// legal
Privacy Notice
Notice version: 2026-10-22-draft. This notice explains what personal data SMMRulz (operating entity to be confirmed)review (“SMMRulz”, “we”) collects, why, how long we keep it, who we share it with, and the rights you have under India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”).
1. What we collect, and why
| Data | Why (purpose) | How we get it |
|---|---|---|
| Email address, name, profile picture, provider account ID (Google) / username (GitHub) | Create and secure your account; sign you in | From Google or GitHub when you sign in |
| Username, avatar choice or uploaded photo, gender (optional) | Personalise your profile | You enter or upload it |
| Order details: the link/URL you submit, quantity, price, status | Deliver the service you ordered | You enter it |
| Wallet, top-up and transaction records (amount, method, status, payment reference) | Credit your wallet, prevent fraud, keep accounting records | You and our payment partners |
| Support tickets, messages and screenshots you attach | Answer your support request | You enter it |
| IP address at sign-up, sign-in time and method, last-seen time, session cookie | Security, fraud and abuse prevention; keep you signed in | Collected automatically |
| Consent records and data-rights requests | Prove what you agreed to and handle your requests | Created when you tick a box or submit a request |
| Reseller / SMMRulz Pay merchants only: business UPI ID, payee name, mobile number, webhook address | Provide the reseller / payment-gateway features | You enter it |
We do not knowingly collect your password (sign-in is through Google or GitHub) and we do not store your card or bank-account details. We do not sell personal data.
2. Cookies and trackers
We use essential storage only to keep you signed in and to remember your privacy choices. At the time of this version we load no analytics or advertising trackers. If that changes, they will stay off until you opt in, and you can change your choice at any time using “Cookie preferences” in the footer.
3. Who we share data with (processors and recipients)
- Hosting and database: Supabase (database), Render (backend), Vercel (website)review.
- Sign-in: Google and GitHub (they tell us your verified email and basic profile; we never receive your password).
- Payments: our UPI / crypto payment partners, to verify that your top-up arrived (BharatPe and the gateways enabled in the admin panelreview).
- Service providers that fulfil orders: they receive the link/URL and quantity of your order, and nothing else about you.
- Email delivery (account / security notices): Resendreview.
- Authorities, where the law requires it.
Some of these providers store or process data outside India. We transfer data only to providers listed above, in line with the DPDP Act.review
4. How long we keep it
- Account data: while your account is active, and deleted or anonymised when you ask us to erase it (see section 6).
- Order, wallet and payment records: kept without personal identifiers after erasure, for the period required for accounting, tax and dispute purposesreview.
- Support tickets and screenshots: 12 months after the ticket is closedreview, or earlier on request.
- Sign-up IP address and security logs: 12 monthsreview.
- Consent records: kept as evidence for as long as the account exists plus the legal limitation periodreview.
5. Consent, and how to withdraw it
We ask for your consent with an unticked box for each purpose. You can withdraw any consent at any time in Settings → Privacy & data; withdrawing is as easy as giving it. Withdrawing the account consent means we can no longer run your account, so we will close it after settling your wallet. Processing already done before withdrawal stays lawful.
6. Your rights
- Access — a summary of the personal data we hold and how it is processed. Download it from Settings → Privacy & data.
- Correction and updating — fix your username, gender and photo in Settings; ask us for anything else.
- Erasure — ask us to erase your data. We can do this once your wallet is empty and no order is in progress.
- Withdraw consent — see section 5.
- Grievance redressal — contact our Grievance Officer below before approaching the regulator.
- Nominate — name another person to exercise these rights if you die or cannot act.
Use Settings → Privacy & data, or the data-rights form if you cannot sign in. We verify your identity before acting. If you are not satisfied with our reply you may complain to the Data Protection Board of India.
7. Children
SMMRulz is for people aged 18 and over, and you confirm this when you create an account. We do not knowingly collect data from children.review
8. Security
Connections use HTTPS, secrets we hold for payment and provider integrations are encrypted, and access to personal data is limited to staff who need it. If a personal-data breach affects you we will tell you and the Data Protection Board as the law requires.
9. Grievance Officer
Grievance Officer: [Grievance Officer — name to be published]
Email: to be publishedreview
You can also use the data-rights & grievance form. We aim to respond within 30 daysreview.
10. Changes to this notice
When we change this notice in a way that matters, we will show it in the app and ask for your consent again where the law requires.