PRIVACY POLICY Updated 7 October 2026 · Applies to ibacuu.store Personal-data enquiries: [email protected]. 1. Scope and principles This policy covers data handled when visiting the site, creating an account, paying, receiving products, using keys/software/APIs, requesting support or joining available programmes. Processing is limited to specific necessary purposes and related lawful obligations. A visit is not unlimited consent for every purpose. Where consent is legally required, it must reflect the stated purpose and information. Other lawful grounds do not remove duties to minimise, protect and explain processing. Payment information and account secrets are not used for advertising beyond an authorised purpose. 2. Accounts and authentication Data can include email, display name, verification status, account timestamps, and information needed for authentication, recovery or security. IBACUU login passwords are stored as hashes rather than readable passwords. Optional Google sign-in or other connected functions process the identity, profile and authentication permissions corresponding to that flow. Provider tokens may be managed to maintain the connection. This does not mean IBACUU knows a customer's Google/ChatGPT password, or that every external token is stored using the same mechanism as an IBACUU password. Do not email passwords or OTPs to request support. 3. Orders, payments, wallet and support Records can include products/packages, quantities, prices/discounts at purchase, payment/delivery status, wallet balances and history, references, reconciliation information and customer-supplied evidence. They support fulfilment, discrepancy handling, complaints and legal recordkeeping. Orders may include information needed to deliver an account/key or perform a service. Support emails, tickets, attachments and complaint correspondence are retained when supplied to resolve an enquiry. PayOS, banks and payment providers process payment data within their services. IBACUU does not ask customers to post banking OTPs, CVVs or bank passwords in reviews, tickets or email. Redact unnecessary information from payment evidence. 4. Software keys, devices and activation identities Licensing data can include keys, permitted applications, expiry, device limits, activation/check history and hashed device identifiers. A device hash may still be linked to an account/licence; it is not automatically anonymous data. Some products require an activation identity, such as a name, student code or login identifier. Supply only what the particular product requires; this is not a requirement for every customer. Contact support to verify and correct a locked identity where appropriate. Data is used to deliver the selected package, check valid usage/device limits and resolve activation problems, not for unrelated processing without a lawful basis. 5. API keys, usage records and AI content API records can include the key owner, model, limits/expiry, request ID, endpoint, time, status, input/output/cache tokens, applied rates, holds/settlement, latency and necessary error information. These support authentication, billing, limits and reconciliation. Keys created under the current mechanism have an authentication hash and an encrypted recoverable copy for owner-only viewing. Some older keys have only a hash and must be replaced to obtain a viewable key. Deleting a key disables use and removes its recoverable secret under the current flow; it does not automatically delete historical usage, orders or wallet records. IBACUU's API usage ledger stores usage metadata and a request-body hash, not full prompts/responses as part of that usage record. This does not establish that no other system along the request path retains content. Execution transmits the prompt, attached data and necessary results through upstream gateways, currently including ShopKeyAPI, and the relevant model provider. They have their own processing, retention and service rules. IBACUU does not guarantee that all upstream providers avoid retention or model training. Prompts voluntarily included in support emails/tickets may also remain in support records. Do not send passwords, secret tokens, sensitive health/financial data or other people's personal data without appropriate authority and grounds. Ask before use if a specific storage region, retention period or data-use commitment is required; buying a key does not imply that commitment. 6. Sessions, logs and browser storage Session/security information can include IP addresses, browser/device information, user agent, timestamps, authentication events, errors and administrative audit logs. Access is restricted according to assigned functions. Cookies and browser storage support current functions such as sign-in, guest carts, theme/navigation preferences, referrals and notice state. Some functions use localStorage or sessionStorage instead of cookies. Browser settings can block or clear this storage, which may remove a login session, guest cart or saved preferences. This policy does not itself authorise advertising cookies. New tracking purposes requiring a separate choice must be disclosed and handled with legally required consent. 7. Purposes and access limits Purposes include account creation/security; payment confirmation and wallet administration; product/key/service delivery; licensing; API execution/billing; support and complaints; prevention of fraud/unauthorised use; programmes the customer participates in; and legal obligations. Access is limited to authorised people/systems that need the data for their work. Support staff do not automatically have access to every secret or all customer records. Incompatible new purposes require appropriate review, notice and consent where required. 8. Recipients Necessary data may be shared with infrastructure/storage, file/image delivery, email, payment, authentication and digital/AI service providers to perform the transaction. Depending on active features/configuration, these can include AWS or equivalent hosting, Cloudinary, PayOS/banks, Google, ShopKeyAPI and model providers. Not every provider receives every customer's data. Sharing is limited by necessity and applicable duties. Competent authorities may receive data on a lawful basis or request. IBACUU does not sell customer account data as a product or treat payment as automatic permission for third-party marketing. When visiting or authorising an external platform directly, its own policy also applies to its activities. This policy does not replace Google, bank or AI-provider policies. 9. Processing outside Vietnam Hosting and related providers may store or process data outside Vietnam, for example server infrastructure in Singapore and AI processing in provider regions. All data is not promised to remain in Vietnam. Provider selection and transfers must respect necessary scope, safeguards and applicable legal obligations. Do not submit data with special localisation requirements before confirming the service meets them. 10. Retention and deletion Account data is kept as needed for the service and outstanding rights/obligations. Orders, payments, wallet records, usage and complaint records may need longer retention for reconciliation, disputes, lawful interests or statutory recordkeeping. When the purpose and lawful need end, deletion or reduced identifiability is considered as appropriate; retention must not be prolonged without a basis. Expired verification codes/sessions, account closure or key deletion do not imply immediate deletion of every transaction record and backup. Backups containing data subject to deletion are handled within operational cycles and applicable requirements; no unimplemented automatic deletion deadline is promised. Confirmed deletion/restriction requests must continue to be respected where applicable after restoration. Email support for the retention basis of particular records. 11. Security and incidents Measures include authentication/ownership checks, access controls, HTTPS, password hashing, API-key encryption under the current mechanism, and relevant administrative logs. Download, key-viewing and order access are checked against the authorised account/permissions. No system is absolutely secure. Incidents are assessed, contained and remediated, with notification/cooperation under applicable legal duties. This policy does not promise one fixed reporting deadline for every situation regardless of legal conditions. If an account/key may be exposed, change passwords, revoke/replace keys and report references, not complete secrets. Additional proportionate verification may protect the rightful owner. 12. Data-subject rights and requests Subject to applicable legal scope and conditions, rights include being informed; giving/withdrawing consent; access, provision and correction; deletion, restriction or objection; complaints, proceedings and compensation where justified. Email [email protected] describing the account, data and requested action. Proportionate ownership verification may be needed before disclosure or changes; a full identity-document image is not automatically required for every request. Available profile fields can also be edited in the account. Requests are answered and handled within applicable legal deadlines and conditions. If a request cannot be fully fulfilled, the basis, limits and next steps should be explained. Lawful retention obligations, unfinished transactions or other people's rights may limit deletion; they do not justify unsupported refusals. Withdrawal does not invalidate earlier lawful processing. Removing/restricting essential data may prevent particular functions; IBACUU should explain the impact and handle the related transaction rights. 13. Public content and other people's data Reviews may display a name, rating, text and verified-purchase badge where justified. Public content can be read by others. Do not post private emails, passwords, keys, bank details or unnecessary personal information. Related correction/removal requests can be emailed. Referral/public-statistics features display information according to that feature; not every public record is automatically fully anonymous. Supplying another person's data requires appropriate authority and grounds. Children's data and data involving legal representation require applicable safeguards, verification and representative participation. A student offer does not authorise unrestricted collection of children's data. 14. Updates and contact Policies are updated when functions, providers or processing change. Material changes to purposes, data categories, recipients or rights require appropriate notice and new consent where legally required; an update does not automatically authorise expanded processing. Mandatory rights are not waived by this policy. Public contact: [email protected]. Related policies: https://ibacuu.store/en/terms and https://ibacuu.store/en/refund-policy.