# Privacy Policy

> What data CryptoLike collects and why, cookies and analytics consent, who processes it, where it is stored, how long it is kept and how to use your rights.

Source: https://cryptolike.net/legal/privacy
Updated: 2026-10-12

This policy explains what personal data CryptoLike collects when you use the website cryptolike.net, the cabinet, the API, the payment page and the Telegram bot, why we use it, who helps us process it, where it is stored and for how long. It describes how the product works today and is not legal advice. Questions: [support@cryptolike.net](mailto:support@cryptolike.net).

## What data we collect

**Your account.** The e-mail address, the project name and the password, which we store only as an argon2id hash. If you turn on two-factor authentication (2FA), we store its secret encrypted and the recovery codes as hashes. In the cabinet you may also add a logo, a default currency and notification settings.

**Verification (KYB).** The documents you upload to verify the account, such as registration documents, an identity document of a director or a proof of address, and the reviewer's decision and comment.

**Sign-in and security.** IP addresses and browser data (user agent) of sign-ins and sessions; the security log of your account (sign-ins, changes to passwords, 2FA, API keys and the whitelist); failed sign-in attempts; a short fingerprint of the browser (a hash of the user agent) of each sign-in, to notice a sign-in from a new device.

**Payments and payouts.** Invoices and their data you send through the API (order number, description, metadata), deposit addresses, the sender's blockchain address, transaction hashes (txid) and amounts, the screening result of a transfer when it is screened, payout addresses and the whitelist, API keys with their allowed IP addresses and the last IP used, and your webhook addresses. Blockchain transactions are public by the nature of the network.

**Telegram.** If you link the Telegram bot: your Telegram user ID, chat ID, username, first name and language; for a linked group, its chat ID and title.

**Messages to us.** When you use the contact form: your name, e-mail address, message, language, IP address and browser data.

**Website and cabinet usage.** Cookies and similar storage described below; with your consent, analytics events.

**When you pay a business.** The payment page shows the invoice the business created. We process the payment data listed above and technical data of your visit, such as the IP address, to operate and protect the page. The payment page does not load analytics. Questions about an order go to the business you pay.

## Why we use it and on what basis

- **To provide the service** under our agreement with you ([Terms of Use](https://cryptolike.net/legal/terms)): the account and sign-in, payments, balances, payouts, notifications and support.
- **To protect accounts and the platform**, a legitimate interest: sign-in limits, lockouts and bot checks, the security log, alerts about new sign-ins, fraud prevention.
- **To screen transactions and verify accounts** (AML and KYB), to meet legal requirements and as a legitimate interest in keeping the platform free of illicit funds.
- **To keep records** of payments and balances: the ledger and reports.
- **To understand how the website and the cabinet are used**, only with your consent to analytics cookies.

## Cookies and your consent

Necessary cookies are always set, because the site and the cabinet do not work without them:

| Cookie | Purpose | Lifetime |
|---|---|---|
| `cl_session` | Your cabinet session | Ends after 24 hours without activity, 30 days at most |
| `cl_locale` | The site language: set on your first visit, changed when you pick another language | 1 year |
| `cl_consent` | Your choice about analytics cookies | 13 months |

Analytics cookies (`_ga`, `_ga_*`) are set only after you accept them in the cookie banner. Until you accept, or if you decline, the analytics script on the site and in the cabinet sets no cookies and sends only cookieless signals without identifiers. Analytics events never include your e-mail, account or merchant IDs, blockchain addresses, transaction hashes, amounts or API keys, and page addresses and links are sent without their query parameters, except campaign (UTM) tags, and without the part after `#`. Parts of a page address that look like an ID, a blockchain address or a key are replaced with a placeholder. The analytics provider keeps event data for 14 months. Advertising signals and ad personalisation are off.

To change your choice, open **Cookie settings** in the site footer, in the user menu of the cabinet, or below the sign-in form. If you withdraw consent, the analytics cookies are deleted. The site and the cabinet also keep a few settings in your browser's storage, not in cookies. Local storage holds the theme (`cl.theme`) and the cabinet language (`cl.locale`); a referral code from a sign-up link (`cl.referral`), until your e-mail address is confirmed and for 30 days at most; whether you hid the «Your first payment» checklist and which dashboard blocks were shown last time (`cl.onboarding.hidden`, `cl.dashboard.*`); which one-time analytics events were already sent (`cl.ga.once.*`); on the payment page, the network and coin of your last payment, to mark them next time (`cl.checkout.lastCoin`) — no amounts, addresses or order details. The storage of the current tab, cleared when you close it, holds a referral code (`cl.ref`), the campaign (UTM) tags of the link you came by (`cl.utm`) and the reports being prepared in the cabinet (`cl.statement.jobs`). None of it holds your password or API keys.

## Who processes data for us

We share data with service providers that we need to run CryptoLike, and only the data each one needs:

- **Hosting and storage**: our servers, file storage and backups.
- **E-mail delivery**: account, security and notification e-mails.
- **AML screening**: blockchain addresses and the network, to assess the risk of a transfer.
- **Blockchain infrastructure**: access to the networks, to read and send transactions.
- **Bot protection**: on the sign-in form after failed sign-in attempts on an account, and on the sign-up and password-reset forms when we turn the check on there (we can also turn it on for every sign-in); the check receives your IP address and the data from your browser it needs to tell a person from a bot.
- **Analytics**: website and cabinet usage events, as described above.
- **Telegram**: messages of the bot, if you link it.

Some data is also visible to other users of CryptoLike, because the service works that way:

- **The business you pay** sees your payment: the coin and network, the amount, the address you paid to and the transaction hash (txid). Blockchain transactions are public, so anyone who has the txid, including the business, can look up the sending address.
- **If you signed up through a referral link,** the account that invited you sees your e-mail address in masked form (for example `j***@e***.com`), the date you signed up, and the rewards it receives from your fees, totalled by day. It does not see your full e-mail address, your addresses or your transactions.

We may disclose data when the law requires it. We do not sell personal data.

## Where data is stored

Our servers, with the database, run in the European Union (Frankfurt, Germany). Uploaded files, such as verification documents, generated reports and backups are kept in encrypted object storage in Canada. Some service providers, such as the analytics provider, may process data in other countries.

## How long we keep it

| Data | How long |
|---|---|
| Cabinet session | 24 hours without activity, 30 days at most |
| E-mail links | Address confirmation 24 hours, password reset 1 hour, team invitation 7 days |
| Generated report files | 24 hours after the report is ready |
| Technical logs, including IP addresses | Up to 30 days |
| Backups | About 90 days |
| Analytics events | 14 months |
| Telegram: your Telegram IDs, username and name | While your account exists; after you unlink the bot, as a record of the link |
| Messages sent through the contact form | As long as needed to answer them and keep a record of the request |
| Account data, verification documents, the security log, payment and ledger records | While your account exists; after closure, as long as needed to meet legal, accounting and security obligations |

Ledger entries and security logs cannot be edited or deleted in the product, so that balances and account history can always be checked.

## How we protect data

- Passwords are stored as argon2id hashes; 2FA secrets, API secrets and webhook secrets are stored encrypted.
- Connections to the site, the cabinet and the API use HTTPS; uploaded files and backups are encrypted at rest.
- Staff access to the administration panel is limited to approved network addresses and needs 2FA; what a staff member can see and do depends on their role, and admin actions are written to an audit log that cannot be edited.

More on how accounts and payouts are protected: [security](https://cryptolike.net/security).

## Your rights

You can ask us to:

- **give you access** to the personal data we hold about you;
- **correct** data that is wrong or incomplete;
- **delete** your data, where we do not have to keep it;
- **stop or limit** processing you object to, where it is based on our legitimate interest;
- and you can **withdraw your consent** to analytics at any time in Cookie settings.

Some data you can change yourself: in the cabinet you edit the project and notification settings, turn digests off and unlink Telegram. For anything else, write to [support@cryptolike.net](mailto:support@cryptolike.net) from the e-mail address of your account, so that we can confirm the request comes from you. You may also complain to the data protection authority where you live.

## Changes to this policy

We update this policy when the product or the way we process data changes. The current version is always on this page with the date of the last update; we tell you about significant changes by e-mail or in the cabinet.

## Contact

Questions about privacy and requests about your data: [support@cryptolike.net](mailto:support@cryptolike.net).

*Last updated: October 2, 2026.*