Privacy Policy | Bumaga Service

1. About this document

This document explains what data we collect when you use the Bumaga Service platform, why we collect it, how long we keep it, and what rights you have over it.

Privacy and data minimisation guide the platform. We use technical logs for security and service operation, do not sell personal data, and do not use such data for advertising profiles.

This policy isn't a legal formality. It's a description of what we actually do. If you find a discrepancy between this document and how the platform works — please tell us.

2. Who processes your data

The data controller is Bumaga Intelligence Solutions Ltd., a company incorporated under the laws of Saint Kitts and Nevis.

For any questions related to data processing, contact us via the email address listed in the "Contact" section.

3. What we collect

The following are the main categories of data that may be processed when you use the platform. The categories depend on the services selected and the security measures required.

3.1. At registration

Login (username) — you choose it yourself and use it to sign in. It's displayed on the platform during deals and in public listings.
Password hash — we don't store the password itself and can't recover it.
Hashes of the secret words / seed phrase generated at registration. We don't see or store the words/phrase themselves — they are shown to you once at registration. Recovery works via hash comparison.

3.2. While using services

Balance history — top-up and spend operations used to pay for services.
Service usage history — what was ordered and at what price.
For payments — the crypto-wallet address from which the payment was received (visible to the OxaPay processor at the moment of transaction).
For SMS activation — the temporary virtual number and operation status (whether a code was received).
For proxy usage — the IP of the issued proxy and the fact that usage has started.
When using Temp Mail - temporary email addresses, account or guest identifiers, received messages and their contents stored in cache and archives, and a hashed IP value for abuse-rate limits.
EXIF Tools - images submitted for metadata inspection or modification and the settings selected for processing. Server-side processing may create generated images, downloadable results and operational history.
MRZ Toolkit - sample strings may be generated in the browser; validation or OCR features may send user-entered MRZ text or selected images to the server. The tool checks technical formats and does not authenticate identity documents.

3.3. Technical data

Technical logs may include IP addresses, request times, requested URLs, User-Agent information, errors and security events, depending on the system. They support site operation, troubleshooting, abuse prevention and infrastructure protection.
Cookies for platform operation — described separately in the "Cookies" section.

4. What we don't collect

To be crystal clear, here's what we don't do:

A personal email address is not required to register a Bumaga account; sign-in uses a username and password. Temporary email addresses created through Temp Mail are processed separately to provide that service.
We do not create advertising profiles from page visits. However, technical access logs may record requested pages, request times and IP addresses.
We do not use browser fingerprints for advertising targeting. Browser and device technical signals, including User-Agent, may be processed for compatibility, security and abuse prevention.
Ordinary account registration does not require an identity document, residential address or legal name. Additional information may be needed in specific cases to handle support, disputes or lawful requests.
We don't use third-party analytics systems (Google Analytics, Yandex Metrika or similar).
We don't share data with advertising networks and don't use it for targeting.
We don't sell data to third parties.

Data minimisation is an architectural principle of the platform, not a marketing slogan. If a service works without a particular type of data — we don't ask for it.

5. Why we collect this data

Each type of data is collected only for a specific purpose:

Login and password hash — for authentication and to distinguish accounts.
Seed phrase hash — to recover account access if the password is lost.
Balance and service history — so you can see your operations and we can correctly deliver services and handle disputes.
Service operational data (payer's crypto address, proxy IP, SMS status) — for the technical operation of the specific service.
Access logs — for protection against attacks, incident investigation and compliance with our legal obligations.

We don't use your data for marketing, profiling or any other purposes unrelated to running the platform.

6. Cookies

We use functional cookies and technical identifiers for sessions, security, language preferences and guest features. They are not intended for advertising targeting.

Cookies list

Session identifiers support authentication and secure site operation; bumaga_guest_id supports guest features. Retention depends on the purpose of each cookie.
CSRF token helps protect requests from cross-site request forgery and may be tied to a server-side session; it is not necessarily stored in a separate cookie.
bumaga_lang remembers the chosen interface language (up to 1 year); bumaga_lang_source is a technical indicator of how the language preference was set.

Managing cookies

You can delete cookies via your browser settings, but this will end your session and require you to sign in again.

7. Analytics

We use internal operational metrics, such as account counts and page request volumes. Technical logs may still contain individual request data as described in the data collection section.

External analytics systems (Google Analytics, Yandex Metrika or any other trackers) are not used on the platform.

8. Third parties

Some services rely on payment providers, SMS and proxy suppliers, hosting and other infrastructure partners. The information available to each partner depends on the specific integration, technical role and service arrangements.

Categories of subcontractors

Payment providers may process payment amounts, wallet addresses, transaction identifiers and technical data needed to process and verify transactions.
SMS providers process virtual-number orders, service selection and message status; the information available depends on the integration.
Proxy suppliers provision and operate network resources and may process connection metadata under their own policies and configurations.
Infrastructure providers support hosting, network protection and service availability; their technical role may involve processing request metadata and strictly controlled infrastructure access.

We aim to limit information shared with partners to what is needed for the service, security and lawful requirements. This does not mean that every partner is technically unable to access all categories of information.

We don't share your data with marketing companies, data brokers, advertising networks or for any purposes unrelated to the operation of services.

9. Data retention

Different types of data are kept for different periods:

Account data is kept while an account is in use. Some records may need to be retained longer for security, disputes and legal obligations.
Balance and service records are needed for payments, support, dispute handling and accounting. Some records may remain after account closure where legally justified.
Technical logs have different retention periods: the Nginx server is configured for daily rotation with 14 archived copies; the activity_log cleanup is configured for entries older than 90 days. Some records may remain in backups or incident evidence under applicable policies.
Service operational data (such as SMS numbers and assigned proxy IPs) is kept during delivery and, where needed, longer for support, accounting, disputes and security.
Temp Mail - temporary addresses and message contents may be stored in cache and archives. Standard archives have a retention period of up to 30 days; extended-access accounts may keep archives without a set expiry until deleted. Deleting an active mailbox does not necessarily erase every related record immediately. Access logs are retained separately as described above.
EXIF Tools - some processed outputs and clean-history records are configured to expire after 24 hours, with removal by a scheduled cleanup process. Actual deletion may take longer if maintenance is delayed. Order records, technical logs and backups may have separate retention periods.
MRZ Toolkit - submitted text or images can be processed server-side for validation or OCR. Sample history may remain in the browser. Technical server logs and any permitted temporary processing files are governed by applicable operational and security retention rules; do not assume immediate erasure or zero logging.

10. Your rights

You have the following rights in relation to your data:

10.1. Access to your data

You can request information about what data we hold on you. Basic information is available directly in your personal cabinet (login, balance, operation history). For further requests — via the support email in the "Contact" section.

10.2. Correction

If profile data is inaccurate, you can correct it in personal cabinet settings or via support.

10.3. Account deletion

You can delete your account via the corresponding function in your personal cabinet. Upon deletion:

Account credentials and access are removed or deactivated under applicable retention requirements and technical procedures.
Certain financial and operational records may be retained for accounting, legal duties, dispute handling and abuse prevention; where appropriate, their link to an account is restricted.
Technical logs are handled and removed according to the retention rules in section 9. Account deletion does not necessarily remove every backup and archive immediately.

After deletion, account recovery is impossible — we have no email or any other contact to identify you as the owner. If you want to return, you'll need to create a new account.

10.4. Account recovery

Account access can only be recovered via the seed phrase and secret words you received at registration. Since we don't collect email and don't store the secret words themselves (only their hashes), no other way to prove account ownership exists.

Keep your seed phrase in a safe place. If it's lost, account recovery is impossible — even the platform's administration cannot help you.

10.5. Objection and complaint

You can object to the processing of your data or file a complaint with the supervisory authority in your country if you believe your rights have been violated.

11. Security

We take reasonable technical and organisational measures to protect your data:

Passwords and secret words are stored as cryptographic hashes. Recovering the original values is impossible even for us — we can only compare hashes.
Connection to the platform is protected by TLS encryption.
Database access is limited to a narrow group of technical administrators and is logged.
Sensitive database fields are additionally encrypted.

No system can guarantee 100% protection. In the event of a security incident, we will promptly notify affected users and take action to mitigate consequences.

The weakest security point is the compromise of your password or seed phrase. Keep them separately, in a safe place, and don't share them with anyone.

12. International data transfers

Legally, the company operating the platform is registered in Saint Kitts and Nevis. Servers may be physically located in other jurisdictions (in countries with strong privacy legislation).

When using technical subcontractors (see "Third parties"), data may be processed in their jurisdictions. We choose subcontractors based on the level of data protection they provide.

13. Changes to this policy

We may update this policy as the platform evolves. We'll notify you on the platform at least 7 days before significant changes take effect.

The date of last update is shown in the document header. The current version is always available on this page.

14. Contact us

For any questions related to data processing and your rights:

Email

bumagaservice@proton.me

Support

Ticket system in your personal cabinet