Privacy policy

1. Who is responsible for your data

The controller is Individual Entrepreneur DMYTRO STAMIKOV, registration number 304795194, at Georgia, Tbilisi, Krtsanisi district, Ponichala 3 settlement, building 5, entrance 2, floor 4, auxiliary storage room. For privacy requests, write to d@opthai.land. You can contact us without an account.

This policy covers the website, the digital guide, support and our administration of the Telegram club and partner programme. It does not replace the privacy notices of independent platforms you use.

2. What we collect and where it comes from

You provide your email, name, profile picture, password, messages, proposed places and photos, and any details needed for an order or partner payout. Passwords are stored as hashes. We also keep favourites, account settings, notices, order amounts and statuses, referrals and support history.

When you use the site, we receive your IP address, browser and device information, browser languages, an approximate country, device identifier hashes, session details and records of relevant actions. Hashing identifiers does not make these records anonymous. Country lookup uses a local MaxMind database; this lookup does not send your IP address to MaxMind.

A payment provider you choose may supply transaction status. If Google sign-in is available and you select it, its requested sign-in permissions cover an account identifier, email, name and profile picture. Do not send passwords, full card details or unnecessary sensitive information in support messages. Map coordinates for places are not, by themselves, your device's GPS location.

3. Why we use this information

We use account, order and communication data to fulfil your order, provide the guide and club access, restore access, answer requests and operate the partner programme. Necessary processing rests on the contract or steps you request before entering it. Without the required email and account information, we cannot provide personal access.

We use technical records to protect accounts, detect misuse, investigate failures and substantiate claims, based on legitimate interests in security and reliable service, balanced against your rights. Legal obligations can require retaining transaction records or responding to lawful requests.

Optional analytics and referral tracking are off until you consent to the corresponding category in cookie settings. You can refuse either category or withdraw consent there at any time. Accepting the terms or reading this policy is not consent to these purposes; withdrawal does not affect earlier lawful processing.

The news subscription is off by default. In account settings you can explicitly enable or disable it; we save your selected preference. We do not currently send promotional newsletters. Service messages about your account or purchase are separate from this subscription.

4. Services involved in processing

Namecheap provides domain registration, the TLS certificate and Stellar Plus shared hosting for this site, as well as our separate Private Email service. Our website and database are hosted in Singapore. Email correspondence and service messages are handled through Private Email, whose servers Namecheap identifies as being in Phoenix, United States. Namecheap's published Data Processing Addendum describes its processing of hosted customer data on the customer's behalf.

Authorised administrators can access information needed for support and operation. Payment providers selected through an available checkout receive the information necessary for payment and provide us with its result; their own legal and security obligations may make them independent controllers.

The site loads Google Fonts. Maps use Google Maps when configured, or OpenFreeMap; place search sends queries to Komoot's Photon service. These external requests can disclose IP addresses and browser information to the relevant provider. If Google Analytics or Google Tag Manager is configured, their resources load only after analytics consent and may then receive browsing and interaction information as described in the cookie policy.

The site automatically checks Gravatar for an avatar using a SHA-256 hash of your email address. If an image is available, your browser loads it from Gravatar. The hash can be associated with your email and is not anonymous; image loading also discloses connection information. These functions are separate from choosing a Google sign-in option.

Namecheap Data Processing Addendum (DPA)

5. Visibility and international processing

Telegram membership requires a Telegram account. Telegram processes data under its own rules; other club members may see your profile and messages according to your settings and the platform's functions. Club administration uses the information needed to check access and moderate the group.

If you submit a place or photo for publication, accepted content becomes visible to guide users, with attribution according to the submission options. Partners can see referral and purchase information relevant to their rewards, including a masked email, country, date, amount and status. Masking an email does not guarantee anonymity. We may disclose necessary information to advisers, authorities or parties to a dispute where there is a lawful reason.

We are established in Georgia. The processing described above includes Singapore and the United States; other listed services may process data in additional countries. Backup and support locations can differ from the website's hosting location. Namecheap's published Data Processing Addendum permits processing in the United States and includes standard contractual clauses for transfers within its scope. Contact d@opthai.land for information about recipients, processing countries and the safeguards applicable to your data.

6. Retention and account deletion

Account and access records are kept while needed to provide your access. For support, submissions, referrals, invitations and technical records, relevant criteria include the purpose, activity, unresolved requests, security needs, applicable limitation periods and legal retention duties. There is no single deletion period covering every category.

The application's scheduled cleanup removes ended sessions after 90 days and journal entries after 90 days without a recurrence. It also removes technical identity records created more than 90 days ago and unused for more than 90 days once no account, session, order or other application record refers to them. An identity still linked to a retained record follows that record's retention needs. Cookie lifetimes are listed separately. A cookie expiring does not delete related server records.

You can request account deletion in account settings or by email. The account procedure includes email confirmation and a seven-day cancellation period; unresolved partner balances or payouts may prevent automatic completion. Contact us in that case so your data request can be considered separately.

Deleting an account removes its active profile and various related records, but does not immediately erase every copy. Transaction and payout records, necessary dispute evidence, correspondence, technical identities and backups may remain. Retention must be limited to what the relevant purpose or obligation requires; a financial record does not justify keeping all other personal data indefinitely. We explain any restriction affecting your request.

Hosting and email backups are governed by the terms of the respective Namecheap services. Backup contents, frequency, retention periods and limits are described in the AutoBackup documentation and Private Email terms linked below. Deleting active data does not mean immediate deletion from backups.

• Hosting backups — Namecheap AutoBackup
• Namecheap Private Email terms, including backups

7. Your rights

Depending on applicable law and the circumstances, you can request information and a copy of your data, correction, deletion, blocking or restriction, portability, or object to processing. You can withdraw consent where processing relies on it and request human review where legally protected from solely automated decisions. These rights have legal conditions and exceptions.

You may complain to Georgia's State Audit Office, which supervises personal data protection, or seek a judicial remedy. Where the GDPR applies, you may also complain to the competent supervisory authority, including in your habitual residence, place of work or place of the alleged infringement. Contacting us first is not a condition for complaining.

8. How to make a privacy request

Write to d@opthai.land, identify the account or correspondence concerned and describe your request. We may ask for only the information reasonably needed to verify identity or clarify the request. A passport copy is not required by default.

We follow the applicable statutory deadline. Georgian information and access requests normally have a 10-working-day deadline, with a justified extension of up to 10 working days and prompt notice where permitted; notification of a blocking decision has a three-working-day deadline. Other rights have their own statutory rules.

Where the GDPR applies, we respond without undue delay and within one month; a necessary extension of up to two further months for complexity or number of requests is explained within the first month. A shorter applicable deadline remains effective. These legal deadlines apply independently of ordinary support response times.

9. Security and changes to this policy

The application uses password hashing, protected session cookies and access checks. Keep your credentials and confirmation links private and tell us about suspected unauthorised access. No transmission or storage system can guarantee absolute security.

The dated version on this page describes the policy in effect. Material changes are published here and, where required, communicated directly. A policy update does not itself create consent for a new purpose.