Privacy Policy

OKAK

Version dated 4 September 2026. This is a translation of the Russian-language document. In case of any discrepancy, the Russian version prevails.

1. General provisions

This Privacy Policy (the "Policy") sets out how the OKAK service, available at okak.club (the "Service"), processes and protects information about its users. It has been drawn up in accordance with Federal Law No. 152-FZ of 27 July 2006 "On Personal Data" and other regulations of the Russian Federation.

The Policy covers all data the Service receives about the User while they use the okak.club website, the personal account area at app.okak.club and related client applications.

Before using the Service, the User must read this Policy. Starting to use the Service constitutes the User's consent to the processing of their data as described in this document.

If the User disagrees with any provision of this Policy, they must stop using the Service.

This Policy forms an integral part of the Service's Public Offer.

2. Definitions

Personal data — any information relating directly or indirectly to an identified or identifiable individual (the data subject).

Processing of personal data — any operation performed on personal data, including collection, recording, systematisation, accumulation, storage, updating, use, transfer, anonymisation, blocking, deletion and destruction.

User — a legally capable individual aged 18 or over who uses the Service.

Account — the User's data within the Service, accessed using an email address and password.

3. What data the Service processes

Data provided by the User during registration and use of the Service:

email address — used as a login, to confirm registration, restore access and send service notifications;
password — stored solely as an irreversible cryptographic hash; the Service does not hold passwords in plain text;
Telegram numeric identifier (Telegram ID) and username — only where the User has linked their account to Telegram;
message content and uploaded files — for services involving messaging, to the extent required for their operation and synchronisation across the User's devices;
support enquiries and their content.

Data generated automatically while the Service is used:

subscription details, tariff plans, validity periods and issued access keys;
payment details: amount, date, status, payment identifier at the payment aggregator, and the payment method selected;
the tariff allowance, aggregate traffic usage and available balance — without browsing history or traffic content;
technical logs of requests to the website, personal account and API: IP address, date and time of the request, browser and operating system type and version — for security and troubleshooting purposes; these logs do not relate to VPN connections;
promo code usage and referral programme participation.

The Service does not request or process names, passport details, residential addresses, telephone numbers, income information, special categories of personal data or biometric personal data.

Bank card details and other payment credentials are never received by the Service. Payment details are entered on the side of a payment aggregator compliant with the PCI DSS security standard. The Service receives only the fact, amount and status of the payment.

When the VPN is used, the Service does not create or retain VPN connection logs: the User’s IP address, VPN connection date or time, user agent, addresses of visited internet resources, or transmitted VPN traffic content. Aggregate traffic usage is used only to apply the tariff allowance and contains no browsing history or traffic content.

4. Purposes of processing

Data is processed solely for the following purposes:

registering the User, identifying and authorising access to the account;
performing the agreement: granting access to paid services, issuing and maintaining access keys;
accepting and processing payments and issuing refunds;
sending service notifications: registration confirmation, access recovery, payment and subscription expiry information;
operating technical support and handling enquiries and claims;
operating the referral programme and promo code system;
ensuring the security of the Service and preventing fraud and abuse;
complying with obligations imposed on the Service by the laws of the Russian Federation;
compiling anonymised usage statistics to improve service quality.

The Service does not use the content of User messages to train machine learning models and does not pass it to third parties for that purpose.

The Service does not send marketing communications without separate consent and does not share data with third parties for advertising purposes.

5. Legal grounds for processing

Personal data is processed on the following legal grounds:

Article 6(1)(5) of Federal Law No. 152-FZ — processing is necessary to perform an agreement to which the User is a party;
Article 6(1)(1) of Federal Law No. 152-FZ — the User's consent, given by starting to use the Service and accepting this Policy;
Article 6(1)(2) of Federal Law No. 152-FZ — compliance with obligations imposed on the Service by law.

The Service does not sell User data or share it with third parties for commercial purposes.

Data may be shared only in the following cases and to the minimum extent necessary:

with payment aggregators — to process payments and refunds (the payment identifier and amount are shared; the email address is shared only where an electronic receipt must be sent);
with infrastructure providers (hosting, email delivery) — to the extent required for the Service to operate, subject to confidentiality;
with authorised government bodies — upon a lawful and properly issued request, in the manner prescribed by the laws of the Russian Federation;
where the User has given separate consent.

7. Retention and deletion

User data is retained for as long as the account exists and the contractual relationship with the Service continues.

Payment records are retained for the period prescribed by the laws of the Russian Federation for documents evidencing transactions.

Server log data is retained for no more than 12 (twelve) months from the date it is generated.

The User may at any time request deletion of their account and associated data by writing to support@okak.club or via the Telegram bot @okak_sup_bot. Such requests are fulfilled within 30 (thirty) calendar days of receipt, except for data whose retention is required by law.

After an account is deleted, the Service may retain anonymised statistical data that does not allow the User to be identified.

8. User rights

The User has the right to:

obtain information about the processing of their personal data, including its purposes, methods and retention periods;
request rectification, blocking or deletion of their data where it is incomplete, outdated, inaccurate or unlawfully obtained;
withdraw consent to the processing of personal data;
request that processing cease and data be deleted, which will end the provision of services requiring such processing;
appeal the Service's actions or omissions to the supervisory authority for the protection of data subjects' rights or in court.

To exercise these rights, the User sends a request to support@okak.club from the email address used at registration, or via the Telegram bot @okak_sup_bot. Requests are handled within 30 (thirty) calendar days.

9. Cookies and similar technologies

The Service uses cookies necessary for the website and personal account area to function: maintaining the authorisation session, protecting against cross-site request forgery, and storing language and interface preferences.

The Service does not use third-party advertising or tracking cookies to profile Users for advertising purposes.

The User may disable cookies in their browser settings; in that case, authorisation and some Service functions may become unavailable.

10. Data protection measures

The Service applies legal, organisational and technical measures to protect data against unlawful or accidental access, alteration, blocking, copying, distribution and destruction.

These measures include: TLS encryption of traffic between the User and the Service, storage of passwords solely as irreversible cryptographic hashes, access control across systems, two-factor authentication for administrative access, logging of administrator actions, regular backups and infrastructure security audits.

Data is stored on the Service's protected servers. Access is granted to a limited number of authorised persons, to the extent required to perform their duties and subject to confidentiality.

The User is responsible for keeping their password and access keys confidential. The Service is not liable for the consequences of the User disclosing them to third parties.

11. Data of minors

The Service is intended for persons aged 18 and over and does not knowingly collect data from minors. If a minor is found to have registered, their account and associated data will be deleted.

12. Changes to this Policy

The Service may amend this Policy, including in response to changes in legislation or in the functionality of the Service.

An updated version takes effect once published at okak.club, unless the version itself specifies otherwise. The date of the latest update is stated in each version.

The User is responsible for reviewing the current version of the Policy. Continued use of the Service after a new version is published constitutes agreement to the changes.

13. Contacts

Service: OKAK

Website: https://okak.club

For questions about personal data processing, withdrawal of consent and account deletion: support@okak.club

Support Telegram bot: @okak_sup_bot