SSocials Wick
LoginRegister

Privacy Policy

Last updated: 9 September 2026. This Policy explains how Socials Wick collects, uses, and protects your personal data in accordance with the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and applicable Cyprus data protection law, including the Processing of Personal Data (Protection of the Individual) Law and related national legislation.

1. Data Controller

The data controller responsible for your personal data is TKOCY LTD, a company registered in the Republic of Cyprus under registration number HE399700 (VAT number CY10399700T), with its registered office at Kiriakou Matsi 9, 4712 Limassol, Cyprus, trading as "Socials Wick" ("we", "us"). For any privacy-related question or request, contact support@socialswick.com.

2. Data We Collect

  • Account data: name, email address, and password (stored only as a salted bcrypt hash, never in plain text), the date you registered, whether your email address has been verified, and your account status.
  • Security data: if you enable two-factor authentication, the authenticator secret for your account (stored encrypted — see Section 6); the API key issued to your account; and short-lived tokens we generate to verify your email address or reset your password.
  • Order data: the Service ordered, the link/username targeted, quantity, price, status, and the reference assigned by our fulfilment provider.
  • Payment and balance data: your prepaid balance, each top-up request (amount, method, status), and the transaction references returned by our payment providers (for card payments, the Viva Wallet order code and transaction ID). Full card numbers, CVV codes and other sensitive payment credentials are entered on the payment provider's own secure page and are never received or stored by us.
  • Technical data: IP address, browser type, device information, and server log data collected automatically when you use the Platform, for security and fraud prevention.
  • Usage data: pages viewed and interactions on the public Platform, collected through Google Analytics as described in Section 8.
  • Support communications: any information you provide when contacting support by email or live chat.

3. Purposes & Legal Basis

We process your personal data to:

  • Create and administer your account, verify your email address, and deliver ordered Services (performance of a contract, Art. 6(1)(b) GDPR);
  • Process top-ups and payments, prevent fraud, and comply with tax and accounting obligations (performance of a contract; legal obligation, Art. 6(1)(c) GDPR);
  • Secure your account, including operating two-factor authentication and password resets, and investigate abuse or policy violations (performance of a contract; legitimate interest, Art. 6(1)(f) GDPR);
  • Understand how the public Platform is used and improve it, through aggregated analytics (legitimate interest, Art. 6(1)(f) GDPR; consent where required for cookies);
  • Respond to support requests and send service-related notices (performance of a contract / legitimate interest); and
  • Send optional marketing communications, only where you have opted in (consent, Art. 6(1)(a) GDPR), which you may withdraw at any time.

4. Sharing Your Data

We share personal data only where necessary, with the following categories of recipients. We do not sell your personal data.

  • Payment providers — Viva Wallet (Viva Payment Services S.A. / Vivabank S.A., Greece, EU) for card payments, and Stripe (Stripe Payments Europe Ltd., Ireland) where offered. They receive the amount, a payment description, and where required your email address, and act as independent controllers for the payment itself under their own privacy policies.
  • Fulfilment provider(s), including MoreThanPanel, to the extent needed to deliver an ordered Service — typically limited to the target link/username and quantity, never your account or payment details.
  • Hosting and infrastructure — our web and email servers are hosted in the EU (Contabo GmbH, Germany), and the Platform is delivered through Cloudflare, Inc. as a reverse proxy and DDoS-protection layer, which processes your IP address and request metadata on our behalf under a data processing agreement.
  • Analytics — Google Ireland Ltd. (Google Analytics 4 and Google Search Console), as described in Section 8.
  • Live chat — if a chat widget is enabled on the Platform, messages you send through it are processed by the chat provider (tawk.to) on our behalf.
  • Public authorities, where we are legally required to do so.

5. Payments

Card payments are completed on Viva Wallet's secure hosted checkout page (Smart Checkout). Your card details are entered directly with Viva, which is a PCI DSS certified payment institution, and are never transmitted to or stored on our servers. After a successful payment Viva notifies us of the outcome together with a transaction reference, which we keep with your top-up record so that we can credit your balance, handle refunds and meet our accounting obligations. The card statement descriptor for payments may show our legal entity name, TKOCY LTD. Top-ups requested by bank transfer or other manual methods are reviewed by our staff before your balance is credited.

6. Account Security & Two-Factor Authentication

You can optionally protect your account with two-factor authentication using an authenticator app (time-based one-time passwords). When you enable it we generate a secret key, show it to you once as a QR code, and store it on our servers in encrypted form only; it is used solely to check the 6-digit codes you enter at login. Codes themselves are never stored. You can turn two-factor authentication off at any time from your account page with your password, and our support team can remove it from your account if you lose access to your device after confirming your identity. Passwords are stored as salted bcrypt hashes, all traffic is encrypted with HTTPS, and email-verification and password-reset links expire automatically after a short period.

7. Emails We Send

We send transactional emails from our own mail server (addresses ending in @socialswick.com) to verify your email address, reset your password, and notify you about the status of your orders and top-ups. These messages are part of operating your account and cannot be opted out of while your account is active. Marketing emails, if any, are sent only with your consent and always contain an unsubscribe link.

8. Cookies & Analytics

The Platform uses the following cookies:

  • Strictly necessary: the session cookie that keeps you signed in, a CSRF-protection cookie, and a short-lived cookie used during the two-factor authentication step of login. These cannot be disabled without breaking login.
  • Cloudflare: cookies set by Cloudflare (such as __cf_bm) to distinguish humans from bots and protect the Platform from abuse.
  • Analytics: Google Analytics 4 cookies (_ga, _ga_*) that assign your browser an anonymous identifier so we can measure visits, pages viewed, and traffic sources. Google Analytics 4 does not log or store IP addresses, and we do not link analytics data to your account. You can opt out with the Google Analytics opt-out browser add-on or by blocking cookies in your browser.

We also use Google Search Console to monitor how our public pages appear in Google Search. It provides us aggregated search statistics only and sets no cookies on your device.

9. International Transfers

Our servers and payment providers are located in the European Union. Where a service provider we use (for example Cloudflare or Google) may process data outside the European Economic Area, we rely on an adequacy decision (including the EU–US Data Privacy Framework where the provider is certified) or appropriate safeguards such as the European Commission's Standard Contractual Clauses, to ensure your data remains protected to EU standards.

10. Data Retention

We retain account and order data for as long as your account is active, and for a reasonable period afterwards to comply with tax, accounting, and consumer-protection obligations under Cyprus and EU law (generally up to seven years for payment and invoice records). Email-verification and password-reset tokens are deleted once used or expired, and two-factor secrets are deleted as soon as you disable the feature. Analytics data is retained by Google Analytics for 14 months. You may request earlier deletion as described in Section 11, subject to those legal retention requirements.

11. Your Rights

Under the GDPR, you have the right to: access the personal data we hold about you; request correction of inaccurate data; request erasure ("right to be forgotten"), where applicable; restrict or object to certain processing; request a portable copy of your data; and withdraw consent at any time where processing is based on consent. To exercise any of these rights, email support@socialswick.com. If you believe we have not handled your data properly, you also have the right to lodge a complaint with the Cyprus Commissioner for Personal Data Protection (dataprotection.gov.cy) or your local EU supervisory authority.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be highlighted on the Platform, and the "Last updated" date above will reflect the most recent revision. This Policy should be read together with our Terms & Conditions and Refund Policy.