Privacy Policy.

1. Introduction

This Privacy Policy describes how personal data is processed when you use the Shaolin Soccer game service: the website https://shaolin.soccer, the game application https://go.shaolin.soccer, the Telegram Mini App, and the Telegram bot @shaolin_go_bot (together, the “Game”).

The policy follows the EU GDPR, UK GDPR, California CCPA/CPRA, and — for users in the Russian Federation — Federal Law 152-FZ “On Personal Data”.

Data controller: Individual Entrepreneur Igor Samokhin, identification number 300481075, registered by the LEPL National Agency of Public Registry of Georgia; brand Shaolin Toys. Privacy requests: legal@shaolin.toys. Game support: support@shaolin.toys.

The Game is linked to physical Shaolin Toys collectible figures: scanning the authentication QR code on a figure’s sole unlocks the matching digital character. Sales of physical figures are governed by the separate privacy documents of https://shaolin.toys.

By using the Game you acknowledge that you have read this Policy. If you disagree, please stop using the Game.

2. Information We Collect

2.1. Authentication data (depending on your sign-in method):

• Telegram sign-in: your Telegram account identifier and name, as provided by the platform;
• Google sign-in: email address and name from your Google account;
• guest access: a device/session identifier only, without personal data.

2.2. Game data: progress (levels, skills, in-game currency, inventory, completed tasks), action history, linked digital characters, activation status of figure QR codes.

2.3. Purchase data: identifiers and amounts of in-game purchases processed by the payment provider [payment provider — to be filled]. We do not collect or store full bank card details.

2.4. Technical data: IP address (anonymized for analytics where required), device type, OS, browser or Telegram client version, date/time of access, session history.

2.5. What we do NOT collect: full card numbers (handled by PCI DSS-compliant providers); biometric or health data; data about your beliefs; cryptocurrency wallet addresses, private keys, or seed phrases — the Game does not require them, and digital items have no monetary value.

3. Purposes and Legal Bases

• authentication and game session (performance of the user agreement);
• storing and synchronizing progress (performance of the user agreement);
• processing in-game purchases and support (contract; legal obligations for fiscal records);
• binding digital characters via figure QR codes — fraud and duplicate-activation prevention (legitimate interest);
• security and anti-cheat (legitimate interest);
• anonymized analytics (legitimate interest, IP anonymized);
• transactional notifications (contract);
• marketing — only with your separate explicit consent, withdrawable at any time.

Processing for other purposes does not occur.

4. Data Sharing

We share data only as necessary:

• Telegram platform (Telegram FZ-LLC / Telegram Messenger Inc.) — when using the Mini App or bot, under Telegram’s privacy policy;
• Google — limited to what the Google sign-in service provides;
• the in-game purchase payment provider [to be filled] — purchase ID and amount; card data stays with the provider under PCI DSS;
• analytics services (IP anonymized) and hosting provider [to be filled];
• shipping carriers and fiscal operators — only for physical figure orders (see shaolin.toys documents).

We do not sell personal data and do not transfer it to data brokers or advertising networks.

5. International Transfers

The Game’s infrastructure, including the Telegram platform, may be located outside your country. For personal data of Russian Federation citizens, recording, storage and retrieval are performed using databases located within the Russian Federation (Part 5, Art. 18 of 152-FZ); hosting provider: [to be filled].

For transfers from the EEA/UK to countries without an adequacy decision we rely on Standard Contractual Clauses or other applicable safeguards; a copy may be requested at legal@shaolin.toys.

6. Data Retention

• account and progress data — for the lifetime of the account, deleted within 30 days of account deletion unless law requires longer;
• purchase records — for periods required by applicable tax law;
• QR activation statuses — for the lifetime of the account (fraud prevention);
• analytics cookies/identifiers — no longer than 12 months.

Upon expiry, data is securely deleted or irreversibly anonymized.

7. Your Rights

Depending on your jurisdiction: access, rectification, erasure, restriction, portability, objection (incl. profiling), withdrawal of consent (GDPR Arts. 15–21; UK GDPR); rights to know, delete, correct, opt out of sale/sharing, limit sensitive data (CCPA/CPRA — we do not sell or share); rights under Art. 14 of 152-FZ for users in Russia, including complaints to Roskomnadzor (https://rkn.gov.ru).

Requests: legal@shaolin.toys. Response: 10 business days (152-FZ, extendable by 5); 1 month (GDPR, extendable by 2); 45 days (CCPA, extendable by 45). You may also complain to your supervisory authority (EEA: edpb.europa.eu; UK: ICO; California: CPPA).

8. Data Security

• TLS 1.2/1.3 encryption in transit (HTTPS);
• role-based access control, least privilege;
• protection against SQL injection, XSS, CSRF; access logging and incident monitoring;
• server-side validation of game operations (protection against client-side spoofing);
• payment data never stored on our servers (PCI DSS on the provider side).

No system is completely secure; we take reasonable precautions but cannot guarantee absolute security.

9. Children

The Game is intended for users aged 14 and over (in line with the brand’s product rating). In-game purchases are available to users 18+ or with verifiable parental/guardian consent. We do not knowingly collect data from children below the applicable threshold; contact legal@shaolin.toys and we will delete it without undue delay.

10. Cookies and Analytics

The web version uses cookies for session management and anonymized analytics. Disabling cookies may affect functionality. Anonymized data is not personal data.

11. Changes to This Policy

A new version takes effect upon publication on this page. Material changes (new purposes, data categories, recipients) are communicated at least 14 days in advance.

12. Contact

• Game support: support@shaolin.toys
• Privacy requests: legal@shaolin.toys
• Telegram bot: @shaolin_go_bot