Controller of personal data: [name], operator of BlehBinary — [email protected].
What we collect
When you create an account or use the website, we collect:
- your email address and optional display name;
- a password hash (we never store plain-text passwords);
- profile details you choose to provide, such as username, description, and avatar;
- project requests you submit, including the service type, description, and customer form;
- support tickets and messages you send through the website, including uploaded files and links;
- payment confirmation data visible to our team: for SBP, the sender’s phone number; for USDT, the wallet address and transaction hash. We never store bank card data;
- basic technical data needed to operate the service, such as session information and request logs.
Why we use it
We use this information to:
- create and manage your account and keep you signed in;
- respond to your project requests and support tickets;
- process payments and issue invoices;
- maintain the security and integrity of the website;
- comply with legal obligations and resolve disputes.
Legal basis
We process personal data on the following bases: performance of a contract with you (account, orders, support); our legitimate interest in keeping the service secure (logs, rate limiting); compliance with legal obligations (accounting, taxes); and, where required, your consent.
What we do not do
We do not sell your personal data. We do not share it with advertisers. We do not use third-party analytics or tracking scripts on this site. We do not use your data for automated decision-making or profiling.
How long we keep it
We keep personal data only as long as needed: account data — until the account is deleted; order and payment records — for the period required by applicable law (typically 5 years); support tickets and uploaded files — up to 12 months after the ticket is closed; request logs — up to 6 months. When the retention period ends or the account is deleted, we delete or anonymize the data, unless we must keep it longer to comply with a legal obligation or defend against legal claims. We review retention periodically.
Security
We use industry-standard practices to protect your data: passwords are hashed with bcrypt, session cookies are signed with HMAC and marked HttpOnly, and API requests are validated and rate-limited. We take these measures seriously and review them regularly. If a data breach occurs that poses a risk to your rights, we will notify you and the competent authority as required by law.
Your rights
Depending on your jurisdiction, you may have the right to access, correct, delete, or restrict processing of your personal data, to object to certain processing, to data portability, and to lodge a complaint with a supervisory authority. You can update your public profile details in the profile editor at any time. To exercise other rights, contact us through a support ticket or at [email protected] — we respond within 30 days.
Cookies
We use a single session cookie to keep you signed in. It is HttpOnly, SameSite=Strict, and is not used for advertising or cross-site tracking. You can clear it by signing out or clearing your browser cookies.
Third parties
We do not share personal data with third parties except when required by law, to protect our rights, or to operate essential infrastructure under confidentiality obligations. We do not transfer data internationally unless necessary and with appropriate safeguards.
Children
The service is not directed to persons under the age of 18. If we learn that we have collected data from a person under 18 without proper consent, we will delete it.
Changes to this policy
We may update this policy from time to time. The current version is always available on this page. Material changes will be communicated through the website or by email. Continued use of the website after changes means you accept the updated policy.
Contact
To ask about your data, request deletion, or correct something we got wrong, contact us through a support ticket or email [email protected].
