Privacy Policy

1. Information We Collect

1.1 Information You Provide

• Account Information: Email address, password (encrypted), username
• Spotify Credentials: Username and password (transmitted securely via HTTPS, used immediately for upgrade process, never stored in our database or logs)
• Payment Information: Processed by Stripe and Cryptomus (we do not store card details)
• Purchase Information: Purchase ID, transaction history, keys purchased
• Reseller Information: API keys, IP whitelist, business details

1.2 Automatically Collected Information

• Usage Data: IP address, browser type, device information, access times
• Log Data: API requests, key usage, upgrade history
• Cookies: Session cookies, authentication tokens (see Cookie Policy)
• Security Data: Cloudflare Turnstile verification, rate limiting data

2. How We Use Your Information

• Service Delivery: Process Spotify Premium upgrades and renewals
• Account Management: Create and maintain your account, manage API keys
• Payment Processing: Process transactions via Stripe and Cryptomus
• Email Communications: Send order confirmations, key delivery, password resets via Resend
• Customer Support: Respond to inquiries, provide technical support
• Security: Prevent fraud, abuse, and unauthorized access
• Improvements: Analyze usage patterns to improve our service
• Legal Compliance: Comply with legal obligations and enforce our Terms of Service

3. Data Sharing and Disclosure

We do not sell your personal information. We share data only in these circumstances:

3.1 Service Providers

• Stripe: Payment processing (PCI DSS compliant)
• Cryptomus: Cryptocurrency payment processing
• Resend: Transactional email delivery
• Cloudflare: DDoS protection, CDN, bot detection
• Hosting Provider: Server infrastructure

3.2 Legal Requirements

We may disclose information if required by law, court order, or to protect our rights and safety.

4. Cookies and Tracking

We use cookies for:

• Authentication: Keep you logged in (HTTP-only, secure cookies)
• Security: CSRF protection, session management
• Performance: Redis caching for faster page loads
• Bot Protection: Cloudflare Turnstile, Google reCAPTCHA

See our Cookie Policy for detailed information.

5. Data Security

We implement industry-standard security measures:

• Encryption: TLS/SSL for data in transit, AES-256 for data at rest
• Password Security: Bcrypt hashing with salt
• API Security: SHA-256 hashed API keys, IP whitelisting, rate limiting
• Database: Encrypted email storage, access controls
• Monitoring: Automated security scanning, intrusion detection
• Staff Access: Limited access on need-to-know basis

Note: No method of transmission over the Internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

6. Data Retention

• Account Data: Retained while your account is active
• Transaction Records: 7 years (legal/tax requirements)
• Support Tickets: 2 years for quality assurance
• Logs: 90 days for security and debugging
• Deleted Accounts: Data anonymized or deleted within 30 days

7. Your Rights (GDPR)

Under GDPR and CCPA, you have the right to:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate or incomplete data
• Erasure: Request deletion of your data ("right to be forgotten")
• Portability: Export your data in machine-readable format
• Restriction: Limit how we process your data
• Objection: Object to processing of your data
• Withdraw Consent: Opt-out of marketing communications

To exercise your rights: Email us at [email protected] or use the account deletion feature in your dashboard settings.

8. Third-Party Services

We use the following third-party services:

• Stripe: Privacy Policy
• Cryptomus: Privacy Policy
• Resend: Privacy Policy
• Cloudflare: Privacy Policy

These services have their own privacy policies. We are not responsible for their practices.

9. Children's Privacy

Our service is not intended for children under 18. We do not knowingly collect data from children. If you believe a child has provided us with personal information, contact us immediately.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. Continued use of our service after changes constitutes acceptance.

11. Contact Us