Privacy Policy

1. Data we collect

We collect the following categories of data:

• Account data: email address, hashed password or sign-in provider identifier (e.g. Google), account creation date and settings.
• Wallet and transaction data: deposits, debits, balances, order history, service selections, amounts, timestamps and payment references. We do not store full card numbers; payment processors handle those.
• Service data: details you enter for orders such as crypto destination and refund addresses, memos, dialed numbers, selected locations, rental durations, and SMS codes received on numbers you rent.
• Technical data: IP address, browser and device type, operating system, language, approximate location derived from IP, referral URLs, and security logs.
• Communications: messages you send to support and related metadata.
• Compliance data: identity or business documents if we request verification.

2. Data we do not collect

We do not log the content of traffic you route through proxies. We do not record dialer call audio. We do not access the content of virtual phones you rent except where needed to investigate abuse reported to us or required by law. Local preferences such as pinned services and your shopping cart are stored in your own browser.

3. How we use data

We use personal data to:

• create and secure your account and authenticate you;
• process wallet top-ups, debits, orders, renewals and refunds;
• deliver services through our suppliers;
• prevent fraud, abuse, chargebacks, money laundering and sanctions violations;
• provide support and send service and security notices;
• improve, debug and measure the performance of the Platform;
• comply with legal obligations and enforce our Terms.

4. Legal bases (EEA/UK)

We rely on performance of a contract (providing the services you order), legitimate interests (security, fraud prevention, improving the Platform), legal obligation (tax, accounting, AML), and consent (optional marketing, where requested). You may withdraw consent at any time without affecting prior processing.

5. Sharing and sub-processors

We do not sell your personal data. We share only what is necessary with:

• Infrastructure and hosting providers that run our database, authentication and servers;
• Proxy suppliers to fulfil proxy orders;
• Virtual device suppliers for phone rentals;
• SMS and number suppliers for verifications and rentals;
• Crypto exchange partners, which receive swap details including destination and refund addresses and may apply their own compliance checks;
• Telephony carriers for dialer calls;
• Payment processors, fraud-prevention services and professional advisers;
• Law enforcement, regulators or courts where legally required, or to protect rights, safety and property;
• A successor entity in a merger, acquisition or asset sale, subject to this Policy.

6. International transfers

Suppliers may process data outside your country, including in the United States and other countries. Where required, we use Standard Contractual Clauses, the UK International Data Transfer Addendum, or other lawful transfer mechanisms.

7. Data retention

Account data is kept while your account is open. Wallet ledger and order records are kept for 7 years after the transaction to meet tax, accounting and anti-money-laundering obligations. Security logs are kept for up to 12 months. SMS codes received on rented numbers are kept for up to 90 days. Support messages are kept for up to 3 years. Data is then deleted or anonymised.

8. Security

We use encryption in transit (TLS) and at rest, row-level access controls so users can read only their own records, server-side storage of supplier credentials, atomic wallet transactions, and least-privilege internal access. No system is perfectly secure; if a breach affects your data we will notify you and regulators as required by law, typically within 72 hours of becoming aware.

9. Your rights

Depending on your location (including under the GDPR, UK GDPR and California CCPA/CPRA) you may have the right to access, correct, delete, restrict or object to processing of your data, to data portability, and to not be discriminated against for exercising your rights. California residents may request disclosure of categories of data collected and shared; we do not sell or share personal data for cross-context behavioural advertising.

To exercise rights, email privacy@zitto.io. We will verify your identity and respond within 30 days (45 days for CCPA requests). Some data must be retained despite deletion requests, such as ledger records required by law. You may also complain to your local data protection authority, such as the UK ICO.

10. Cookies and local storage

We use strictly necessary cookies and browser storage to keep you signed in, protect against fraud, and remember your cart, pinned services and preferences. We do not use third-party advertising cookies. You can clear storage through your browser, but parts of the Platform may stop working.

11. Children

The Platform is not directed to anyone under 18 and we do not knowingly collect their data. If you believe a minor has created an account, contact us and we will delete it.

12. Changes to this policy

We may update this Policy. Material changes will be announced by email or in the dashboard before they take effect. The effective date above shows the latest version.