NeRambler privacy policy

1.1This policy describes how the Provider (the operator named in the “Provider” block) processes personal data of visitors of beta.nerambler.com/en, cabinet account holders, closed beta applicants and authors of abuse reports.

1.2It also describes how we handle data customers keep in their panels: there the customer is the operator (controller) and we act on its behalf.

• Cabinet account: email address, password as a one-way hash (scrypt), name or nickname (optional), interface language, phone (if you verify one), records of accepted documents — version, time and IP address.
• Panels and payment: addresses and plans of your panels, balance, invoices, amounts and payment statuses. We do not receive card data: the payment provider handles it.
• Security: IP address and browser details (User-Agent) of active sessions, the account event log (sign-in, password change, panel actions).
• Support requests: the correspondence and whatever you attach.
• Abuse reports: the report text, links to evidence and a contact for the answer, if you leave one.
• Closed beta application: name or nickname, Telegram or email contact, platforms, what you sell, approximate volume, chosen plan and free text if you filled it in.

• To conclude and perform the agreement: create the account and panels, take payment, notify you of deadlines and changes.
• To protect accounts and the Service: verify email and phone, limit password guessing, investigate incidents and abuse.
• To answer requests, applications and reports.
• To keep accounting and tax records.

3.1We send no marketing mail, do not sell data and do not use it for profiling.

4.1Proposed bases (to be confirmed by the lawyer): performance of an agreement you are party to (cabinet data, payment, support); consent (beta application, optional fields); legal obligations (payment records, answers to authorities); the legitimate interest in protecting the Service (security logs, abuse reports).

5.1In panels customers keep data of their users and accounts: mailbox logins and passwords, access tokens, Steam Guard files (maFile), proxies, message details and the buyers’ sign-in log (IP address, country, time).

5.2The customer is the operator of that data. We process it only to run the panel, under the instruction in the public offer, and never for our own purposes.

5.3Each panel has its own database and its own encryption key. Passwords, tokens and maFiles are stored encrypted (AES-256-GCM). We do not enter a panel without its owner’s explicit permission.

5.4If you bought an account and want to learn about or delete your data in the seller’s panel, contact the seller. If that does not work, write to us and we will forward the request.

6.1The site, the cabinet and the cabinet database run on servers in Russia.

6.2Panels and their backups run on servers in the Netherlands (Amsterdam), because panel services need to reach Steam and Telegram. For panel data this is a cross-border transfer.

6.3A closed beta application arrives as a message in the team’s private Telegram chat, whose servers are outside Russia. By sending the application you agree to this transfer. The site itself does not keep the application and holds the sender’s IP address in memory for at most 20 minutes for spam protection.

• Hosting providers whose servers run the Service.
• The mail provider that sends codes and notifications.
• Payment providers: what a payment and its receipt need.
• Telegram: beta applications and, if you connected one, your panel bot’s notifications.
• Google Safe Browsing: panel addresses only, no personal data.
• Authorities: only on a lawful request.

• Account: while it exists; after closing we delete it within 30 days, except data the law requires us to keep longer.
• Payment documents: for the periods set by accounting law.
• Sessions: until sign-out or up to 30 days; the security event log: at most 3 years.
• Panel data: while the panel exists; a deleted panel leaves the backups within 30 days.
• Beta application: until the closed beta starts plus 6 months, but at most 18 months from the application date.
• Abuse reports and support correspondence: at most 3 years.

9.1We use only necessary cookies: the cabinet session cookie (HttpOnly, not readable by scripts). Your chosen theme is kept in the browser’s local storage.

9.2The site has no counters, analytics or advertising trackers.

• Encrypted connections (HTTPS) and encrypted secrets in the databases.
• A separate database and key per panel; the cabinet has no access to panel databases.
• Staff sign in with a password and a one-time code, their actions are logged, and irreversible actions need a second key’s confirmation.
• Daily encrypted backups and regular restore drills.
• Timely security updates.

11.1You may learn what data of yours we process, have it corrected or deleted, withdraw consent and export your panel’s data.

11.2Write to support (beta.nerambler.com/en/support) or to the operator’s contact. We answer within 10 business days. You may also complain to Roskomnadzor, the Russian data protection authority.

12.1A new edition is published on this page with a new version number and date. We tell account holders about material changes by email.