Legal
Privacy
This policy explains what the L2JOne customer platform collects, why, who it is shared with and how you ask for removal.
What we collect
- Account: name, username, email, phone number and preferred language.
- Verification: codes sent by email or WhatsApp, stored hashed and short-lived.
- Social login: when you sign in with Google, Facebook or Telegram we receive the account identifier at that provider, the public name, the email address (when you allow it) and the profile picture. We never receive your password or your contact list.
- Purchases: orders, amounts, currency, status and the transaction reference at the payment provider.
- Access: pages visited, language, approximate country, browser and device, tied to a random identifier.
What we use it for
- Creating and running your account and customer area.
- Confirming identity and blocking automated sign-ups and fraud.
- Processing payments, issuing licences and delivering contracts.
- Providing support and sending operational notices about your project.
- Measuring site audience in aggregate.
How we protect it
- Passwords are stored as bcrypt hashes. Never in readable form, not even to us.
- Card details are handled by the chosen payment provider and never reach our servers.
- Integration credentials are encrypted with AES-256-GCM in the database.
- IP addresses are recorded only as a hash, for rate limiting and audit.
- All traffic uses HTTPS, with CSRF, XSS and SQL injection protection.
Who we share it with
- Payment providers: Mercado Pago, Stripe, PayPal and Binance Pay, only what a charge requires.
- Login providers: Google, Facebook and Telegram, when you choose to sign in with them.
- Messaging: the email provider and the Meta WhatsApp API, for confirmations.
- We do not sell personal data, run targeted advertising, or share your purchase history with third parties.
How long we keep it
- Account data: for as long as the account exists.
- Verification codes: minutes, set by the configured lifetime.
- Payment records and contracts: for the period required by law and by the contract.
- Access records: in aggregate form, without identifying the person.
Your rights
- Access, correct or export your account data.
- Revoke social login and unlink Google, Facebook or Telegram.
- Request deletion of the account and the personal data attached to it.
- Contact us about any use of data described here.
Data deletion
You can request account removal at any time, free of charge. The deletion page explains the steps, what is erased and what has to be kept for legal reasons.
How to delete my dataContact
Questions about this policy or about how your data is handled: support@l2jone.com