SMM Apps
Sign in

Privacy Policy

Last updated 27 October 2026

This policy explains what personal data SMM Apps ("SMM Apps", "we", "us") collects when you use SMM Apps, why we collect it, who else handles it, and the choices you have.

1. Data about you

When you create and use an account, we keep:

  • Account: your name, your email address, and your password as a one-way hash. We never store the password itself.
  • Google sign-in: if you sign in with Google, your Google account ID and the email and name Google shares. We ask Google only for your email and basic profile, never for your Google password, contacts or files.
  • Telegram alerts: if you connect the SMM Apps bot, your Telegram chat ID.
  • Sign-ins: the IP address and browser of each session, and failed sign-in attempts, to keep your account safe.
  • Billing: your plan, your invoices and payments, your balance and count credits, and the payment details you send us, such as a transaction ID.
  • Activity: what changed in your account and websites, and a record of the emails we sent you (address, subject and time, not the text).
  • Support: the messages you send us.

2. Data you connect

For each website you add, we store your panel's address, your panel API key and your bot token (both encrypted), the groups you link, your providers and your settings. For each WhatsApp or Telegram account you connect (Accounts add-on), we keep its login session, its groups and chats, your forward rules, campaigns and contacts.

3. Data about your customers

Your bot and your accounts handle data about your panel's customers so they can help them: their Telegram or WhatsApp ID, name, username or number, the messages they send, and the orders and tickets looked up in your panel. For this data you are the controller and we are your processor: we use it only to run your bot and tools, the way your settings tell them to. Your customers should contact you about their data, and we'll help you answer them.

4. How we use data

  • To run SMM Apps: read tickets, forward requests to providers, track orders, and answer with the AI agent.
  • To count: Start count sends the order's link (never your customer's name) to a counting service.
  • To email you, and to send alerts by Telegram if you connected it: sign-in links, invoices, reminders, and alerts when a bot stops.
  • To keep the service safe: rate limits, sign-in checks and the activity log.
  • To bill you, and to keep the records the law requires.
  • To find and fix problems, using logs that are rotated automatically.

We don't sell personal data, we don't show ads, and we don't use your customers' data for our own marketing.

5. Who else handles data

We share only what each service needs to do its part:

  • Our server host: the database and bot data live on a server we rent from a hosting company.
  • Resend: sends our emails, so it receives your email address and the email.
  • Google: when you sign in with Google, Google tells us who you are.
  • AI providers (OpenRouter and the model hosts it uses, Google Gemini, or another provider we choose): when the AI agent is on, they receive the customer's message and the details needed to answer it. Their own terms decide how long they keep it.
  • ScrapeCreators: when Start count is on, it receives the order links to count.
  • Telegram and WhatsApp: deliver your bot's and accounts' messages. Their privacy policies apply to your bots, groups and accounts.
  • Your panel: we call your panel's API with your key.
  • Payments: payments go through the payment service, wallet or exchange you choose. Blockchain transactions are public.
  • Authorities: only when the law requires it.

Some of these services work from other countries. When data goes abroad, we rely on the safeguards the law requires for that transfer.

6. How long we keep data

  • Account data: while your account is open. Ask us and we'll delete it, except records we have to keep.
  • Website data (bot data, case history and logs): until you delete the website, or 60 days after your account is paused. We email you a week before.
  • Connected accounts: until you remove the device; its session is logged out then.
  • Invoices and payment records: as long as accounting and tax law requires.
  • Security and email records: only as long as they help keep the service safe and reliable.

7. Security

Passwords are hashed with scrypt. API keys, bot tokens and account sessions are encrypted, and the dashboard never shows them in full again. All traffic uses HTTPS, and your sign-in cookie can't be read by scripts on the page. No system is perfectly secure; if we learn of a breach that affects your data, we'll tell you without delay.

8. Cookies

We use one cookie, smm_session, to keep you signed in (for up to 30 days), and a short-lived one while you sign in with Google. Your theme choice, dark or light, is saved in your browser. We don't use advertising cookies.

9. Your rights

You can ask to see, correct, export or delete your personal data, or object to how we use it. Write to business.mhtanvirahamad@gmail.com. Depending on where you live, you may also complain to your data protection authority.

10. Children

SMM Apps is a service for businesses and isn't meant for anyone under 18.

11. Changes

If we change this policy, we'll update the date at the top, and we'll email you about important changes.

12. Contact