Privacy policy
This policy explains what personal data BIL BAZ FOR SOCIAL MEDIA APPLICATIONS DEVELOPMENT & MANAGEMENT ("BAZ", "we") collects on BazSocial.com, why, who receives it, how long we keep it and your rights. It follows the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and Article 10 of Federal Decree-Law No. 14 of 2023. Contact for privacy questions: support@bazsocial.com or a privacy ticket in your dashboard.
1. What we collect
| Data | When |
|---|---|
| Name, email, username, mobile number (if you gave it), password (stored only as a one-way hash) | When you create or use an account |
| Payment records: amount, fee, total, payment method, provider reference, status, invoice. We do not receive card numbers; Stripe, PayPal and Heleket process them | When you pay |
| Wallet history and BAZ Agency orders: links to the public posts or profiles you give, quantities, comments you write for comment services | When you top up or order |
| Trading memberships: your TradingView username, MT5 account number, Telegram user id and username | When you buy or connect them |
| Support tickets and messages; Bil Baz campaign inquiries (name, company, contact, message) | When you contact us |
| WhatsApp: your WhatsApp number, profile name and the messages you exchange with us; if you link the number from your dashboard, the account it belongs to | When you message us on WhatsApp |
| Consent choices for cookies (with no IP address) | When you choose in the cookie banner |
| Click counts on outbound, deal and broker links, stored with no IP address, cookie or account id (a daily anonymous hash only lets us count a visitor once per day) | When you follow a tracked link |
| The type of site that sent you to us (for example a search engine, an AI assistant or a social site), the referring site name and the page you arrived on, stored the same way; the type of site is also kept in your session and recorded with a payment you make in that session | When you arrive from another site |
| With your advertising consent only: pixel identifiers set by Meta, TikTok, Snapchat and X, and for purchases or leads a hashed (SHA-256) email, phone and account id sent to Meta, TikTok and Snapchat to measure our campaigns | When you buy or send an inquiry |
| With your analytics consent: Google Analytics usage data. Without it, Google tags set no cookies and send only cookieless signals (the page, the time, the browser type and whether you consented), with advertising data redacted, which Google uses to model visits and conversions in aggregate (Google Consent Mode) | While you browse |
| Admin accounts: an encrypted authenticator secret for two-step sign-in | Admin set-up |
We do not ask for or store passwords of your social media accounts, and we do not collect special categories of data. Our services are not for people under 18.
2. Why we use it, and on what basis
- To provide what you buy (contract): accounts, payments, wallet, orders, memberships, invoices, support.
- To meet legal duties: keeping commercial and financial records, consumer-protection duties, answering lawful requests from authorities.
- Security and fraud prevention (legitimate interest): sign-in protection, abuse prevention, audit logs of balance changes.
- Analytics and advertising measurement (consent): only if you allow it in the cookie banner; you can withdraw at any time. Google's cookieless signals without consent (section 1) rely on our legitimate interest in counting visits and conversions in aggregate; they identify no one.
- Service messages: payment confirmations, membership reminders 7, 3 and 1 day before the end, allowance notices, ticket replies. We send marketing messages only with your consent, and you can opt out at any time (Decree-Law 14/2023, Art. 6(4)).
3. Who receives it
- Hosting: StableHost (servers in St. Louis, United States) hosts the site and database.
- Payments: Stripe, PayPal and Heleket receive what they need to process your payment.
- SMM providers (currently SMM Panel King, SMM Cost and Lionfollow): receive only the public link, the quantity and, for comment services, the comments you wrote. They never receive your name, email or payment details.
- TradingView (your username, when we grant access by hand), Telegram (to send your VIP invitation), MetaTrader 5 (your account number is checked by your own licence).
- Official platform APIs we use to show the Bil Baz creator's own public figures: Meta (Instagram and Facebook Graph API), Google (YouTube Data API), TikTok and X. No customer data is sent to them.
- Analytics and advertising: Meta, TikTok, Snap and X only with your consent; Google (Analytics, Tag Manager, Ads) with your consent, and without it only the cookieless signals described above.
- WhatsApp (Meta) carries the messages you send us on WhatsApp. When our WhatsApp assistant is switched on, your messages and the facts it looks up (our live services and prices, and for a linked number your wallet balance and order status) are sent to Anthropic (Claude, United States) to write the reply. Anthropic does not use them to train its models. Payment card numbers and one-time codes are removed before the text is stored or sent. You can ask for a person at any time, and refunds, disputes and complaints are always handled by our team.
- Email delivery through our mail server, and authorities where the law requires it.
We do not sell personal data.
4. Transfers outside the UAE
Some recipients above are outside the UAE (for example our hosting in the United States and the payment and platform providers). We transfer data only as needed to provide the service you asked for, to recipients that apply appropriate security and contractual safeguards, as permitted by the UAE data protection law.
5. How long we keep it
| Data | Kept for |
|---|---|
| Account details | While your account is open; deleted or anonymised on request (see data deletion) |
| Payments, invoices, wallet history, orders | 5 years after the transaction (UAE commercial record-keeping), without personal details after an account deletion |
| Support tickets | 2 years after the ticket is closed |
| WhatsApp message texts | 180 days, then deleted (the conversation record without the texts is kept with support records); deleted earlier with your account |
| Consent records and click counts (no personal data) | 5 years for consent proof; 25 months for click counts |
| Advertising conversion records | 13 months |
6. Your rights
You can ask to access, correct, delete or receive a copy of your personal data, to restrict or object to its processing, and to withdraw consent at any time. Use a privacy ticket in your dashboard or email support@bazsocial.com. We answer within 30 days. If you are not satisfied you can complain to the UAE Data Office.
7. Security
Connections use HTTPS. Passwords are hashed; platform tokens and admin authenticator secrets are encrypted; admin access needs a second step; every wallet balance change is recorded. Credentials for payment and platform providers are kept only on the server. No method is perfectly secure; we will tell you and the authorities about a breach that affects you as the law requires.
8. Changes
We will post changes here with a new date, and tell you before material changes take effect.