Operator / data controller
Yang Ding · Individual operator
SMMRoute · smmroute.com
Support, billing and privacy: support@smmroute.com
1. Data controller
The SMMRoute operator identified below is responsible for personal information processed to run this service. Send privacy requests to the listed support email and identify them as privacy requests. Payment providers may independently control information needed for their own payment, fraud, tax and legal obligations.
2. Information we collect
Account information includes email, display name, optional avatar and login-provider/authentication records. Orders include service, public target URL, quantity, price, status, delivery/refill records and order-time IP address. Payment records include amount, currency, identifiers, status and verified receipt information. We also process messages you send to support.
Infrastructure and analytics may record page visits, referral/campaign information, browser/device information, timestamps, errors and approximate country/city derived from IP addresses. We do not request precise GPS location or your social media passwords. Only information you authorize through a third-party sign-in is used for that sign-in.
3. Payment information
Waffo Pancake processes card details on its hosted checkout. Full card numbers and card security codes are not stored on SMMRoute servers. We send the checkout email, amount and transaction reference, and receive the payment confirmation needed to reconcile your balance. Cryptocurrency payments, where offered, are processed by Cryptomus; blockchain transactions may be publicly visible.
4. Purposes and legal bases
We process account, payment and order data to perform our contract with you; support, security and proportionate service analysis to pursue legitimate interests where permitted; and financial or regulatory records to meet legal obligations. Optional processing that legally requires consent relies on that consent. Withdrawal of consent does not invalidate earlier lawful processing. We do not use submitted order targets to train AI models.
7. Security and incidents
Safeguards include HTTPS, authentication, restricted database access, server-side secrets and payment-signature verification. No system is completely secure. Report suspected compromise promptly. Where GDPR applies and notification is required, we notify the competent authority within 72 hours of awareness where feasible, and affected people without undue delay when required. Other applicable notification deadlines also apply.
8. Retention and deletion
We keep active account and order records while needed to provide the service. On a verified closure/deletion request, we aim to delete or anonymize eligible account information within 90 days, after resolving outstanding orders, balances and disputes.
Financial, fraud and dispute records may need to remain longer under applicable accounting, legal or claims requirements. The exact statutory period depends on the operator's jurisdiction and the record; we can explain the applicable period when responding to your request. Information still needed for a legal hold is restricted rather than used for unrelated purposes. Payment providers apply their own retention obligations.
9. Your privacy rights
Depending on applicable law, you may request information, access, correction, deletion, restriction, portability, objection or withdrawal of consent. California residents may also have rights to know, correct or delete information and to opt out of sale/sharing; we do not sell or share it for cross-context advertising. We do not discriminate for exercising applicable privacy rights.
Email support to make a request. We may verify identity proportionately and aim to respond within 30 calendar days, subject to applicable legal deadlines and permitted extensions. You may use an authorized agent where law permits and complain to your local data protection authority or other competent regulator.
10. International processing
SMMRoute uses a Supabase database in Japan and internationally distributed hosting and service providers, which may process information in the United States and other countries. Where transfer safeguards are legally required, the appropriate provider terms and lawful transfer mechanism must apply, such as applicable adequacy decisions or standard contractual clauses. Contact us for information about a particular transfer.
11. Age limits and communications
The service is for adults aged 18 or over. We do not knowingly collect children's information. Contact us if a child has supplied personal data so we can investigate and delete eligible information. To stop marketing contact, reply requesting removal or email support; essential order, billing and security notices may still be sent.
12. Other services and policy updates
Third-party sites and providers have their own privacy policies. This policy covers SMMRoute's processing. We will announce material changes on the website or by email, normally fourteen days before they take effect, except where urgent legal or security needs require otherwise. Where a new use requires consent, we will obtain it separately. The version date appears at the top of this page.