Skip to main content

Privacy Policy

Last updated: July 14, 2026

1. Information We Collect

Account Information: Email address and username when you register. We use Argon2 password hashing — we never store plaintext passwords.

Seller identity and liveness verification (Didit): Sellers who start verification are redirected to a Didit-hosted flow, where they submit identity-document images and face/liveness data directly to Didit. Didit processes those materials and returns verification results and selected identity fields to AccountsSale; AccountsSale stores the status and identity fields needed to operate seller verification.

Transaction Data: Order history, wallet balances, and payment records necessary to operate the escrow system.

Technical Data: IP address, browser type, and access timestamps for security monitoring and rate limiting.

2. How We Use Your Data

  • Operate the escrow marketplace and process transactions
  • Verify seller identity and prevent fraud
  • Send transactional emails (order confirmations, verification links)
  • Enforce rate limits and detect abuse
  • Comply with applicable legal requirements

3. Data Security

Sensitive data stored by AccountsSale (including account credentials delivered during transactions, withdrawal addresses, and identity fields returned by the verification provider) is encrypted using AES-256-GCM. Encryption keys are stored in production environment variables, separate from the database. Database backups are encrypted with age public-key encryption, with private keys stored offline.

4. Cookies

We use essential cookies only:

  • Access-session cookie: HttpOnly, Secure in production, SameSite=Strict, expires after about 15 minutes
  • Refresh-session cookie: HttpOnly, Secure in production, SameSite=Strict, expires after about 30 days and is rotated on renewal
  • Two-factor authentication challenge cookie: HttpOnly, Secure in production, SameSite=Strict, expires after about 5 minutes
  • One-time recovery-code display cookie: HttpOnly, Secure in production, SameSite=Strict, expires after about 5 minutes and is cleared after display
  • Language preference cookie (as-lang): HttpOnly, Secure in production, SameSite=Lax, expires after about one year

We do not use advertising or tracking cookies. Analytics, if enabled, use privacy-respecting tools.

5. Data Sharing

We do not sell your personal data. Data is shared only with:

  • Identity and liveness verification (Didit) — to host the seller-verification flow, process identity documents and face/liveness data, and return verification results
  • Payment processor (NOWPayments) — to process cryptocurrency payments
  • Email service (Resend) — to deliver transactional emails
  • Authorities or other recipients — when disclosure is required by applicable law or valid legal process
  • Bot and abuse prevention (hCaptcha, operated by Intuition Machines, Inc.): On login, registration, and password-recovery forms, the hCaptcha widget loads from hCaptcha to distinguish human use from automated abuse. hCaptcha may process IP addresses, device and browser characteristics, and interaction data. For server-side verification, AccountsSale sends the submitted hCaptcha token and requesting IP address to hCaptcha. See hCaptcha Privacy Policy.
  • Google Cloud Translation: Seller-submitted listing titles, descriptions, and attribute text may be sent for machine translation. Passwords, delivered credentials, KYC documents, and payment data are excluded.
  • Resend operational alerts: If configured, bounded administrator alerts may include internal user, order, or payment IDs, amounts, status, and redacted diagnostics. Email addresses, secrets, wallet addresses, and chain hashes are removed before transmission.
  • WhatsApp: AccountsSale sends no data before you choose a WhatsApp support link. After you choose it, your browser contacts WhatsApp under its own privacy terms.

6. Data Retention

We retain account, verification-status, transaction, security, and dispute records only as needed to operate and secure the Platform, resolve disputes, and meet financial or legal obligations. Exact periods depend on applicable law and the documented retention schedule. We process deletion requests when records may lawfully be deleted; legal, security, fraud-prevention, financial, or dispute obligations may require continued retention. Jurisdiction-specific periods and the final retention schedule should be confirmed with qualified legal counsel before launch.

7. Your Rights

You may request access to, correction of, or deletion of your personal data by contacting support@accountssale.com. We will respond within 30 days.

8. Contact

For privacy questions: support@accountssale.com

Idle Account LLC · EIN 33-2624329