What we collect about the businesses that rent a panel from us and about their customers, why we collect it, who else receives it, how long we keep it, and what you can ask us to do with it.
· Operated by Jeskie Services Ltd, Nairobi, Kenya
Jeskie Services Ltd runs this website and the panel software ("Jeskie SMM Reseller Platform", "we", "us"). We are based in Nairobi, Kenya. For anything in this policy, write to [email protected].
This policy covers our website, our admin and the shops that run on our software. Each shop is a separate business; the next section explains who is responsible for what.
A business that rents a panel from us (a "shop") sells to its own customers under its own name. For the personal data of those customers, the shop is the controller: it decides why the data is collected and what is done with it, and it publishes its own privacy policy. We are the processor: we store and handle that data only to run the shop's panel, and only on the shop's instructions.
If you are a customer of a shop, contact the shop first. If you cannot reach it, write to us and we will pass your request on or deal with it ourselves.
Account details: business name, email address, password (stored only as a one-way hash), country, currency, language and time zone, and the name and email address of each member of staff you add.
Your WhatsApp number, for billing reminders and account alerts. We never use it for marketing.
Your Google account identifier and name, if you sign in with Google.
Your shop's settings and content, and the API key of your supply account, which is stored encrypted.
Billing records: your plan, your invoices and the payments you make to us.
If you ask us to collect payments for you: your legal name, country, payout details, an identity or business registration document, and your withdrawal history.
Security records: a log of the actions taken in your admin, with the time, IP address and browser used, and a list of the devices that have signed in to your account.
The date you accepted our terms and the version you accepted.
On behalf of each shop:
Account details: name, username, email address, password (as a one-way hash), language, country, currency and time zone; a Google identifier if they sign in with Google; passkeys and two-factor settings if they turn them on.
Their balance and every movement on it, their orders and the links they ordered for, and their support tickets with anything attached to them.
Payments: the amount, method and reference; the mobile money number, where a payment needs one; any receipt image they upload, with its location data removed on upload; and the confirmation the payment provider sends back.
Security records: the IP address and browser used to sign in and to change account details, and a list of the devices that have signed in. The shop can see these, so that it can spot shared or misused accounts.
The dates they accepted the shop's terms and its rule that added funds are not refundable.
Social media passwords, card numbers, card security codes, mobile money PINs or online banking credentials. An order only needs a public link. Card and wallet details are typed on the payment provider's own page or in its phone prompt, never on ours.
To provide the service: running panels, placing orders, taking and matching payments, paying out withdrawals and answering support. We need the data to perform our contract with you.
To keep accounts and money safe: sign-in checks, and preventing fraud, abuse, shared accounts and dishonest payment reversals. This is our legitimate interest, and the shop's.
To keep the financial and identity records the law requires, and to answer lawful requests. This is a legal obligation.
To send service messages: email verification, sign-in codes, receipts, and notices about orders, billing and your account, by email and, where you gave a number, by WhatsApp. We do not send marketing unless you ask for it.
We do not sell personal data, and we do not share it with advertisers or data brokers. We use these service providers, each only for its own task:
Payment providers (mobile money, card, bank and crypto payment companies): the amount and, depending on the method, the payer's name, email address or mobile number.
Cloudflare: carries all traffic to our sites, protects them against attacks, runs the automated check on signup forms that tells people from bots, and connects custom domains.
Google: only when somebody chooses to sign in with Google.
Our email delivery provider and our WhatsApp messaging provider: the address or number, and the message.
Our hosting and backup storage providers.
The supply panel a shop connects: the link and quantity of each order, and never who placed it.
We may also disclose information when the law requires it; to protect people from fraud or harm, including to a payment provider or the police when a payment has been dishonestly reversed; or to a buyer if our business is sold, who would then be bound by this policy.
We only use the cookies our sites need to work, such as the one that keeps you signed in. We use no advertising or analytics cookies. Every cookie is listed in our cookie policy.
Account data: for as long as the account is open.
Balances and their history, payments, invoices and withdrawals: for as long as the account exists, and afterwards for as long as the law requires financial records to be kept (in Kenya, up to seven years).
Identity verification documents: for as long as the shop exists, and deleted with it. A document you replace is deleted immediately.
Sign-in sessions: until the browser closes, or 120 minutes after the last activity. "Keep me signed in on this device" lasts for the period you choose on that device, and ends sooner if you sign out or forget the device.
IP addresses and browser details in our security logs, and the list of signed-in devices: 12 months.
WhatsApp message history: 180 days.
Database backups: the last 14 on our server, and 30 days with our backup storage provider.
The public demo shop is wiped every night.
When a shop closes: its customers, their balances and their order history are kept for 90 days and then deleted. Paying for a plan inside those days brings the shop back with everything in it. After them, all that is left is a count of what the shop held, with nothing in it about a person.
When an account is closed, we delete or anonymise what we no longer need and keep only the records above, for the periods above.
Passwords are stored as one-way hashes. API keys and payment credentials are encrypted. All traffic uses HTTPS. Each shop's data is kept separate from every other shop's. Only the people who need access to our systems have it. No system is perfectly secure: if a breach affects your data, we will tell you, and the regulator, as the law requires.
Our servers and backups may be outside your country. When data leaves Kenya or your own country, we only use providers that protect it to the standard the law requires.
You can ask us for a copy of the personal data we hold about you. You can also ask us to correct it, delete it, limit or object to how we use it, or give it to you in a portable format. Write to [email protected] from the address on your account. We reply within 30 days. Some records, such as payment records, we must keep even after a deletion request; if so, we will tell you which ones.
If you are not satisfied with our answer, you can complain to the Office of the Data Protection Commissioner in Kenya, or to the data protection authority where you live.
Our service is not for anyone under 18. We do not knowingly hold data about children. If we find out that we do, we delete it.
We post every change on this page with a new date. If a change matters, we also tell shops by email before it takes effect.