Privacy policy | Mena-Pin

This policy explains what we collect about you, why, who we share it with, and how long we keep it.

What we collect

Account details: your name, your email address, and your trading name if you have given one.
Trading history: orders, wallet movements, and top-up payments.
Technical data: IP address, sign-in times, failed sign-in attempts, and a record of API use.
An administrative record: what our staff changed on your account, who changed it, and when.
The account id you enter to place a direct top-up. That is an id at the service being topped up, not personal information we ask of you.

To fill and deliver orders.
To keep an accurate financial record of your account, which is an accounting obligation rather than a choice.
To prevent fraud and to rate-limit the API.
To contact you about your account and your orders.

**Whoever fills the order** receives only what filling it requires: the product identifier, the id you entered, and a reference for the order. They do not receive your name, your email address or your account details.
**The service that receives top-up payments** is sent the amount of the payment, its network and a reference for it, and nothing else. We do not send it your name, your email address or your account details.
**Our email provider**, to deliver verification messages and notifications.
A court or a regulator, where the law requires it.
**We do not sell your data, do not share it for advertising, and do not use it to build marketing profiles.**

We use a session cookie that keeps you signed in, and one that protects forms against request forgery. That is all.
There is no advertising tracker and no third-party analytics tool on this site.

Financial records — orders and wallet movements — are kept for as long as the account exists, and after it closes for as long as accounting and legal obligations require.
Webhook delivery records are deleted automatically after a short period set in the platform's configuration.
Sign-in attempts and the administrative record are kept for security and audit.

To see your data and ask for a copy of it.
To have anything incorrect corrected.
To have deleted anything we are not required to keep for legal or accounting reasons.
To withdraw consent for notification emails, while necessary account emails continue.
To ask for any of these, write to the contact address published in the site footer.

Passwords are stored hashed and nobody here can read one.
API keys are stored hashed too: a key is shown once when it is created and cannot be recovered afterwards — only revoked and replaced.
Two-factor authentication is available on your account, and we recommend turning it on.