1. Information collected
Account
Username, email, optional first and last name, hashed password, role, status, timezone, locale, referral code, email-verification timestamp, MFA flag, last login IP and time.
Session and security
Session cookie, CSRF token, login-attempt rows (identifier, IP, user agent, success/failure), optional TOTP secret (encrypted) and hashed recovery codes, signed email-verify and password-reset tokens.
Wallet and orders
Wallet balance, ledger entries, SMM orders (link, quantity, charge, status), VTU transactions, number reservations, identity lookups, gift-card orders, marketplace orders, tickets and ticket messages.
Device and technical
IP address and user agent on auth, contact and rate-limited actions. Request IDs in application logs.
Cookies
A first-party session cookie required to stay signed in and to validate CSRF. No third-party advertising cookies ship in this codebase.
Assistant
Messages you send to the on-site assistant are processed locally to produce a reply. They are not forwarded to an external AI provider. Rate-limit rows may record that a request occurred.
We do not run a third-party product-analytics script in this codebase. If the operator later adds one, this policy must be updated before it is enabled.
2. How information is used
- To create and authenticate accounts, including MFA and password reset
- To take payment, credit wallets, place orders and record a ledger
- To fulfil orders through the providers the operator has connected
- To answer support tickets and contact-form messages
- To enforce rate limits, blacklists and Acceptable Use rules
- To answer assistant questions from local knowledge (not a cloud AI API)
- To meet accounting, tax and lawful-request obligations
3. Legal bases
Requires counsel review for a specific jurisdiction. Where GDPR or a similar regime applies, typical bases are: contract (running the account and fulfilling orders), legitimate interests (security, fraud prevention, service improvement that does not override your rights), legal obligation (tax and accounting records), and consent where we ask for it (for example optional marketing email, which this codebase does not send by default).
4. Sharing and processors
We do not sell personal data. We share it with processors only as needed to run the service:
- Payment gateways. Stripe, PayPal, Paystack, Flutterwave, Razorpay, CoinPayments, plus manual bank transfer. Only gateways the operator enables receive payment data.
- SMM providers. Upstream social-media panels configured by staff. They receive the public link and quantity needed to fulfil an order — never your panel password.
- VTU. VTpass or another configured VTU adapter for airtime, data, cable, electricity and exam pins.
- Virtual numbers. 5sim or another configured number adapter.
- Identity. Dojah or another configured KYC adapter for NIN/BVN lookups. These checks are billable and retain whatever the vendor returns for the operator’s retention window.
- Gift cards. Reloadly or another configured gift-card adapter.
- Email. The configured SMTP server (MailHog in development).
- Object storage. Optional S3-compatible storage for media uploads.
Staff with the right RBAC permission can see operational records. Impersonation, if granted, is read-only, time-boxed and audited. Lawful requests from authorities may compel disclosure.
5. Cookies
A first-party session cookie keeps you signed in and binds the CSRF token. That cookie is required for the logged-in product to work. Optional “remember me” extends the session cookie lifetime on the device you used to sign in. This repository does not ship advertising or cross-site tracking cookies.
6. Security measures
- Hashed passwords; dummy verify on unknown identifiers
- CSRF protection on state-changing requests; logout is POST-only
- Encrypted MFA secrets, provider credentials and gift-card codes at rest
- TLS verification on outbound provider calls; private-IP egress blocked by default
- Rate limiting on login, registration, password reset, contact and the assistant
- Role checks on every admin controller
No security measure is a guarantee against every attack. Report a vulnerability to the support address rather than exploiting it.
7. Retention
Account and ledger records are kept for as long as the account exists and for a further period needed for accounting and dispute handling. Identity-lookup payloads are retained for the operator’s identity_retention_days setting (default 30 days) and can be purged. Login-attempt rows are used for throttling and abuse review. Application logs keep request IDs; they are not a second copy of gift-card codes or MFA secrets.
8. Your rights
Depending on where you live you may have rights to access, correct, delete, restrict or port personal data, and to object to certain processing. Use the contact form or a signed-in ticket. We may need to verify the request. Some records (ledger rows, completed tax-relevant payments) cannot be erased without breaking the integrity of the books; we will explain if that applies.
9. Account deletion
Ask support to close the account. Closure prevents further sign-in and further charges. Wallet leftovers are not paid out as cash. Historical ledger and order rows remain as required to keep the books consistent and to handle chargebacks.
10. International transfers
If the operator, a payment gateway or a fulfilment vendor stores data in another country, that is an international transfer. The operator must document the transfer tool (for example standard contractual clauses) once the hosting and vendor locations are known. This policy does not invent those locations.
11. Children
The service is not directed at children under 16, or the higher digital-consent age in your country. If you believe we hold data about a child, contact us and we will delete the account.
12. Policy changes
We will update the date at the top of this page when the policy changes. Material changes that affect how we use personal data will also be announced in the site banner where practical.
13. Contact
Privacy questions: contact form or support@marvy.local.
Identity of the controller and any supervisory-authority complaint rights must be completed by the operator for the country in which they are established.
