Gizlilik politikası

1. Who is responsible for your data

The data controller is VeloStratus Systems LLC, the Operator of the Service, whose details are shown at the top of this page. For any privacy question or request, write to legal@example.com.

This policy describes the Service as a whole. It applies together with the Terms of Use.

2. What data we collect

Account

• your email address, interface language, whether the address is confirmed, and the date you registered;
• your password, only as a salted one-way hash: we cannot read it;
• a record that you accepted the Terms of Use and the Privacy Policy: which versions, when, and in which language they were shown to you.

Orders and money

• your orders: proxy type, country, term, quantity, declared purpose of use, price, status and dates;
• the ledger of your balance: top-ups, charges for orders and refunds;
• the proxy access details issued to you, stored in encrypted form so that you can see them in your account;
• payment information that the payment processor reports to us: the status of an invoice, the amount and currency, and transaction identifiers.

Chat

The messages you write in the chat and the assistant’s replies. While the page is open they are held in your browser. We do not store the text of conversations in our database or in our logs. The text is sent to the language model provider to produce the answers (see section 4). Please do not type passwords, payment secrets or other sensitive information into the chat.

Technical data

• your IP address and a random browser identifier (see Cookies), used to limit the number of requests and to protect against abuse. These counters are kept for a short time (see Retention);
• standard request information (such as the browser type) that every web server receives. Our hosting infrastructure may record it in its ordinary operation;
• technical details of server errors, which we collect so that we can fix them. They are configured to exclude your account, cookies, request contents, chat text and IP address.

Correspondence

If you write to us, we keep your message and our reply.

What we do not collect

We do not collect payment card details (payments are made in cryptocurrency through a processor), and at present we do not ask for identity documents. We do not use analytics, advertising or social-media trackers on the site.

3. Why we use your data and on what basis

Where the law requires a legal basis for processing, we rely on the following. Where the law of your country uses a different framework, the purposes below still describe what we do.

• To provide the Service (create and run your account, answer in the chat, calculate prices, take and deliver orders, keep your balance, send service emails): needed to perform our contract with you.
• To keep the Service secure and prevent abuse (rate limits, detection of fraud and misuse, protection of the budget for the assistant, error fixing): our legitimate interests in running a safe service.
• To meet legal obligations (accounting and tax records, answering lawful requests from authorities): legal obligation.
• To handle your requests (support, refunds, privacy requests): contract and our legitimate interests.

We send only service emails (confirmation of your address, password reset). We do not send marketing emails. If that ever changes, we will ask for your consent first. We do not sell personal data and we do not share it for advertising.

The assistant suggests offers and you confirm every order yourself. We do not make decisions that have legal or similarly significant effects on you solely by automated means.

4. Who receives your data

We share data only with the providers that are needed to run the Service, and only what each of them needs:

• Hosting and database providers that run our servers, store the database and keep encrypted backups.
• Proxy supplier (Proxy-Seller): receives the parameters of an order (proxy type, country, term, quantity and the category of the declared purpose). We do not send it your email address or name.
• Payment processor (Plisio): processes cryptocurrency payments. It receives the amount and the reference of the invoice and may collect further data under its own policy, for example for fraud prevention and legal compliance.
• Language model provider: processes the chat to answer you. It receives the messages of the conversation, the assistant’s instructions, and the results of the tools the assistant uses (such as catalog search and price calculation). If you are signed in and ask about your orders, it receives a summary of them, never your proxy passwords or your email address. Depending on our configuration the model is provided by Anthropic or Google, possibly through an interface gateway run by another company (currently ProxyAPI). These providers may keep requests for a limited time under their own terms. We will keep this page up to date if the provider changes.
• Email provider (Resend): sends our service emails (address confirmation, password reset). It receives your email address and the text of the message.
• Error tracking (Sentry): receives technical information about server errors, configured not to include personal data as described above.
• Authorities, advisers and successors: when the law requires it, to establish or defend legal claims, or in a sale or transfer of the Service (with the same protection of your data).

5. International transfers

We serve customers worldwide and the providers above operate in different countries, including outside the country where you live. Your data may therefore be processed in other countries, whose data protection rules may differ. Where the law requires safeguards for such transfers, we choose providers that offer them, for example standard contractual clauses or similar mechanisms.

6. How long we keep data

• Account data: while your account exists. There is no self-service account deletion yet: write to us and we will delete or anonymise what we are not required to keep.
• Orders and balance ledger: the ledger is append-only for accounting integrity, and we keep orders and ledger entries for as long as the law requires us to keep financial records and for as long as needed to handle claims, typically several years.
• Proxy access details: kept in encrypted form together with the order, so that you can view them in your account.
• Confirmation and reset links: valid for 24 hours and 1 hour; their records are deleted 7 days after they expire.
• Sign-in sessions: end after 14 days without activity, and in any case after 60 days.
• Request counters (including IP address): deleted after 2 days. Usage counters of the assistant: deleted after 30 days.
• Backups: the database is backed up in encrypted form and copies are kept for up to about 6 months. Data that we delete disappears from backups when they are rotated.
• Server logs and error reports: kept for a limited time, depending on the settings of the hosting and error tracking providers. They do not contain chat text.
• Correspondence: as long as needed to handle your request and any follow-up, then deleted.

7. Your rights

Depending on the law of the place where you live (for example the GDPR in the EU, the UK GDPR, the LGPD in Brazil, the KVKK in Turkey, the DPDP Act in India, or California privacy law), you may have the right to:

• access your data and receive a copy;
• correct data that is wrong or incomplete;
• have your data deleted;
• restrict or object to certain processing;
• receive your data in a portable format;
• withdraw a consent you have given, without affecting what happened before;
• know whether personal data is sold or shared for advertising (we do neither) and not be treated worse for exercising your rights;
• complain to the data protection authority of your country.

To use a right, write to legal@example.com from the address of your account. We may ask you to confirm your identity. We answer within the time the law requires. We do not claim to follow any particular regime in full; we handle requests under the law that applies to you.

8. Children

The Service is for people aged 18 and over. We do not knowingly collect data from anyone younger. If you believe a child has given us data, write to us and we will delete it.

9. How we protect data

Passwords are stored as salted hashes, proxy access details are encrypted, connections use HTTPS, operator access requires a second factor, and backups are encrypted. No system is perfectly secure. If a breach affects your data, we will notify you and the authorities as the law requires.

10. Cookies and browser storage

The site uses only what is needed to run it or to remember a choice you made. We do not use analytics, advertising or tracking cookies. That is why there is no cookie banner. If this changes, we will ask for your consent before anything else is stored.

• hm_session (over HTTPS, __Host-hm_session): keeps you signed in. Cookie, not readable by scripts. It lasts until 14 days without activity, or 60 days at most.
• hm_visitor (over HTTPS, __Host-hm_visitor): a random signed identifier of your browser, used to apply usage limits of the chat and to prevent abuse. Cookie, not readable by scripts. Lasts 1 year.
• NEXT_LOCALE: remembers the language you chose. Cookie, lasts 1 year.
• hopmind-theme (local storage): your choice of light or dark theme. Stays until you clear it.
• hopmind.orders.v1 (local storage): the numbers of your latest orders in this browser, so that their status can be shown again. Stays until you clear it.
• hopmind:chat-stash (session storage): keeps the conversation while you switch the language, and is removed as soon as it is restored.
• hopmind:language-offer (session storage): remembers that you dismissed the suggestion to switch language, until you close the tab.
• hm_device (over HTTPS, __Host-hm_device): a signed mark of a browser you signed in from. It lets you sign in even while someone is guessing passwords for your email from other addresses, and contains none of your data. Cookie, not readable by scripts. Lasts 90 days, renewed when you sign in.

You can delete these in your browser settings. The site will still work, but you may be signed out and your choices forgotten.

11. Changes to this policy

We may update this policy. The current version and its effective date are shown on this page. We will tell you about material changes by email or on the site before they take effect.

12. Contact and complaints

Privacy questions and requests: legal@example.com. All contact options are on the Contacts page. You also have the right to complain to the data protection authority of the country where you live or work.