Privacy Policy

This describes what BuyByteData records, why, and what is deliberately not recorded. Every statement below describes the platform as it is built rather than as a policy aspires to.

Recording happens in four places, for four reasons.

1. 1.Your account — name, phone number, email address and state. Your password and transaction PIN are stored only as hashes and cannot be read back by anyone, including us.
2. 2.Your wallet and funding — your balance, the dedicated account number reserved for you, and each transfer credited to it.
3. 3.Your transactions — what you bought, the recipient details you supplied, what was charged, and the outcome.
4. 4.Your sign-ins — the time and address of your last sign-in, and the session itself.

1. 1.To deliver what you buy. A recipient number is sent to the provider fulfilling that purchase, because the purchase cannot be delivered without it.
2. 2.To keep your balance correct. Every movement of money is recorded in a double-entry ledger that must reconcile.
3. 3.To answer questions about a transaction, months later, from the record rather than from memory.
4. 4.To secure your account — rate limiting, PIN lockouts and the sign-in record exist for this.

Accounts on the API plan generate one additional kind of record: a log of the requests their server makes.

1. 1.Each request records which key was used, the method, the endpoint name, the response status, how long it took and the calling address.
2. 2.Request headers, request bodies, response bodies and query strings are deliberately not recorded. A request to this API carries a live credential in a header and a customer’s phone number in a body, and a log holding either would be a credential leak and a privacy breach with a long retention period.
3. 3.The endpoint NAME is recorded rather than the URL, because a URL can carry a transaction reference and a name cannot.
4. 4.API keys are stored as hashes. The key itself is shown once when it is created and cannot be retrieved afterwards by anyone, including us.

1. 1.Service providers, who receive the details needed to deliver a specific purchase and nothing else.
2. 2.Our payment processor, which operates the account number your transfers arrive at.
3. 3.Nobody else. BuyByteData does not sell customer information and does not share it for advertising.

BuyByteData sets two cookies, both necessary and neither used for tracking.

1. 1.A session cookie that keeps you signed in. It cannot be read by JavaScript.
2. 2.A token used to protect requests against cross-site forgery.

There is no advertising cookie, no third-party analytics cookie and no tracking pixel, which is why the site asks for no cookie consent.

1. 1.You can see and correct your name and state from your profile at any time.
2. 2.Your transactions, wallet activity and support tickets are visible to you in full within the application.
3. 3.There is no self-service export or account deletion in the application today. To ask for either, contact support — the request is handled by a person.

1. 1.Passwords, transaction PINs and API keys are stored as hashes and never in a readable form.
2. 2.Every request is scoped to the signed-in account. A transaction or ticket belonging to another account answers "not found" rather than confirming it exists.
3. 3.Balance changes are enforced by the database itself, not only by application code.

Questions about this document go to support. Signed-in customers can open a ticket, which attaches their account and any transaction they are asking about; anyone else can use the contact page.

BuyByteData has not published a support telephone number or a direct email address. Anyone offering one is not us.