1. General
This Policy describes what data Grossa (the “Service”) – the Telegram bot @grossa_supply_bot, the key activation website and the Service’s API – processes, why, and how it is protected. By using the Service you agree to this Policy.
2. What data we process
About Resellers (users of the bot and API):
- Telegram ID, username, name and language from the Telegram profile;
- balance, orders, keys, top-ups and transaction history;
- order labels, tags and notification settings;
- API keys – only as a hash, they are never stored in full.
About Customers (users of the activation website):
- the activation key entered;
- details required to set up the product: for example, the account email or service session data;
- the delivery result: access details, code or link issued to the Customer.
Technical data: IP address (to protect against brute force and to rate-limit requests), browser and device type, request times.
The Service does not receive bank card data: it is processed by payment systems.
3. Why we use it
- to sell and deliver keys, set up products and show their status;
- to keep balances and transaction records;
- to answer requests and resolve delivery issues;
- for security: protection against key brute force and abuse;
- to send service messages in the bot – top-ups, activations, restocks. The activation digest can be turned off in the profile.
4. Who receives data
- Suppliers that set up the product – only the data needed for that.
- Payment systems – when paying: Platega, CryptoBot, Telegram (Stars); USDT transfers go through public blockchain networks.
- Stripe – if a payment system asks to confirm a payment, the check runs in the Customer’s browser via Stripe.
- Hosting providers whose servers run the Service.
- A machine translation service – only interface and instruction texts, without personal data.
We do not sell data or share it for advertising.
5. Storage and protection
- Details a Customer enters for activation are stored encrypted and deleted after 40 days – we keep them that long to help if anything happens to the product.
- API keys are stored only as a hash.
- Reseller data is kept while it is used to provide the services and as long as transaction records require.
- Access to data is limited to those who need it to run the Service.
6. Cookies and browser storage
The activation website stores in the browser:
- the selected language (a cookie, up to a year);
- the last checked key and access to your activation – to return to the status without entering the key again.
There are no advertising or third-party trackers on the activation website.
7. Your rights
You may request information about your data, its correction or deletion. Resellers – via “Support” in the bot; Customers – via the key seller or the bot’s support. Deletion may be limited if the data is needed for transaction records or to resolve a disputed delivery.
8. Changes
The new version is published in the @grossa_supply_bot bot (the /privacy command) and takes effect upon publication.
9. Contacts
Via the “Support” button in the @grossa_supply_bot bot.