Privacy policy

1. What we collect

From Telegram, when you use our bot or log in to the website: your Telegram user ID, first name, username (if you have one) and the language you choose.

If you create an account with email: your email address, your password (only as a one-way hash that even we cannot read) and the name you enter. If you sign in with Google: your Google account ID, email and the name Google shares with us.

Account security: for every sign-in and security change (such as a password change) we record the time, sign-in method, IP address and browser/device type, so you can review them on your account page and spot sign-ins that weren't you.

About your orders: the product, region and amount, the price we quoted, the order status and the times it changed. Payment receipts or messages you send our admin stay in that Telegram chat.

On the website: a login cookie if you log in (see the Cookie policy) and standard technical logs (IP address, browser type, time of request) that help us keep the site secure.

We also count how often each page is opened, as anonymous daily totals per page (no cookie, no IP address, nothing that identifies you). Browsers with "Do Not Track" turned on are not counted.

We do not ask for your phone number, address, ID documents or bank card number, and we do not use third-party analytics or advertising trackers.

2. Why we use it

To process and deliver your orders, to show your order history in the bot and on the website, to answer support questions, and to prevent fraud and abuse of the site. We do not sell your data and do not use it for advertising.

3. Who can see it

Only the PimsPay team. Your messages with our bot travel through Telegram, which processes them under its own privacy policy. Our servers are rented from a hosting company, which stores the data for us but may not use it. We share data with authorities only when the law requires it.

Account emails (verification and password-reset codes) are sent through an email delivery service, which receives only the address and the text of that message in order to deliver it. If you press "Continue with Google", Google processes that sign-in under its own privacy policy.

We never send your personal data to the brands or issuers of the codes you buy.

4. How long we keep it

Order and account data: while you are our customer and up to 3 years after your last order, so we can help with old orders and keep basic records. Technical logs: up to 30 days. Backups: rolling copies for up to 14 days.

Sign-in and device history: 180 days. Email verification codes: valid for 15 minutes and deleted within a day.

After that the data is deleted or made anonymous.

5. How we protect it

Encrypted connections (HTTPS), signed login cookies, rate limits against password guessing and attacks, restricted admin access and regular backups. No system is perfect, but we work to keep your data safe and will tell affected customers if a serious incident happens.

6. Your rights

You can ask us for a copy of your data, ask us to correct it, or ask us to delete your account and order history, unless we must keep a record by law. Send the request to our admin on Telegram from the same Telegram account.

7. Age

Our services are meant for people aged 18 or older. If you are younger, please order with the help of a parent or guardian.

8. Changes

If we change how we use your data, we update this page and the date at the top. Important changes are also announced in our Telegram channel.