Privacy Policy.

1. Who we are

StarsBanking is operated by ОсОО «Жаштык Плюс» ("we", "us", "our"), registered in the Kyrgyz Republic (Tax ID (INN): 02602202610044 · OKPO: 34703842 · Registration No.: 326031-3301-ООО, dated 26 February 2026). We are the controller of personal data collected via starsbanking.gamearea.io and the Telegram bot @starsarea.

Contact: support@gamearea.io or via @starsarea (Support).

1.1 Definitions

Personal data means information relating directly or indirectly to an identified or identifiable individual. Processing includes collection, recording, storage, correction, use, disclosure on a lawful basis, restriction, erasure and destruction, by automated or non-automated means.

Operator means ОсОО «Жаштык Плюс», which determines the purposes and means of processing. A User uses StarsBanking; a data subject is the individual the data relates to. The Service comprises the StarsBanking website, associated web interface and StarsBanking Telegram bots.

Blocking means temporarily restricting processing except as needed to correct data. Destruction means making the data content irrecoverable. A cross-border transfer is a transfer of data to a recipient in another country.

1.2 Processing principles

Processing must be lawful, fair and limited to specific, predetermined purposes. The nature and amount of data must be relevant to those purposes and not excessive. Data must not be used for incompatible purposes, and databases collected for incompatible purposes must not be combined. Processing must maintain accuracy and currency, correct or remove incomplete or inaccurate information, and limit retention to the processing purpose and applicable legal requirements.

2. What data we collect

2.1 Telegram account data

• Telegram User ID — unique numeric identifier provided by Telegram.
• Telegram username — your @-handle, if set.
• Display name — first and/or last name set in Telegram.

2.2 KYC data

• ID document (photo/scan) if KYC is required.
• Date of birth and full legal name provided at verification.

2.3 Transaction data

• Stars amount and fiat amount for each exchange.
• Card digits (last 4 only) or SBP phone numbers.
• Timestamps, statuses, and exchange identifiers.
• Blockchain transaction hashes or payment-provider IDs.

2.4 Technical and device data

• IP address during bot and website interactions.
• Browser fingerprint and user-agent (for website visitors).
• Device type and OS (approximate, from Telegram API).

2.5 Communications

• Messages sent to support via the bot.
• Emails to support@gamearea.io.

3. Why we collect it

• Service delivery: to process purchases, confirm payments, and automatically deliver Stars.
• Anti-fraud and security: to detect and prevent fraudulent transactions, money laundering, and other illegal activity.
• KYC/AML compliance: to meet applicable anti-money-laundering obligations.
• Customer support: to answer queries, resolve exchange issues, and handle disputes.
• Service improvement: to analyze aggregated usage patterns and improve platform performance.
• Legal obligations: to comply with applicable laws, regulations, court orders, and lawful requests.

4. Legal bases

Processing is subject to the applicable legislation of the Kyrgyz Republic and, where applicable, the GDPR. The following grounds apply to the extent permitted by those laws:

• Contract performance: processing is necessary to deliver the service you requested.
• Legal obligation: KYC/AML processing is required by law.
• Legitimate interest: anti-fraud, security monitoring, and service improvement — balanced against your rights.
• Consent: for any optional communications or analytics outside the above.

4.1 Operator rights and duties

The operator may request accurate data and supporting information to the extent needed to provide a service, verify a request or comply with law, and determine proportionate safeguards. The operator must provide information about processing, handle data-subject requests and lawful requests from competent authorities within statutory deadlines, maintain confidentiality and keep an up-to-date policy publicly accessible.

When consent is withdrawn, processing based on that consent must stop; processing under an independent legal obligation or another applicable basis may continue only to the extent necessary. Merely using the website does not replace separate consent where the law requires it.

4.2 User duties

Users should provide accurate information and report changes affecting a service or request. Another person's data may be supplied only on a lawful basis. Do not send documents or sensitive information that have not been requested for a specific transaction or verification.

If particular data are necessary to fulfil a user request or comply with mandatory law, the corresponding operation may be unavailable without them. Declining optional processing should not in itself prevent access to the service's core functions.

5. Retention

• Exchange records: 5 years from the exchange date, as required by AML rules.
• KYC/ID documents: 5 years after the last exchange or account activity.
• Support communications: 2 years from resolution.
• Technical logs (IP, fingerprint): 12 months.

After retention expires, data is securely deleted or anonymized.

6. Third parties

We do not sell your data. We may share data with:

• Payment processors and banking partners — to process card and SBP payments. Bound by their own policies and applicable regulations.
• Blockchain networks — crypto payments inherently broadcast addresses and transactions to public chains.
• KYC/AML verification providers — when needed, documents may be processed by a third-party verifier under a data-processing agreement.
• Law enforcement and regulators — on lawful request or court order.
• Cloud infrastructure providers — servers and databases may be hosted by third parties under appropriate safeguards.

7. Cookies and analytics

StarsBanking uses minimal cookies necessary for operation (session state, security). We may use privacy-respecting analytics for aggregated traffic patterns. No ad or tracking cookies. You can disable optional cookies in your browser.

8. Security

• Data encrypted in transit (HTTPS/TLS).
• Sensitive data encrypted at rest.
• Role-based access control — only authorized staff access data.
• Regular security audits and penetration testing.

No system is 100% secure. If a breach poses high risk to your rights, we'll notify you and the authorities per applicable law.

8.1 Confidentiality

Access to personal data must be limited to people who need it for their duties. The operator and anyone granted access must not disclose or distribute data without the data subject's consent or another lawful basis. Ending work with the data does not in itself end the duty of confidentiality.

9. Your rights

Subject to applicable law, including the GDPR where applicable, you have the right to:

• Access: request a copy of personal data we hold on you.
• Rectification: correct inaccurate data.
• Erasure: request deletion, subject to retention obligations.
• Restriction: limit processing under certain conditions.
• Portability: receive data in a structured, common format.
• Object: oppose processing based on legitimate interest.
• Withdraw consent: where processing is based on consent.

Exercise any right via support@gamearea.io or via @starsarea. We respond within the deadlines required by applicable law. You may also lodge a complaint with the competent personal data protection authority in the Kyrgyz Republic or another supervisory authority with jurisdiction over your case.

9.1 Requests and withdrawal of consent

To request access, correction, restriction, erasure or withdrawal of consent, contact support@gamearea.io or support through @starsarea. Include your Telegram ID or username, the nature of your request and a way to contact you. Do not send passwords, login codes, private keys or full card details.

To avoid disclosing data to an unauthorized person, proportionate verification of identity or a representative's authority may be necessary. Responses are provided within applicable statutory deadlines; if a request cannot be fully fulfilled, the reason and applicable restrictions must be explained.

Withdrawal does not affect the lawfulness of processing before withdrawal. Erasure is subject to mandatory retention and other lawful grounds, such as handling a dispute; once those grounds cease, data must be erased or anonymized. Public blockchain records are outside the operator's control and cannot be erased by the operator.

Users may challenge the operator's actions or inaction before a competent supervisory authority or court and use other remedies available under applicable law.

10. International transfers

Your data may be processed by service providers outside the Kyrgyz Republic and, where relevant, outside the European Economic Area. Cross-border transfers are subject to the requirements and safeguards of applicable law, including the GDPR where applicable.

11. Changes

We may update this Policy from time to time. The updated version is posted here with a new effective date. Material changes are notified to active users via the bot.

12. Contact us

For any privacy question or to exercise your rights:

ОсОО «Жаштык Плюс»
Tax ID (INN): 02602202610044 · OKPO: 34703842 · Registration No.: 326031-3301-ООО, dated 26 February 2026
429 Frunze Street, Sverdlovsky District, Bishkek, Kyrgyz Republic
Email: support@gamearea.io
Telegram: @starsarea → Support