1. General provisions
This Policy governs personal data processing in connection with the Nexardo website, account, web panel, agent and support. The Operator is the person operating the Service and organising personal data processing.
Processing is subject to Belarusian Law No. 99-Z of 7 May 2021 on Personal Data Protection and other applicable requirements. Data enquiries and subject requests may be sent to admin@nexardo.com.
The Processing on customer instructions section of the Terms of Use also applies to data processed on an organisation’s instructions. The organisation determines lawful purposes for processing its members’ and players’ data.
2. Data categories and sources
The Operator receives data from the User, authorised organisation members, the connected agent and Service features. The data scope depends on the operation performed.
- Account data: name, email address, password hash, verification status, preferences, session records and access-security information.
- Organisation data: members, roles, invitations, worlds, environments, services and nodes.
- Technical data: IP addresses, browser and device information, node characteristics, commands and results, management events, metrics, logs and console messages.
- Enquiry data: message content and attachments supplied by the User.
- Where analytics is allowed: visit and referral information, analytics-cookie identifiers, recordings of interactions with public pages and application-attribution parameters.
3. Purposes and legal grounds
Registration, Free applications, email verification and access: name, email, application details, preferences and access data support entering into and performing the agreement with the User. The contractual ground in Article 6 of Law No. 99-Z applies to data obtained under an existing or proposed agreement with the subject, only for actions provided for by that agreement.
Command execution and access protection: resource, operation, session and technical-event data supports requested features, diagnostics and prevention of unauthorised actions under the agreement. This ground does not automatically cover player or other third-party data: that processing requires a lawful ground and, where relevant, instructions from the Customer.
Support: enquiry data supports replies, problem resolution and obligations to the person contacting the Service. Binding authority demands and statutory retention follow the relevant legal duty. Data is not kept for undefined future purposes.
Google Analytics, Yandex Metrica and application attribution require separate consent. Rejection or withdrawal does not restrict core features. The internal article view counter operates separately, as described below. Accepting the Terms or reading this Policy does not consent to Google Analytics, Yandex Metrica, marketing emails or every international transfer.
Where GDPR applies to particular processing, contract performance is assessed under Article 6(1)(b), a binding legal duty under Article 6(1)(c), and separate consent under Article 6(1)(a). Necessary security measures outside a contractual ground may rely on Article 6(1)(f) only after assessing legitimate interests, necessity and effects on subject rights; this is not an independent ground under Belarusian law.
4. Article views
The internal counter operates for all visitors independently of their external-analytics choice, without cookies, browser storage or a persistent identifier. To suppress repeats, the server computes a secret daily hash of the IP address, User-Agent and specific article. Raw IP addresses and User-Agent values are not stored in article view statistics. This is temporary pseudonymisation, not complete anonymity.
One view is counted per UTC calendar day; translations are counted separately and domains serving the same article share the count. Visitor matching is approximate: a shared IP and identical browser can merge different people, while changing networks or browsers can add a view. Receipts older than 48 hours are deleted hourly, so normal retention can reach 49 hours; scheduler delays can extend it. After cleanup, only daily article totals without visitor identifiers remain. Statistics are available to administrators and are not sent to Google.
5. Recipients and processing locations
Authorised persons receive access only as needed for their functions. Organisation members have access according to assigned roles. Data may be disclosed to public authorities pursuant to a binding lawful requirement.
The primary Service infrastructure and self-hosted mail system run on a VPS in the UAB Interneto vizija network in Lithuania. Cloudflare provides network and external backup services; New Relic provides platform monitoring and technical logging; Google Analytics and Yandex Metrica provide optional public-site statistics. Provider functions and data locations are listed in the next section of this Policy.
Transfers outside Belarus require a ground under Article 9 of Law No. 99-Z. Where transfer consent is required, recipient, country and relevant risk information must be provided before consent is obtained. A storage region does not confine support access or all processing to one country. Other applicable international-transfer rules must also be observed; a cookie-banner choice does not replace necessary transfer safeguards. Provider changes require separate notice, consent or Customer authorisation where required by law or agreement.
6. Providers
- UAB Interneto vizija: the VPS network in Lithuania. Primary databases, self-hosted mail and technical-log stores run on the Service VPS.
- Cloudflare: DNS, HTTP traffic processing and protection for the website, panel and administrative host. Request information is processed across Cloudflare’s global network.
- Cloudflare R2: encrypted backups. The primary backup repository uses EU jurisdiction. An additional repository is in WEUR (Western Europe) without an EU jurisdiction restriction.
- Cloudflare Workers and Durable Objects: independent availability checks, monitoring state and backup receipts, using Cloudflare’s international infrastructure.
- New Relic: platform metrics, process information, system logs and container logs, using the EU region. Category-specific periods are listed in the Privacy Policy.
- Google Analytics: public-site visit statistics where analytics is allowed, using Google’s international infrastructure.
- Yandex Metrica: optional public-site visit statistics, click and link maps, and Session Replay of interactions. It receives technical device and browser information, page addresses, referrals and interaction events. Collection is disabled on private app/admin hosts.
7. User infrastructure
VPS providers, game platforms and storage connected directly by the User operate under the User’s own agreements. The User selects resources, regions and access authority.
Game-world saves remain on connected nodes; backups use User-selected storage. Commands, console output, logs and diagnostics sent to Nexardo are also processed by Service infrastructure.
Email correspondence also reaches recipients’ mail providers under their settings and policies.
8. Retention periods
Account, application and organisation data is processed during application review and Service use only as needed for that purpose. A rejected application does not itself justify indefinite retention. Enquiries and related records are retained during resolution and for any further period needed to perform obligations, resolve a dispute or meet mandatory retention requirements. Data must be deleted or blocked when the relevant ground ends.
The following storage and pruning periods apply to technical data:
- Game and agent logs, raw metrics and one-minute rollups: 90 days; fifteen-minute rollups: 395 days.
- Console-output chunks: seven days from creation; agent task output: 90 days from creation.
- Audit records: 365 days from creation; resolved incidents: 365 days from resolution.
- Log exports: seven days from creation. Expired files and records are included in daily pruning.
- Telemetry usage receipts and aggregates: a 400-day pruning threshold.
- New Relic: logs, 30 days; raw infrastructure events, eight days; infrastructure integrations, 395 days. Raw dimensional metrics are retained for 30 days and rollups for 13 months.
9. Deletion and backups
Technical-data periods describe retention settings and scheduled pruning thresholds. Pruning is periodic and a backlog can extend actual retention. Unresolved incidents are outside the resolved-incident period. Metric-storage deletion may finish after the retention period during background processing. Working-storage retention is not the expiry period of every backup. Retention of accounts, enquiries, mailbox messages and backups depends on the relevant purpose and mandatory lawful retention. These categories are cleared following review of the retention ground; no uniform automated deletion period applies. Information about retention and grounds for specific data is available on request.
Encrypted backups support recovery. When a deletion request is granted, the Operator stops ordinary use of the affected data and excludes it from further processing, including processing following backup restoration, except where a separate lawful ground applies.
Files on the User’s VPS and selected storage remain under their control. Nexardo account deletion does not delete those files. Data-deletion requests may be sent to admin@nexardo.com.
10. Subject rights and requests
Subjects may obtain legally required information about processing and third-party disclosures, correct inaccurate or incomplete data, withdraw consent and request cessation or deletion where lawful grounds are absent. Withdrawal does not end processing supported by another independent lawful ground.
Where Law No. 99-Z applies, processing information is provided within five working days; eligible correction, cessation and deletion requests are handled within fifteen days unless otherwise prescribed by law. Other requests follow their statutory deadlines.
Initial enquiries may be sent to admin@nexardo.com. Consent may also be withdrawn in the form in which it was given; analytics consent may be withdrawn through cookie settings. For other requests, formal applications must meet Article 14 of Law No. 99-Z, be submitted in writing or as an electronic document, and contain the required particulars and signature. Identity verification is limited to what is necessary to resolve the request.
Subjects may challenge the Operator’s conduct before the Belarusian National Personal Data Protection Centre and the courts through the applicable procedure. Additional rights and deadlines under other applicable laws remain available.
11. Other applicable rights and required data
Where GDPR applies to particular processing, subjects may also request restriction, object to processing based on legitimate interests and receive data they supplied in a portable format in the cases provided for by that regulation. Such requests are normally addressed within one month; any permitted extension and its reasons are notified within the required period. Subjects may complain to a competent supervisory authority, including at their habitual residence, workplace or place of the alleged infringement.
Data necessary to create and protect an account or execute a command is required for that feature: email verification requires an email address and an operation requires resource information. Analytics is optional. The Service is not intended for independent registration by people under 18; player data may be submitted only within lawful Customer processing.
If a request cannot be granted, the Operator explains the refusal and available appeal procedure. Account closure and consent withdrawal do not override mandatory lawful retention or authorise unrelated use of retained data.
12. Safeguards and changes
The Operator applies legal, organisational and technical safeguards, limits access by authority and takes measures against unauthorised use. Persons with access must maintain confidentiality.
Changes to processing purposes or conditions are reflected in a revised Policy. Any required subject consent is obtained separately; publication does not replace consent.
Contact
Legal documents, personal data and operator enquiries: admin@nexardo.com.
Abuse, vulnerabilities and incidents: abuse@nexardo.com.