Privacy Policy

Effective date: October 20, 2026

This policy explains what personal data BotSlots collects, why, how long we keep it, and what rights you have. It applies to users from all countries — the rights section covers the EU/EEA standard (GDPR), California (CCPA/CPRA), and Russia (Federal Law 152-FZ "On Personal Data").

1. Who we are

BotSlots is operated by an individual operator. For the purposes of data protection law, the operator is the controller of your personal data. Contact for any privacy matter: mamalubitlal2@gmail.com.

2. What data we collect

• Account data — your email address and a salted hash of your password (we never store the password itself).
• Slot data — the Python files and configuration you upload, and the log output your bot produces. This may contain personal data if you put it there (for example bot tokens or user IDs your bot handles); treat your own logs accordingly.
• Payment metadata — invoice number, plan, period, amount and asset, CryptoBot invoice ID, and (for RU bank transfers) the transfer reference you submit. We never see and never store your wallet keys, card numbers, or bank credentials.
• Technical/security data — IP address and timestamps of panel logins and uploads, kept in short-lived server logs for abuse prevention and troubleshooting.

We do not use analytics services, advertising networks, or third-party trackers on the site.

3. Why we process it (and on what basis)

• To provide the service — creating your account, running your slots, showing your logs, support. Legal basis: performance of our contract with you.
• To get paid and keep records — processing payments via CryptoBot or SBP, matching invoices to activations. Legal basis: contract performance and, where record-keeping applies, legal obligation.
• To keep the service safe — login rate-limiting, abuse and AUP-violation detection, incident investigation. Legal basis: our legitimate interest in operating a secure service, balanced against your rights.
• To communicate service notices — invoice confirmations, maintenance or AUP warnings to your account email. Legal basis: contract performance.

We do not use your data for profiling, automated decision-making, or advertising.

4. Who we share data with

• @CryptoBot (Crypto Pay) — payment processing. Your payment data is processed by them under their own privacy policy; we only receive invoice status and metadata back.
• Our server/hosting provider — the physical infrastructure provider that runs the VPS the service lives on.
• Authorities — only where we are legally required or permitted (for example a valid law-enforcement request tied to a clear AUP violation).

We do not sell, rent, or trade your personal data — to anyone, ever. This also answers the California question: there is no "sale" or "sharing" of personal information as those terms are defined by the CCPA/CPRA.

5. International transfers

The service runs on servers that may be located outside your country of residence, and CryptoBot processes payments globally. Where personal data is transferred internationally, we rely on the transfer being necessary for the contract with you (GDPR Art. 49(1)(b)) or on the safeguards required by applicable law, and we keep transfers to the minimum set of providers listed above.

6. How long we keep data

• Account data — until you ask us to delete your account, plus up to 30 days in backups.
• Slot files and logs — while your slot exists; expired-slot files are deleted no earlier than 14 days after expiry.
• Technical/security logs — typically 14 to 90 days, then gone.
• Payment records — kept as long as accounting and tax law requires where applicable; otherwise deleted with the account.

7. Your rights

EU/EEA/UK (GDPR): access, rectification, erasure, restriction of processing, data portability, objection to processing based on legitimate interest, and the right to lodge a complaint with your supervisory authority.

California (CCPA/CPRA): the right to know what personal information is collected, to request deletion or correction, to opt out of sale or sharing (we do neither), and the right not to be discriminated against for exercising these rights.

Russia (152-FZ): the right to receive information about the processing of your personal data, to require clarification, blocking, or destruction of data that is incomplete, outdated, or unlawfully processed, and to withdraw consent to processing.

Everywhere else: you can always see and download your own data (it is in your dashboard), and you can ask us anything by email.

To exercise any right, email mamalubitlal2@gmail.com from your account email. We respond within 30 days.

8. Cookies

We use exactly one cookie: a functional session cookie ("s") that keeps you logged in after you sign in. It is HttpOnly and lasts 7 days. There are no analytics cookies, no advertising cookies, no fingerprinting, and no cookie banner is needed because the only cookie we set is strictly necessary for the service to work.

9. Security

Passwords are stored as salted hashes, sessions are signed and HttpOnly, the entire site runs over HTTPS, and each bot slot runs in an isolated systemd unit with memory and CPU caps so slots cannot access each other. We keep collected data minimal by design. No system is perfectly secure; if a breach affecting your data ever occurs, we will notify affected users without undue delay.

10. Children

BotSlots is not directed at children and we do not knowingly collect personal data from anyone under 16. If you believe a child's data has been provided to us, email us and we will delete the account.

11. Changes to this policy

We may update this policy as the service changes; the effective date at the top always reflects the current version. Material changes will be announced on the site in advance where practicable.

12. Contact

Privacy requests and questions: mamalubitlal2@gmail.com.