Legal

Privacy policy

Last updated September 26, 2026

This policy explains what personal data SMM Shiro collects, why, and what rights you have under the Philippine Data Privacy Act of 2012 (Republic Act No. 10173). For questions or requests, email support@smmshiro.com.

What we collect

Account: your email address and your password, stored only as a one-way hash (Argon2). We cannot read your password.
Orders: the links you submit, the services, quantities and any custom comments you enter, and their status.
Payments: top-up amounts, status and PayMongo's reference. You pay on PayMongo's checkout; we never see your GCash, Maya, bank or card details.
Wallet: a record of every change to your balance (top-ups, orders, refunds, referral commission).
Referrals and API: who referred you, if anyone, and a hash of your API key if you create one.
Technical data: your IP address and browser details, which our hosting and security providers log, and which we use to limit repeated failed logins.

Why we use it

To run your account, deliver orders, process top-ups, refunds and refills (performance of our agreement with you).
To keep the site secure and prevent fraud and abuse (legitimate interest).
To keep financial records as tax and accounting law requires (legal obligation).
To answer you when you contact support.

Logged-in customers can see a "Recently completed" list of orders delivered on the site. It shows only the service, quantity and delivery time, never your link, account, email or name.

We don't sell your data, we don't use advertising trackers or third-party analytics, and we don't send marketing email.

Who we share it with

Only the service providers that run the site, each for its own part:

PayMongo (Philippines): payment processing.
Our SMM suppliers: the link, quantity and comments of each order, which they need to deliver it. Never your email or name.
Render (United States): application hosting.
Neon (United States): database hosting.
Cloudflare (global): domain, security and content delivery.
Google Fonts: your browser loads our fonts from Google, which sees your IP address.

Some of these providers store data outside the Philippines. We use providers that protect data with encryption in transit and at rest. We will also disclose data when the law requires it.

Cookies and local storage

session: keeps you logged in. Strictly necessary; set only after you log in or sign up.
theme (local storage): remembers light or dark mode on your device.

We use no advertising or tracking cookies.

How long we keep it

We keep account and order data while your account is open. When you ask us to delete your account, we delete or anonymize your email, links and comments, and keep only the payment and wallet records that tax and accounting law requires us to keep, for as long as it requires.

Your rights

Under the Data Privacy Act you have the right to be informed, to access your data, to object, to correct it, to have it erased or blocked, to data portability, and to claim damages. Email support@smmshiro.com to use any of them; we reply within 15 days. If you're not satisfied, you can complain to the National Privacy Commission.

Security

Connections are encrypted (HTTPS), passwords are hashed, login attempts are rate limited, and access to the database is restricted. No system is perfectly secure; if a breach affects your data, we will notify you and the National Privacy Commission as the law requires.

Children

The site is not meant for children under 18 without a parent or guardian's permission.

Changes

We will post changes here and update the date above. Significant changes will also be announced on the site.