Privacy Policy - Perfect Deal

01

Data Controller & Scope of Policy

💡 IN PLAIN ENGLISH: This Privacy Policy applies to everything you do on Perfect Deal — whether interacting with our Telegram bot (@pDealbot), browsing the web download center, or connecting your business via our Reseller API. We operate as the responsible Data Controller for your information.

This Privacy Policy constitutes an official legal agreement between you ("User", "Customer", "Reseller", or "You") and Perfect Deal ("We", "Us", "Platform", or "Controller"), having its primary web domain at https://digioffers.xyz.

This policy covers all personal data, telemetry, and transactional metadata processed when you:

Interact with or execute commands in our Telegram Automated Store Bot (@pDealbot);
Access digital downloads, receipts, or verification tokens via our Web App endpoints (https://digioffers.xyz/download/*, https://digioffers.xyz/verify*);
Integrate, query, or execute wholesale orders via our Customer & Reseller REST API endpoints (https://digioffers.xyz/api/v1/*);
Deposit funds, transfer balances, or submit disputes regarding digital products or software licenses.

02

Categories of Information We Collect

💡 IN PLAIN ENGLISH: We only collect what is strictly necessary to deliver your digital goods instantly, credit your deposits, protect against malicious scammers, and process your orders.

We process information belonging to the following categories:

A. Telegram Account & Identity Metadata

When you message our bot or authorize our mini-app, the Telegram Bot API automatically transmits:

Telegram User ID (Unique numeric identifier used as your primary wallet account key);
Telegram Username (e.g. @username, if set);
Display Name (First name and optional last name as configured in your Telegram client);
Language Code (Used to serve menus in your preferred language);
Referral Code & Origin (Telegram ID of the user who invited you, if applicable).

B. Transactional & Ledger Records

Order Records: Order identification code (e.g. ORD-xxxxxx), purchased product catalog ID, item title, quantity, unit price, timestamp of fulfillment;
Digital Key Deliveries: Serial numbers, activation license keys, or accounts dispatched to you;
Top-Up Details: Deposit method (CryptoBot, OxaPay, Binance Pay, OrcusPay, bKash, Nagad, etc.), payment invoice IDs, fiat or crypto deposit amounts, and incoming blockchain Transaction Hashes (tx_hash) or MFS Transaction IDs (TrxID);
Ledger Balance: Real-time available wallet balance, cumulative total spent, and total deposited.

C. Anti-Fraud & Device Verification Telemetry

Network IP Address: Recorded when generating payment invoices or accessing web download portals to detect multi-accounting abuse, VPN proxies, and velocity attacks;
Device Verification Fingerprint: Browser screen resolution, user-agent string, platform type, and hardware canvas hash collected solely when completing device anti-sybil challenges (/verify-device);
Security Logs: Failed payment attempts counter, anti-fraud freeze timestamps, and dispute audit trails.

D. Reseller Developer API Credentials

Cryptographically generated API keys (X-API-Key);
Webhook callback URLs and HMAC-SHA256 signing secrets configured for downstream automated notification.

03

Information We NEVER Collect or Store

🛡️ ABSOLUTE SECURITY GUARANTEE: We never ask for, collect, or store your private banking credentials, credit card numbers, or cryptocurrency private keys. All financial transactions are non-custodial or processed via verified external payment processors.

To eliminate custodial vulnerability, Perfect Deal strictly maintains that:

NO Credit / Debit Card PANs or CVVs: We never prompt for or handle full 16-digit credit card numbers, expiration dates, or CVV security codes. Any card payments facilitated through gateways (such as Orcus Pay) are entered directly on PCI-DSS Level 1 compliant gateway checkout pages;
NO Private Keys or Seed Phrases: We will never ask for your 12/24-word recovery seed phrase, private cryptographic keys, or Web3 wallet passwords;
NO Mobile Banking PINs: We never ask for your personal bKash, Nagad, or Rocket secret PIN numbers. Manual deposits are handled strictly through peer-to-peer "Send Money" or merchant QR transactions on your official provider app;
NO Telegram Account Passwords / 2FA Cloud Passwords: Telegram's security architecture protects your password; we operate strictly through bot tokens and webhook events.

04

Lawful Bases for Processing (GDPR Art. 6)

💡 IN PLAIN ENGLISH: Under data protection laws like GDPR, we must have a valid legal justification to process your information. Our primary reasons are executing your purchases, safeguarding the platform from bad actors, and keeping legal financial records.

Processing Purpose	Data Categories	GDPR Legal Basis
Digital product delivery & order fulfillment	Telegram ID, Order SKU, License Keys	Art. 6(1)(b) Contractual Performance
Wallet top-up crediting & ledger accounting	Transaction ID, Crypto tx_hash, amount	Art. 6(1)(b) Contractual Performance
Anti-fraud, sybil defense & device verification	IP address, device fingerprint, failed attempts	Art. 6(1)(f) Legitimate Interests
Financial auditing & tax record keeping	Timestamped order ledger, payment receipts	Art. 6(1)(c) Legal Compliance
Optional email receipts & restock alerts	Email address, notification preferences	Art. 6(1)(a) Explicit Consent

05

How Your Information is Used

We process collected data exclusively for the following operational workflows:

Instant Fulfillment & Key Allocation: Validating your balance, reserving available stock keys from our encrypted inventory pool, and dispatching credentials through Telegram or single-use download links;
Payment Gateway Reconciliation: Parsing incoming webhook notifications from CryptoBot, OxaPay, Orcus Pay, and OwnPay to match order invoice parameters and credit your account immediately;
Customer Support & Dispute Investigation: Reviewing order logs and key allocation timestamps when you open a support ticket or dispute regarding defective credentials;
Automated Defense & Rate-Limiting: Enforcing API request quotas (e.g. 60 requests/minute), detecting fraudulent double-spend attempts, and blocking brute-force attacks;
Community & Store Updates: Sending critical operational messages, maintenance alerts, or promotional announcements if you have subscribed to our official channel.

06

Third Parties & Payment Gateways

💡 IN PLAIN ENGLISH: We never sell your data to advertisers or marketers. We only communicate with payment processors to confirm your deposits and upstream suppliers to deliver software licenses anonymously.

We share limited information only with vetted infrastructure partners:

1. Telegram Messenger (FZ-LLC)

Routes encrypted messages between your client and our bot server under Telegram's standard Privacy Policy.

2. CryptoBot & OxaPay

Receives order invoice IDs and crypto amounts to verify on-chain settlements (USDT, TON, BTC, etc.).

3. Orcus Pay & OwnPay (MFS)

Processes bKash, Nagad, and Rocket mobile financial payments via tokenized checkout sessions.

4. Upstream Suppliers (AIVerse / DongVanFB)

Receives strictly anonymous product requests. No user Telegram ID, username, or personal metadata is ever transmitted to upstream suppliers.

Legal Disclosures: We will only disclose personal records to law enforcement agencies if compelled by a legally binding court order or valid subpoena issued by a court of competent jurisdiction.

07

Cookies & Local Storage

Perfect Deal is committed to a zero-tracking cookie policy. We do not use third-party analytics trackers, behavioral ad pixels (e.g. Facebook Pixel, Google Ads Tag), or fingerprint cross-site trackers.

We use strictly essential technical storage solely for:

Admin Session Authentication: Encrypted, HttpOnly, SameSite=Strict cookies used exclusively to authenticate administrators accessing the Command Center;
CSRF Protection: Non-trackable anti-forgery tokens preventing malicious cross-site request exploitation;
Device Verification Token: Ephemeral token stored during web anti-sybil checks (valid for 1 hour).

08

Data Retention Lifecycle

Data Category	Retention Window	Lifecycle & Purge Protocol
Financial & Ledger Transactions	5 Years (Audit statutory)	Immutable ledger records retained for financial and anti-money laundering compliance.
Digital Goods Download Links	24 to 72 Hours	Tokens expire automatically; items remain in your Telegram private history.
Device Verification & IP Logs	30 Days	Automated rolling purge cleanses verification logs older than 30 days.
Temporary Tool OTP / Mail Cache	1 to 24 Hours	Ephemeral cache destroyed immediately upon expiration.

09

Security & Encryption Standards

We deploy defense-in-depth engineering practices to secure your data:

TLS 1.3

Strict HTTPS Transport

End-to-end encrypted cipher suites with Perfect Forward Secrecy.

HMAC-SHA256

Webhook Signatures

Every payment and reseller webhook is cryptographically verified.

BCrypt & Salt

Credential Storage

Admin passwords and sensitive tokens hashed with high work-factors.

10

Your Privacy Rights (GDPR / CCPA)

Regardless of your geographic location, Perfect Deal guarantees you the following rights:

Right of Access (Art. 15 GDPR): You may inspect your complete order and ledger history directly in Telegram via the /orders menu command or request a consolidated JSON export;
Right to Rectification (Art. 16 GDPR): You may update your linked notification email or preference toggles via bot settings at any time;
Right to Erasure ("Right to be Forgotten" - Art. 17 GDPR): You may request the deletion of your user profile. Please note that statutory legal and AML accounting obligations require completed transaction ledgers to be preserved in an anonymized state;
Right to Data Portability (Art. 20 GDPR): You have the right to receive your structured purchase history in machine-readable JSON format.

To exercise any of these rights, contact our Data Protection representative directly on Telegram: @askmenowanything. We resolve all valid requests within 72 hours.

11

Children's Privacy Protection (18+ Policy)

The services, bot automations, and digital products offered by Perfect Deal are strictly intended for individuals who are at least 18 years of age (or the legal age of majority in your jurisdiction).

We do not knowingly collect personal data from minors under the age of 18. If we discover that an individual under 18 has created an account or transacted through the bot, we will immediately freeze the account, purge non-financial telemetry, and prohibit future access.

12

Policy Amendments & Contact Details

We reserve the right to revise this Privacy Policy periodically to reflect changes in applicable legal frameworks, technology architectures, or payment integrations. Material revisions will be broadcast to users through our official Telegram announcement channel (@pDealChannel) with a minimum of 7 days prior notice.

Official Contact & Escalation Channels:

Telegram Support Handle: @askmenowanything

Official Announcements: @pDealChannel

Official Community Group: @pDealGroup

Email Inquiries: store@digioffers.xyz

Compliance Website: digioffers.xyz

Automated Store Bot: @pDealbot

Privacy Policy & Data Protection