Privacy Policy

1. What we collect

• Email and password — your password is never stored in plain text; it's salted and hashed (PBKDF2) before it ever touches disk.
• Payment screenshot and an optional note — submitted when you pay, used only to manually verify your payment.
• Binance ID — only if you apply to the partner program and request a payout, so we know where to send your commission.
• IP address — read briefly, in memory, to block obvious abuse (e.g. scripted login attempts). It's not written to disk or kept once the request is handled.

We don't ask for your real name, phone number, date of birth, or any payment card details — none of that is needed for how Exalator works.

2. What we use it for

Running your account, reviewing and approving your payment, running the partner program (if you join it), and keeping the login/signup/payment forms from being abused. Nothing here is used for advertising, and nothing is sold.

3. Who sees it

Your data is visible only to whoever operates Exalator, through the admin panel used to review payments and partner applications. We don't share, sell, or rent your information to any third party. Payment screenshots are stored on our server and are only ever viewed during manual payment review.

4. Cookies

Exalator sets exactly one cookie: a signed session cookie that keeps you logged in. There are no third-party tracking or advertising cookies, and no analytics scripts running on the site at this time.

5. How long we keep it

Your account and payment records are kept for as long as your account exists, so we can verify access and partner commissions. If you'd like your account and associated data deleted, contact us (Section 8) and we'll remove it, other than what we're required to keep for legitimate record-keeping (e.g. a completed payment).

6. Security

Passwords are hashed, not stored in plain text. The admin panel is gated behind a separate access token. In production, the site is served over HTTPS and the login cookie is restricted to HTTPS connections only. No system is perfectly secure, but we take reasonable, concrete steps rather than just claiming to.

7. Children

Exalator isn't intended for anyone under 18, and we don't knowingly collect data from anyone under that age.

8. Contact

Questions about this policy, or a request to access/delete your data: reach us on WhatsApp.

9. Changes

If this policy changes in a meaningful way, we'll update the date at the top of this page.