Politique de confidentialité

Almaty, as revised on August 17, 2026

Ce document est publié dans sa version anglaise faisant foi. Les traductions sont fournies à titre indicatif uniquement et n'ont aucune valeur juridique.

This Privacy Policy (hereinafter referred to as the “Policy”) has been developed and published by «PLOTEX», Limited Liability Partnership (hereinafter referred to as the “Administrator”, “Operator” or “Controller”) in accordance with the Law of the Republic of Kazakhstan on Personal Data and Protection Thereof, the General Data Protection Regulation (GDPR), the UK GDPR, the California Consumer Privacy Act (CCPA) and other applicable regulations.

The Policy is a publicly available document and is aimed at protecting the rights and freedoms of individuals whose personal data is processed by the Administrator.

Terms and Definitions

Personal data means any information relating to a directly or indirectly identified or identifiable individual (personal data subject).

Operator / Controller (data controller) means «PLOTEX», Limited Liability Partnership (BIN 260840000843), registered address: 2/22 Saken Zhunisov Street, Building 3, Non-residential Unit 92, Shugyla Microdistrict, Nauryzbay District, Almaty 050000, Kazakhstan, which determines the personal data processing purpose and tools.

Personal data subject (User) means an individual whose personal data is processed by the Administrator.

Platform means the website https://plotex.io/ and related services.

User Content means texts, images, interactive stories, novellas and other materials that the User creates and posts on the Platform.

Personal Data Processing means any action or set of actions with personal data, including collection, recording, systematization, accumulation, storage, clarification, extraction, use, transfer, depersonalization, blocking, deletion and destruction.

1.General Provisions

1.1.The Administrator is the personal data controller within the meaning of the GDPR and the UK GDPR, as well as the personal data operator in accordance with the Law of the Republic of Kazakhstan on Personal Data and Protection Thereof.

1.2.The Platform is an interactive computer service within the meaning of Section 230 of the Communications Decency Act (USA) and a hosting provider within the meaning of Article 6 of the Digital Services Act (EU) / Directive on Electronic Commerce. The Administrator does not exercise preliminary control over the User Content and does not act as a publisher.

1.3.The Administrator processes the personal data of user-authors (who create and publish the User Content) and user-readers (who consume content). The Administrator is not responsible for personal data that Users voluntarily disclose in their stories, public profiles, or other the User Content.

1.4.The authors retain the rights to the User Content. The Administrator receives only a simple (non-exclusive) license to use such content for the purpose of operating the Platform in accordance with the User Agreement.

1.5.The Policy applies to all personal data processed by the Administrator in connection with the use of the Platform.

1.6.In case of disagreement with the terms of the Policy, the User may refrain from starting to use the Platform or may cease using it.

2.Purposes and Legal Grounds for Personal Data Processing

2.1.The Administrator may process personal data for the following purposes and on the following legal grounds:

• Agreement implementation: registration and account creation, provision of access to the Platform, payment processing and provision of Stars, publication and display of the User Content, account management, and communication with the User.
• Legitimate interest: analytics of Platform use, ensuring security, preventing fraud and abuse, moderating the User Content, protecting the rights of the Administrator and other Users. The legitimate interest is to maintain the performance, security, and quality of the service, and to protect the legitimate interests of the Administrator and third parties.
• Consent: Optional Cookies and Similar Technologies.

2.2.By accepting the offer at the time of registration, the User gives their consent to the personal data processing that is necessary for the execution and performance of the User Agreement. There is no need to obtain such consent repeatedly.

2.3.The processing shall be limited to the achievement of specific, predetermined, and legitimate purposes. The data processed shall not be excessive in relation to the stated purposes.

3.List of Processed Personal Data

3.1.The Administrator processes the following categories of personal data:

• Registration data: nickname, password (in hashed form), email address (if specified).
• Telegram account details: username, ID – if linked voluntarily.
• Payment data: processed primarily by the Polar payment system; the Administrator receives limited transaction information (status, amount, payment ID).
• Technical data: IP address, device type, operating system, browser type, language and country settings, cookie data.
• Platform use data: logs, Personal Account activity, Star purchase history, interaction with the Content and the User Content.
• User Content: stories, texts, images and other materials posted by the User. Such content may contain personal data that the User voluntarily discloses. The Administrator is not responsible for such data.

4.Personal Data Retention Periods

4.1.Personal data shall be retained no longer than required for the purposes of processing, unless otherwise provided by law:

• Account and registration data: during the account validity term and three (3) years after its deletion or blocking (for the purposes of dispute resolution and legal compliance).
• Payment and transaction data: for the periods set forth by tax and accounting laws (generally, for at least 5 years).
• Technical data and logs: up to 12 months, unless otherwise required for security reasons.
• Data processed on the basis of consent (marketing, cookies): until consent is revoked or the purpose is achieved.
• User Content: for the period of posting by the User and a reasonable period after deletion (for backup and dispute resolution).

4.2.Upon expiration of the retention period, personal data shall be destroyed or anonymized.

5.Categories of Recipients and Cross-Border Data Transfers

5.1.The Administrator may transfer personal data to the following categories of recipients:

• payment systems (in particular, Polar) – for payment processing;
• cloud providers (Google Cloud) – for data storage and ensuring the Platform operation;
• analytics services (in particular, PostHog, EU cloud) – to analyze the use of the Platform and, with your consent, to record sessions (your clicks, scrolling and navigation, and what is shown on screen, including your messages in conversations with AI characters and the replies; text being typed into input fields is masked);
• government authorities – as expressly provided for by applicable laws.

5.2.Data is stored in Google Cloud infrastructure. Analytics data and session recordings are processed by PostHog on servers in the European Union (Frankfurt, Germany) and only after you give consent to analytics cookies; you can withdraw it at any time in the cookie settings.

5.3.Before transferring data to third parties, the Administrator shall ensure that appropriate contractual obligations regarding confidentiality and security are in place.

6.Rights of Personal Data Subjects

6.1.Rights under GDPR and UK GDPR

The User has the following rights:

• the right to access their personal data;
• the right to modify inaccurate data;
• the right to erasure (the “right to be forgotten”);
• the right to restrict processing;
• the right to object to processing on the basis of legitimate interest;
• the right to data portability;
• the right to withdraw consent at any time (without affecting the lawfulness of processing before withdrawal);
• the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or significantly affects the User;
• the right to file a complaint with the competent supervisory authority.

6.2.Rights under the Laws of the Republic of Kazakhstan

A personal data subject has the right to access their data, correct, block, destroy it, and also revoke consent to processing in accordance with the Law of the Republic of Kazakhstan on Personal Data and Protection Thereof.

6.3.California Residents’ Rights (CCPA/CPRA)

If the User is a resident of the State of California (USA), they have the following rights:

• Right to Know: the right to request information about the categories and specific personal data that the Administrator collects, the sources of collection, the purposes of processing and the categories of third parties to which the data is disclosed.
• Right to Delete: The right to request deletion of personal data, except as provided by the CCPA.
• Right to Correct: the right to request that inaccurate personal data be corrected.
• Right to Opt-Out of Sale/Sharing: the right to opt out of the sale or sharing of personal data for cross-context behavioral advertising purposes. The Administrator does not sell personal data in the traditional sense. To opt out, the User may submit a request or use the “Do Not Sell or Share My Personal Information” mechanism (if available) / Global Privacy Control signal.
• Right to Limit Use of Sensitive Personal Information: if such data is collected.
• Right to Non-Discrimination: the right not to be discriminated against for exercising the said rights.
• Right to Appoint Authorized Agent: the right to appoint another person to make requests on behalf of the User.

6.4.Rights of Residents of Other US States

For residents of states with laws similar to the CCPA (Virginia CDPA, Colorado Privacy Act, Connecticut Data Privacy Act, and etc.), the corresponding rights apply, including access, deletion, correction, data portability, and opting out of processing for targeted advertising and profiling.

6.5.Procedure for Exercising of Rights

To exercise any of the rights listed in this section, the User may send a request to the email address info@plotex.io or through the form in the Personal Account (if any). The Administrator may request additional information to verify identity.

7.Children’s Data Protection

7.1.The platform is not intended for children under 13. The Administrator does not knowingly collect personal data from children under 13.

7.2.If the Administrator becomes aware that personal data of a child under 13 has been collected without the required verifiable consent of a guardian, such data will be deleted within 72 hours of discovery.

7.3.Features marked “18+” are only available to persons aged 18 years or older.

7.4.Parents or legal guardians wishing to delete their child’s data may contact info@plotex.io.

8.Cookies and Similar Technologies

8.1.The platform uses cookies and similar technologies to ensure the operation of the service, analytics and (subject to consent) marketing.

8.2.Necessary (strictly necessary) cookies are processed on the basis of legitimate interest/agreement implementation and do not require consent. Analytical and marketing cookies may only be used with the User’s consent.

8.3.The User may manage cookies through browser settings or tools provided on the Platform.

9.Measures to Protect Personal Data

9.1.The Administrator takes the necessary organizational and technical measures to protect personal data, including:

• data encryption during transmission (TLS/SSL);
• restriction of access to data on a need-to-know basis;
• backup;
• monitoring and detection of unauthorized access;
• use of Google Cloud infrastructure with appropriate security certificates.

9.2.The Administrator complies with the Federal Trade Commission’s prohibition on unfair and deceptive practices.

10.Policy Amendment

10.1.The Administrator may amend the Policy from time to time. The new version shall be published on the Platform and come into force on the date of publication, unless otherwise specified.

10.2.The Administrator shall notify Users of significant changes in a reasonable manner (via the Personal Account, email, or a notification on the website).

11.Operator’s Contact Details

«PLOTEX», Limited Liability Partnership

BIN: 260840000843

Registered address: 2/22 Saken Zhunisov Street, Building 3, Non-residential Unit 92, Shugyla Microdistrict, Nauryzbay District, Almaty 050000, Kazakhstan

Email: info@plotex.io