Privacy Policy

This Privacy Policy (the "Policy") describes how INTmarket (the "Service", intmarket.cc) processes users' personal data.

The operator processes data in accordance with Russian Federal Law No. 152-FZ "On Personal Data" and other applicable laws of the Russian Federation. By using the Service, you confirm that you have read this Policy.

This Policy supplements the Terms of Service and does not replace them.

We collect only the data necessary to operate the marketplace, maintain security, and fulfill orders. We do not request payment cards or bank details — top-ups are made via cryptocurrency transfers.

Purchased session/TData file contents are the product, not your personal data. We do not read correspondence inside Telegram accounts after delivery.

• Directly from you — when registering, topping up, purchasing, contacting support, or creating API keys.
• Telegram — when signing in via Login Widget or linking an account for 2FA (ID, name, and username are shared per Telegram's rules).
• Blockchain / payment gateway — on-chain transaction hash and amount for automatic balance crediting (without access to your private keys).
• Automatically — browser technical headers and IP address when accessing the API and pages (see "Cookies and logs").

Personal data is used to:

• register, authenticate, and manage your account
• fulfill orders, deliver digital goods, and maintain purchase history
• top up balance, record transactions, and process referral rewards
• operate reseller API and prevent abuse (rate limiting)
• support users, handle complaints and refunds
• prevent fraud, block violators, and maintain security
• send in-app notifications (account bell icon)
• comply with legal requirements and respond to lawful requests

We do not use your data for targeted advertising and do not send marketing emails without separate consent.

Processing is carried out on the following bases (152-FZ and equivalent principles where applicable):

• Contract performance — registration and use of the Service (user agreement).
• Consent — linking Telegram, enabling 2FA, voluntarily providing data in a support ticket.
• Legitimate interest — protection against attacks, fraud checks, administrator audit logs.
• Legal obligation — retaining data upon request from authorized authorities.

• Passwords are stored only as bcrypt hashes — the original password cannot be recovered.
• API keys are stored as a cryptographic hash; the full key is shown only once at creation.
• Traffic between your browser and the Service is encrypted with TLS.
• Databases and archive storage run on secured infrastructure with restricted administrator access.
• 2FA OTP codes and rate-limit counters are stored in Redis with a short TTL (minutes).

We do not sell or rent personal data. Sharing occurs only when:

• Telegram — for Login Widget, 2FA bot, and one-time code delivery (Telegram policy: telegram.org/privacy).
• Payment infrastructure — on-chain payment service to identify your blockchain transfer (email is not shared).
• Account Hub — technical integration for inventory reservation and delivery (order IDs only, not user profile).
• Government authorities — upon a lawful and properly documented request.

If infrastructure or contractors change, we maintain a level of protection no lower than described in this Policy.

Detailed cookie types, retention, and controls are in our Cookie Policy. In brief: the Service uses essential cookies for authentication sessions (NextAuth) and security. Analytics and advertising cookies are not used without your consent via the site banner.

• CAPTCHA (ALTCHA) is used on sign-in and registration to protect against bots.
• IP address and User-Agent may be recorded in server logs and used for rate limiting. Redis counters are automatically deleted after 60 seconds.
• In-app notifications are stored in your account; Telegram push or email for order alerts are not sent (except 2FA codes).

Controls: cookie banner (bottom-right on first visit) or browser settings. Removing essential cookies will sign you out.

Under Russian Federal Law No. 152-FZ (and, where applicable, GDPR-style rights in your jurisdiction), you may:

• obtain information about processing of your personal data
• request a copy of stored data
• request correction of inaccurate data
• withdraw consent where processing is consent-based
• request deletion when there is no legal basis to retain data
• lodge a complaint with Roskomnadzor or a court in Russia

Submit requests via a support ticket with subject "Personal data". We respond within 30 calendar days. Include your account email for verification.

Account deletion is available on request if there are no open disputes, outstanding balances, or legal retention duties. Some records (e.g., financial) may be kept in anonymized form.

The Service is intended for users aged 18 and over. We do not knowingly collect data from minors. If you believe a child registered without parental consent, contact support and we will delete the account.

Servers and contractors may be located outside the Russian Federation. In such cases we ensure adequate protection — encryption, contractual obligations with processors, and access on a need-to-know basis.

By using the Service from another country, you agree to such transfers to the extent necessary to provide the services.

We may update this Policy when Service features or legislation change. The current version is always published on this page with the update date.

Material changes may also be announced via in-app notification. Continued use after publication means acceptance of the revised Policy.

For personal data inquiries:

• Ticket: Support → new ticket (subject "Personal data")
• Telegram support: @INTmarketcc_support
• Telegram channel: @INTmarket_channel

Operator details (sole proprietor / LLC) will be published at public launch and can be requested via support.