Privacy policy

1. Data controller

The data controller is Individual entrepreneur Zolotarev Mikhail Igorevich (INN 773319471109) — for the data of the business owners who use the service. Data-protection contact: support@get5stars.ru.

For guest data left in the Prize Wheel mechanic, the controller is the owner of the location that displayed the QR code: they determine the purposes of processing and obtain the guest’s consent. get5stars processes such data solely on that owner’s instruction (part 3 art. 6 of 152-FZ) on the terms of section 8 of the public offer, and does not use it for its own purposes. The location owner is liable to the guest as a data subject; a guest with a question about their data should contact them. The owner’s legal name and INN are shown to the guest when the phone number is requested and in the promo rules.

2. What data is processed

• Business-owner data: name, email, phone, Telegram id — for sign-up, login and notifications.
• Location and subscription data: map-listing links, settings, payment history.
• Guest data in the Prize Wheel (processed on the location owner’s instruction, see 1): phone and name if the guest provides them and consents; the rating and text of the review; details of the prize issued; the date and time of participation.
• Technical data: session cookies and service logs needed for the site and account area; once the visitor consents, analytics cookies (Yandex Metrica, Google Analytics) and marketing cookies (Meta Pixel) — see section 9.
• First-touch attribution: campaign labels, the shortened address of the referring page and the moment of first visit — this record falls under the «Necessary» category and is not gated by the cookie banner, see section 9.

3. Purposes and legal basis

Data is processed to provide the service (performance of the agreement), send notifications, take payment and issue fiscal receipts (54-FZ), and support users. Data is not sold to third parties and is not used for third-party advertising.

4. Sharing with third parties

To provide the service, data may be shared with infrastructure providers: the acquiring bank JSC «TBank» (payments, receipts; tbank.ru) and Telegram (notification delivery). Sharing is limited to the data needed for that operation.

For visit statistics and advertising-performance measurement — only once the visitor has consented — data is shared with Yandex Metrica, Google Analytics and Meta (Meta Pixel); for session recording in the owner account area and staff console — with Yandex Metrica (see section 9).

5. Storage and deletion

Data is stored on servers in the Russian Federation for the term of the agreement and for the periods required by law (including accounting and tax records). On the owner’s request, the account and related data are deleted, except records the controller must keep by law.

6. Your rights

You may request access to your data, its correction, blocking or deletion, and withdraw consent to processing. To do so, email support@get5stars.ru.

7. Information security

The controller applies organisational and technical safeguards: role-based access control, storing passwords and PINs only as irreversible hashes (Argon2), access over secure channels, regular backups and software updates. Only authorised staff can access personal data, and only as needed for the work.

8. Secure transmission of payer data

All data exchange between the user’s device and the service is encrypted via HTTPS/TLS. Card details are entered on the acquiring bank’s secure payment page and processed on its side under the PCI DSS security standard. get5stars does not receive, see or store the full card number, expiry date or CVV.

9. Statistics, advertising and traffic attribution

The site uses Yandex Metrica, Google Analytics and Meta Pixel — for visit statistics and to measure how well advertising performs. These scripts are not loaded into the browser until the visitor consents in the cookie banner to «Analytics» and/or «Marketing». Consent can be withdrawn at any time — the «Cookie settings» control is in the site footer and on the account settings screen — and withdrawal turns those scripts off.

The owner account area and the staff console also use session recording (Yandex Metrica’s Webvisor) — to understand where the interface is hard to use. Session recording is not run on the public «Prize Wheel» page or on this marketing site; payment screens in the account area are excluded from it.

When a visitor arrives via an advertising or referral link, we store that campaign's labels (utm_source, utm_medium, utm_campaign, utm_content), the address of the referring page — shortened to its host and path, with its query string and fragment discarded before storage — and the moment of the first visit. We add no name, phone number, email address or other contact detail to that record; the parameters of the referring address are discarded, and the record itself is used only to understand which channel a registration came from — not to identify the visitor. This record falls under the "Necessary" category and is not gated by the cookie banner: without it we could never learn the traffic source for visitors who decline analytics.