Privacy Policy

This policy explains what data smmbilan.uz collects, why, and who it is shared with.

1. What we collect

You provide:

• email address and username (required);
• first name, last name, company, phone (optional);
• order data: link, quantity, comment text;
• payment receipt (for manual payment methods).

Collected automatically:

• IP address, browser and device type;
• login times and history (for security);
• approximate country from IP — to pre-select currency and language.

2. Why we need it

3. Who we share it with

• Upstream provider — only the link and quantity are sent to fulfil the order. Your name, email and payment details are not sent.
• Payment gateway — to process payment. Card details never reach our server; they go directly to the gateway.
• Lawful request — to an authorised authority.

We do not sell or share data with anyone else.

4. Passwords and secrets

• Passwords are never stored in readable form. They are stored irreversibly using Argon2id.
• 2FA secrets and API keys are stored encrypted.
• An API key is shown once and never displayed again.

5. Cookies

Only necessary cookies are used:

• session cookie — to keep you signed in;
• language and currency choice;
• "remember me" (only if you enable it).

No advertising or tracking cookies are used. If external analytics is ever added, it will be announced on this page.

6. Retention

• Account data — while the account is active;
• order and payment records — retained as required for financial reporting, and kept after account deletion (amounts separated from personal data);
• login history and technical logs — up to 30 days.

7. Your rights

• view and correct your data on the profile page;
• request account deletion;
• turn off notifications (profile → notifications).

Note: even when an account is deleted, money movement records are retained. They are accounting records and the means of resolving disputes — without them, payment claims could not be verified.

8. Security

The site runs over HTTPS. Two-factor authentication is mandatory in the admin panel. Login attempts are logged and suspicious activity is throttled.

Even so, no system is absolutely secure. Use a strong password that you do not reuse elsewhere.

9. Contact

Privacy questions: the address on the "Contact" page, or the Support section inside the Panel.