Privacy policy

What we collect

Account data: your email address, username, password hash (never the password itself) and the notification preferences you set. If you sign in with Google we receive your email address and basic profile name from Google, nothing more.

Usage data: the orders you place, including the public link, quantity and service, plus your wallet transactions and the payment reference you submit for a manual deposit. We do not store card numbers, UPI PINs or bank credentials at any point.

Support data: the tickets and messages you send us, kept with your account so an agent can see the history instead of asking you to repeat it.

Technical data: standard server logs such as IP address, timestamp and user agent, used for security and abuse investigation.

Why we use it

To run your account, route orders to providers, verify deposits, send the transactional emails you have enabled, prevent fraud and chargeback abuse, and answer support requests. We also look at aggregated, non-identifying numbers to decide which services to keep and which providers to drop.

We do not use your data to build advertising profiles and we do not sell it. There is no data broker in this chain.

Who we share it with

Providers: the target link and quantity for an order are passed to the provider fulfilling it. That is unavoidable, because they are the ones delivering. They do not receive your email address or wallet history.

Infrastructure: our database and authentication run on Supabase, and transactional email is sent through Resend. Both process data on our instructions only.

Law: we disclose data where a valid legal request requires it, or where it is necessary to investigate fraud against us or another customer.

Cookies and analytics

We use a session cookie so you stay signed in, and local storage for your currency and interface preferences. These are required for the panel to work. We do not run third-party advertising trackers on the panel.

Security

Data sits in an encrypted Postgres database with row-level security enabled, which means one account physically cannot read another account's rows even if application code has a bug. Sessions use short-lived tokens, administrative actions are logged, and payout and deposit approvals go through manual review.

No system is perfect. If a breach ever affects your data we will tell affected users directly rather than burying it in a policy update.

How long we keep it

Account and transaction records are kept while your account is open, and afterwards for as long as accounting and dispute-resolution obligations require. Support tickets are kept with the account. Server logs are rotated on a short cycle.

Your rights

You can ask for a copy of your data, ask us to correct it, or ask for your account to be deleted. Email support@smmfree.com from your registered address and we will act on it. Deletion removes your account, order links and support history, subject to records we are legally required to retain.

You can turn individual email notifications on or off yourself from dashboard settings at any time.

Children

The panel is not intended for anyone under the age at which they can lawfully contract in their country, and we do not knowingly hold data from children. If you believe a child has registered, tell us and we will remove the account.

International transfers and changes

We serve customers worldwide, so data may be processed in a country other than yours by the infrastructure providers listed above, under their standard safeguards.

If this policy changes materially we update the date at the top and, where the change affects how we use your data, we notify account holders by email.