Privacy notice

Who we are

The controller for account, website and support data is FORCESCRIPTS LTD, company number 17110478, Suite 10647, 5 Brayford Square, London E1 0SG, United Kingdom. Contact [email protected]. Proxlio is the product name. forcescripts.com is the parent site.

The roles we play

We are the controller for the account, the website, billing records and support. For the content of traffic you choose to send through a proxy, we act as your processor, on your instruction, only to route it. You decide the destination. Do not send special-category data, card numbers or government identifiers through the proxy unless you have your own lawful basis and this data-processing terms page applies.

Data we collect

We collect only what the account and the service need.

• Identity and contact: name, email, optional company, country.
• Credentials: a hash of the password. We do not store the password itself.
• Preferences: language, display currency, and whether you opted into product notes.
• Consent records: the document version, the time, the IP address and the user agent.
• Messages you send through the contact form.
• Technical logs: time, IP address, user agent, the page requested, and security events. Kept short.
• Card payments: a Stripe customer reference, the payment status, and the card details Stripe shows us (brand, last 4 digits). The full card number and CVC stay with Stripe; we never see or store them.
• Crypto payments: the token chosen (USDT or USDC), the network, the deposit address, the transaction reference, the amount received and the time. Avalanche C-Chain and BNB Smart Chain are public blockchains: the sending wallet address and the transaction are permanently visible on-chain and cannot be erased by us.
• Account and payment security records: at sign-up, sign-in (including failed attempts), sign-out, password change, order, start of payment, balance payment and when delivered credentials are viewed or downloaded — the IP address, the IP’s country, browser and device details, browser language and a one-way hash of the session.
• Balance: top-ups, payments made from the balance, refunds, and the balance after each entry.
• Verification documents: only if we ask for them on suspicion, an identity document or a card photo (see “Verification” below).
• Proxy usage: the username, allow-listed IPs and usage. Our proxy infrastructure partner also records connection logs, the IP addresses used to authenticate, the destination hostnames and ports you connect to, and daily byte and connection counts. The content of your traffic is not recorded.

Why we use it

Each use has a basis. We do not sell personal data.

• To open and run the account, and later to supply the exits you pay for: contract.
• To show a lira reading of a dollar price using the TCMB bulletin: legitimate interest in a clear price, and your display preference.
• To keep the service secure and to enforce the acceptable use policy: legitimate interest, and legal obligation where the law requires us to act.
• To keep accounting records once invoices exist: legal obligation.
• To prevent fraud, stolen-card use and chargebacks, to show in a dispute that you placed the order and used the service (including sharing account and payment security records with the payment provider), and where needed to ask for identity or card verification: legitimate interest (UK/EU GDPR article 6(1)(f), KVKK article 5/2-f) and legal obligation where the law requires it.
• To run the balance, auto-renewal and renewal invoices, and to send transactional email about them: contract.
• To measure how our ads perform (Google Analytics and Google Ads cookies): your consent, which you can withdraw at any time from cookie preferences.
• To send product notes if you opted in: consent. You can withdraw it by writing to [email protected]. That does not end the contract.

Who else sees it

The host that runs this website and database. Our proxy infrastructure partner, without which traffic cannot be routed; it may also disclose connection logs to authorities and to third parties who show evidence of harm, in response to legal process, violations of its terms, fraud or security issues. Stripe as the payment processor for card payments. For crypto payments, FORCESCRIPTS’ payment gateway (pay.forcescripts.com) and the public blockchain where the transaction is recorded (Avalanche C-Chain or BNB Smart Chain). A mail provider (Resend) for transactional mail. If you accept optional cookies, Google (Google Analytics and Google Ads) for ad measurement: order number, product and amount, never your name, e-mail or proxy credentials. The relevant payment providers and banks when a chargeback or fraud case is investigated. Professional advisers if a dispute or a legal duty requires it. Public authorities when the law requires disclosure. We do not sell personal data.

International transfers

The company is in the United Kingdom. The website host, our proxy infrastructure partner and Stripe may process data in other countries outside the UK and the EEA, in particular the United States. Where the law requires a transfer tool, we use the UK International Data Transfer Addendum or the EU Standard Contractual Clauses, as applicable, plus any supplementary measures the transfer needs. Türkiye does not currently rely on a UK or EU adequacy decision for this; the contractual tool is the safeguard.

How long we keep it

We keep data while the reason for it still exists, then delete or reduce it.

• Account data: for the life of the account. After closure, a minimal record of the erasure request, and invoice records for up to 6 years where tax law requires them.
• Consent records: up to 6 years, so we can show what was accepted.
• Security and access logs: about 90 days unless an incident requires longer.
• Account and payment security records: 18 months (540 days), because card-network dispute windows can run that long, then deleted automatically. Longer only while a dispute or legal claim is open.
• Contact messages: up to 24 months.
• Balance entries and payment records (card, crypto, balance): as long as accounting and tax law requires, up to 6 years.
• Proxy connection logs (at our proxy infrastructure partner): destination hostname and port records for 30 days, other usage and access logs typically for 90 days. They may be kept longer while an abuse, security or legal review is open.
• Verification documents (identity document or card photo): kept for 180 days after we receive them, then deleted from our servers. We keep only the outcome of the check (date, passed or failed) on the account record.
• Exchange rates: not personal data. The bulletin history can stay.

Verification (KYC) and card photo

If an order, a payment or an account raises a suspicion — such as fraud, stolen card use, paying with someone else’s card, chargeback risk or a breach of the acceptable use policy — we have the right to ask you for identity verification (KYC). Instead of or in addition to that, we may ask for a photo of the card used for the payment showing only its last 4 digits and the cardholder’s name.

On the card photo, always cover the other digits, the expiry date and the security code (CVC) on the back. Do not send an image showing the full card number or CVC; if one is sent we delete it straight away without using it. On an identity document you may also cover fields not needed for the check; our request will say which fields we need.

We use these documents only to confirm that the payment and the account are yours. They are kept for 180 days after we receive them, then deleted from our servers. Only the authorised people carrying out the check can access them.

If verification cannot be completed, or the requested document is not sent within a reasonable time, we may decline the order, suspend the account, or refund the payment to the method it came from. That decision is made by a person.

Automated decisions

We do not make decisions based solely on automated processing that have legal or similarly significant effects on you. The system may flag an order as suspicious; a person decides whether to suspend, ask for verification or decline, and you can contest that decision.

Your rights

You can ask for access (UK/EU GDPR article 15), correction (16), erasure (17), restriction (18) and a portable copy of the data you gave us (20). You can object to processing based on legitimate interest, including fraud prevention (21); if you do, we stop unless we show compelling legitimate grounds to continue. You can always object to direct marketing. You can withdraw a consent; that does not make earlier processing unlawful. You can complain. We will not treat you differently in price or service for using a right.

The right to erasure does not require us to delete at once invoice and payment records the law makes us keep, or a record needed to establish, exercise or defend a legal claim; we keep those only for that purpose until the period ends.

In the UK, the supervisory authority is the Information Commissioner’s Office, ico.org.uk. In the EU, you may complain to the authority where you live or work. In Türkiye, KVKK article 11 rights — to learn whether we process your data, to request information, to learn the purpose and whether it is used accordingly, to know the third parties it is transferred to, to ask for correction or deletion, to ask that those parties are told, to object to a result against you from automated analysis, and to claim compensation for damage — can be exercised through [email protected]. The Board is at kvkk.gov.tr. We answer within one month under the GDPR, and within 30 days where the KVKK timetable applies. We may need to confirm it is you.

Children

Proxlio is not for anyone under 18. We do not knowingly open an account for a child. If you believe we have, write to [email protected] and we will close it.

Security

Passwords are hashed. API keys and proxy passwords are stored encrypted in the database. Database access is limited to the application. The site runs over TLS. No method is perfect. If we learn of a personal data breach we notify the relevant supervisory authority within 72 hours where required, and tell you without undue delay if it puts you at high risk.

Changes and contact

The version and date are at the top of this page. A material change to a contract you already accepted will be flagged on the account and, once mail works, sent to the registered email. Questions: [email protected], or the postal address above.