Privacy

What we collect

• Account: name, username, email, phone number and preferred language.
• Verification: codes sent by email or WhatsApp, stored hashed and short-lived.
• Social login: when you sign in with Google, Facebook or Telegram we receive the account identifier at that provider, the public name, the email address (when you allow it) and the profile picture. We never receive your password or your contact list.
• Purchases: orders, amounts, currency, status and the transaction reference at the payment provider.
• Access: pages visited, language, approximate country and device type, linked to a browser identifier. Signed-in visits are also linked to your account.
• Portfolio: public name, introduction, photo, titles, descriptions and work links published on the member page.

What we use it for

• Creating and running your account and customer area.
• Confirming identity and blocking automated sign-ups and fraud.
• Processing payments, issuing licences and delivering contracts.
• Providing support and sending operational notices about your project.
• Measuring audience and distinguishing signed-in visits from guests. Only staff with user-management access can see the associated account identity.

How we protect it

• Passwords are stored as bcrypt hashes. Never in readable form, not even to us.
• Card details are handled by the chosen payment provider and never reach our servers.
• Integration credentials are encrypted with AES-256-GCM in the database.
• IP addresses are recorded only as a hash, for rate limiting and audit.
• All traffic uses HTTPS, with CSRF, XSS and SQL injection protection.

Who we share it with

• Payment providers: Mercado Pago, Stripe, PayPal and Binance Pay, only what a charge requires.
• Login providers: Google, Facebook and Telegram, when you choose to sign in with them.
• Messaging: the email provider and the Meta WhatsApp API, for confirmations.
• Portfolios: images load from services selected by members and thumbnails come from YouTube. Playing a video loads the YouTube player and sends connection data according to the provider policy.
• We do not sell personal data, run targeted advertising, or share your purchase history with third parties.

How long we keep it

• Account data: for as long as the account exists.
• Verification codes: minutes, set by the configured lifetime.
• Payment records and contracts: for the period required by law and by the contract.
• Access records: the account link is removed when your account is deleted; audience counts are retained.
• Account-linked portfolios are deleted with the account. For pages managed solely by the administrator, request removal using the contact below.

Your rights

• Access, correct or export your account data.
• Revoke social login and unlink Google, Facebook or Telegram.
• Request deletion of the account and the personal data attached to it.
• Contact us about any use of data described here.

Contact

Questions about this policy or about how your data is handled: support@l2jone.com