Privacy policy

1. Who is responsible for your data

The operator of xsmmpanel.uk decides what is collected here and why. In this policy, "we" means that operator and "you" means the person holding the account.

Your card details are a separate matter. They go to Whop, who take the payment, and they never reach this site. What we hold about a purchase is the amount, the package, whether it cleared, and a reference we can match to your balance.

2. What we collect

• Account details. Your username, email address, first and last name, and a WhatsApp number if you choose to give one. The WhatsApp number is optional and is used only if support needs to reach you about an order.
• Order data. The service, the quantity and the public link for each order, its status history, and the order number our network returned for it.
• Payment records. Which credit package you bought, the credit and the fee, the payment reference and its status. Card numbers never reach our servers. They are handled entirely by our payment company.
• Balance history. Every movement in or out of your balance, with the amount, the balance it left behind and what caused it, so a figure you disagree with can be rebuilt line by line.
• Technical data. Your IP address, browser and timestamps, kept for security and fraud prevention.

3. What we never ask for

We do not ask for the password to any social media account, and we never need one. Every service works from a public link alone, and we request no permissions on your accounts. Nobody from support will ever ask you for a login. Treat any message that does as an impersonation attempt and open a ticket about it.

4. Why we use it

• To place your orders with our network and keep your balance accurate.
• To send you order updates, receipts and account emails.
• To answer your support tickets.
• To detect fraud, chargeback abuse and account takeovers.
• To meet our accounting and tax obligations.

We do not sell your data, and we do not share it for advertising.

5. Who we share it with

Only the companies we need in order to run the panel. Our payment company, Whop, receives what it needs to take the payment and tell us it cleared. Our network receives the public link and the quantity for each order, and nothing else about you. Our hosting provider stores the database. Our email provider sends your confirmation, receipt and order emails. Each is bound by its own data agreement with us.

We will also hand over data where the law requires it, and we will tell you when we are allowed to.

6. How long we keep it

Account and order records are kept while your account is open, and afterwards for as long as tax law requires us to keep them. Support tickets are kept for two years. You can ask us to delete anything that is not covered by a legal retention duty.

7. Your rights

You can ask for a copy of your data, correct anything that is wrong, or ask us to close your account and delete it. Open a ticket from the account the data belongs to and we answer within 30 days. We ask from the registered address because that is how we know the request is yours.

8. Cookies

We set one cookie, and it keeps you signed in. It holds a signed session token and nothing else. There are no advertising cookies and no cross-site tracking cookies on this site.

9. How we protect it

Traffic is encrypted with TLS. Passwords are stored as bcrypt hashes and cannot be read by anyone, including us. Email confirmation and password reset links are stored only as hashes, so a stolen copy of the database cannot be replayed to take an account over. You can regenerate your API key from your account page at any time, which immediately stops the old one working.

10. How to reach us

Open a ticket from inside the panel. Every route is listed on our support page, and the rules for holding an account are in our terms of service.