Controller
The controller details have not yet been configured. Sales and account launch must remain disabled until the Legal Notice identifies the responsible operator and contact channels.
Data we process
- account and contact data, email-verification state, password hashes, session records, security events, support correspondence, and consent records;
- pseudonymous device and license identifiers, entitlement scope, product/version status, device-reset history, and integrity or abuse signals;
- order references, server-side offer snapshots, payment-provider invoice/status data, selected asset and network, transaction metadata, receipt state, and refund records;
- reviews or vouches you submit, moderation state, and optional proof metadata;
- technical request data such as time, IP address, user agent, request identifier, and rate-limit/security logs.
Purposes and legal bases
We process data to create and secure accounts, perform contracts, deliver licensed access and updates, verify payments, provide support, prevent fraud and abuse, comply with legal duties, and establish or defend claims. Depending on the activity, the legal basis is contract performance, steps requested before a contract, legal obligation, legitimate interests in security and service operation, or consent where specifically requested.
Recipients and processors
Data is disclosed only as necessary to hosting and security providers such as DanBot Hosting and Cloudflare, email services such as Google/Gmail, payment services such as NOWPayments, professional advisers, and authorities where legally required. The payment provider receives payment data directly; Nihility never needs your wallet seed phrase or private key.
International transfers
Some providers may process data outside the EEA. Where required, transfers rely on an adequacy decision, appropriate contractual safeguards, or another lawful mechanism. Provider-specific details must be confirmed against the production account configuration before launch.
Retention
We retain account and entitlement data while the account is active and as needed for contractual claims; security logs for a proportionate fraud and incident-response period; and tax, order, invoice, and payment records for legally required retention periods. Expired OTPs and reset tokens are invalidated promptly, and encrypted mail payloads are purged after delivery or terminal failure. Exact schedules are documented in the production retention register.
Your rights
Subject to applicable conditions, you may request access, correction, deletion, restriction, portability, or objection, and may withdraw consent for future processing. You may complain to a competent data-protection authority. Requests are verified to protect the account and answered within the statutory period.
Security and automated decisions
We use encryption in transit, password hashing, short-lived single-use tokens, secure cookies, scoped authorization, rate limits, signed updates, audit records, and restricted secret storage. No Internet service is risk-free. Automated signals may temporarily block abusive traffic or flag a device/payment for review; a human review channel is available for consequential account decisions.
Cookies and local storage
The account service uses essential HTTP-only session and anti-CSRF cookies. They are required for login and security, not advertising. We do not use browser storage for passwords, license keys, payment secrets, or wallet credentials. Any future non-essential analytics require a separate consent assessment before activation.