Privacy Policy

How we collect, use, and protect your data.

Last updated: March 2026

1What we collect

We collect only the information needed to provide our service:

Account data — username, email, password (hashed), and the contact details you choose to add.
Orders — service IDs, links you submit, quantities, and prices.
Payments — transaction amounts and gateway references. Card numbers are handled by our PCI-compliant processors and never stored on our servers.
Technical — IP address, browser fingerprint, and timestamps, used only for security, rate-limiting, and fraud detection.

2How we use your data

Deliver the orders you place and update you on their status.
Process payments and reconcile your balance.
Detect and block fraud, abuse, and bot traffic.
Respond to support requests and send required transactional emails (receipts, password resets).
Improve the platform — diagnose bugs and measure feature usage.

No marketing without consent. We do not sell your data and do not send marketing emails unless you opt in.

3Cookies & local storage

We use only the cookies and storage needed for the site to work:

access_token — keeps you signed in (HTTP-only, secure).
lang — remembers your language preference.
session — CSRF protection and short-lived flash messages.
localStorage — remembers UI preferences (theme, view toggles) on your device only.

No third-party analytics, advertising, or tracking cookies are used on this site.

4Who we share data with

Your data is shared only with the parties strictly needed to provide your service:

Service providers — we forward the link and quantity to the upstream provider that fulfils your order.
Payment gateways — we send the amount and order reference to the gateway you select. The gateway handles card or wallet data directly.
Email delivery — transactional emails are sent through our own mail server; we do not pass your address to bulk marketing providers.
Legal — we disclose data when required by law, court order, or to protect against fraud.

5How long we keep it

Account data — for as long as your account is active.
Orders and payments — kept for accounting and fraud history (typically 7 years).
Server logs — rotated after 90 days unless flagged for security review.
Closed support tickets — kept for 2 years.

When you close your account we anonymise personal fields and delete authentication credentials within 30 days, but we keep transaction records as required by law.

6Your rights

Access — request a copy of the personal data we hold about you.
Correct — update your profile from your account page at any time.
Delete — close your account and request deletion of personal data.
Export — request a machine-readable copy of your data.
Object — opt out of any non-essential processing.

To exercise any of these rights, open a ticket from the support page.

7Security

Passwords are hashed (bcrypt) — never stored in plain text.
Sensitive integration credentials (API keys, gateway secrets) are encrypted at rest.
All traffic is served over HTTPS with modern TLS.
We log admin sign-ins and access to sensitive endpoints for audit.
Suspected breaches are investigated and disclosed to affected users without delay.

8Children

This service is intended for users aged 18 and over. We do not knowingly collect data from children. If we learn we have, we will delete it.

9Changes to this policy

We may update this policy from time to time. Material changes will be highlighted on this page; continued use of the service after a change means you accept the updated policy.

10Contact

Questions about this policy or about your data? Reach us through the support ticket system.