Privacy Policy

1. Data we collect

The Operator processes only the data necessary to run the service. Based on the site's functionality this is:

• Email address — provided at registration, used as a login and for communication.
• Password — stored solely as an irreversible cryptographic hash (scrypt with a per-user salt); the original password is not accessible to the Operator.
• Telegram data (when logging in via Telegram) — the numeric identifier (id) and username; the Telegram widget may pass a display name at first login. Used to identify the account.
• Display name — set by the user or derived from the email / Telegram.
• Balance and transaction history — the internal account state and a log of transactions (top-ups, order charges, refunds, amounts and dates).
• Order history — the chosen service, volume, the public link to the promotion target, price, status and dates.
• API key — a technical access key for the API (for resellers).
• Technical data — the IP address and session data sent by the browser; the authentication cookie (see the Cookie Policy).

The Operator does not request or deliberately collect ID documents, exact address, biometrics or other excessive data categories. Card/payment details are processed on the payment provider's side and are not passed to the Operator in full.

2. Purposes of processing

• registration and authentication, access to the account dashboard;
• provision and accounting of services, order and payment processing, balance management;
• communication on service and support matters;
• security, fraud and abuse prevention;
• compliance with legal requirements (including fiscal accounting).

3. Legal grounds

Processing is based on: the data subject's consent (given at registration and acceptance of the offer); the necessity of performing the service agreement; compliance with legal obligations; and the Operator's legitimate interest in securing the service.

4. Retention period

Data is kept for the life of the account and thereafter within the periods required by law for the relevant records (e.g. accounting and fiscal). Indicatively: account data is kept until account deletion and for a reasonable period thereafter; payment data is kept for the periods required by law for accounting and fiscal records.

5. Disclosure to third parties

The Operator does not sell personal data. Data may be shared only to the extent necessary to run the service:

• Payment provider connected to the Website — to process payments and issue receipts;
• Hosting provider — [HOSTING PROVIDER] — to host the service and store data;
• Promotion suppliers — only the public link/identifier of the order target, as needed for fulfilment;
• Public authorities — in the cases and to the extent expressly required by law.

Any cross-border data transfer, if required, is carried out in compliance with applicable law.

6. Your rights

You may: obtain information about the processing of your data; request its correction, blocking or deletion; withdraw consent; and lodge a complaint with the competent data-protection authority. To exercise your rights, contact [email protected].

7. Data protection

Passwords are stored only as a hash (scrypt). The user session is protected by a signed, HttpOnly cookie. Access to data is restricted. The Operator takes reasonable organisational and technical measures to protect data against unauthorised access.

8. Contact

Operator: the PapaSMM service (papasmm.com). For data-protection matters and to exercise your rights: [email protected].