannot read buyer emails or payment details or manage orders. Once used, it cannot issue new access in another browser. Service terms: lava.top.

4. Processing and recipients

Processing may include receiving, recording, storing and using data for the stated purposes, correcting it, restricting access and deleting it. Local game preferences are processed by your browser. Enquiries pass through the email service or messenger you choose; website requests, orders and access records pass through the hosting platform. External services process data under their applicable rules. When seller email alerts are enabled, FormSubmit (formsubmit.co) sends operational alerts to the Seller containing the random order number, amount, currency, payment-declaration status and shop administration address. These alerts do not include the Buyer’s email, payment operation reference, receipt or secret access link. An alert is not proof that funds were received.

Access is limited to what is needed to operate the website, answer requests and fulfil orders. Hosting, email and, once connected, payment providers may receive only information necessary for their functions, on a lawful basis and subject to applicable processing conditions. When YooMoney or another configured method is used, payment information is processed by the relevant payment provider and participants in the transaction under their rules, which will be available before payment is confirmed. Disclosure to public authorities is made only on grounds provided by law.

Links to external payment pages open services with their own privacy rules. This policy does not govern processing those services carry out independently.

To record a sale, the Seller sends the information required by law to the Russian Federal Tax Service through the My Tax application and delivers the receipt to the Buyer through the agreed contact channel. This website does not generate tax receipts automatically.

5. Retention, protection and deletion

Language, progress and favourites stay in your browser until you or the browser delete this website's data. You can remove favourite cards in the Saved section. To remove all local preferences and progress, clear this website's data in your browser settings. This does not delete correspondence or purchase records. After clearing this website’s browser data, a verified purchase can be restored for free using a new activation link. A browser access session lasts up to one year and may be restored; the purchase remains one-time, without a subscription. Unused activation links last seven days; request protection counters stop being used within two hours of creation and are deleted while subsequent requests are processed.

Support correspondence is retained for the time needed to answer and resolve the request, then deleted or anonymised unless the law requires further retention. Purchase and refund records are retained for periods required for transactions, tax records and lawful claims. Where consent is the only ground, withdrawing it ends that processing and leads to deletion when there is no other lawful ground for retention.

Deletion, correction and cessation of processing follow applicable legal deadlines. The hosting platform processes technical information within its functions and applicable rules. The Operator takes necessary organisational and technical measures within their responsibility, restricts access and does not publish support correspondence. No internet transmission offers an absolute security guarantee; avoid sending unnecessary sensitive information.

6. Your rights and requests

You may request information about processing of your data, its purposes, grounds, categories, recipients and retention; request correction of inaccurate information, restriction or deletion where there are legal grounds; withdraw consent where processing relies on it; and challenge the Operator's actions before the competent authority or a court.

Email avline797@mail.ru with the subject “Personal data”. Include a reply contact and enough information to locate your correspondence or order, such as the email address used and order number. To avoid disclosing data to someone else, the Operator may request reasonable proof that the data belongs to you. Do not attach a passport or full card details without a justified need.

The response is provided within applicable legal deadlines. If mandatory retention or another lawful reason prevents full completion of a request, the response explains the grounds. Deleting information needed for a particular order may prevent its performance, without restricting rights preserved by law.

7. Policy changes

The current version remains available at this address. Material changes to purposes, data categories and processing are published before new processing starts, with separate consent requested where needed. The Russian text is the primary version. This English translation is provided for convenience and does not limit visitors' mandatory rights.

8. Operator details and contact