Privacy Policy | PanelOps

1. Introduction

PanelOps is operated by Tech N Byte LLC ("we", "our", "us"), which is the controller of the personal data described in this policy. We are committed to protecting your privacy. This Privacy Policy explains what information we collect, how we use it, and your rights regarding that information when you use our Service.

2. Information We Collect

Account Information

Email address and password (used for authentication, and to send you account, billing and support notifications)
WhatsApp phone number (used to identify you to your agent — not used for signing in)
Business/panel name provided at signup
Billing information (card payments are processed and stored by Stripe, cryptocurrency payments by Cryptomus — we do not store card details or wallet keys)

WhatsApp Data

WhatsApp group IDs and names for groups the agent operates in
Customer WhatsApp IDs (LIDs) and display names of verified users
Message content processed by the agent for order management purposes
Message logs stored in our database for your operational records
For customers who are verified, the panel username they link to their WhatsApp number

Usage Data

Agent interaction counts and activity logs
Feature usage patterns (for service improvement)
IP addresses for security and rate-limiting purposes
Website analytics on our public pages (pages visited, referrer, device and browser type), collected through Google Tag Manager and Google Analytics — see Cookies below

3. How We Use Your Information

To provide, operate, and improve the Service
To authenticate your account and prevent unauthorized access
To process payments and manage your subscription
To send transactional notifications (verification codes, billing alerts, subscription updates) by email
To enforce our Terms of Service and detect abuse
To respond to support requests
To understand how visitors use our website so we can improve it

We do not sell your personal data to third parties.

4. Data Storage and Retention

Your data is stored on servers we operate. Specific retention periods:

Message logs — retained for your plan's log retention period, then deleted automatically
Account data — retained for the duration of your account and up to 90 days after deletion
AI conversation history — stored in Redis with a 24-hour TTL; automatically purged
WhatsApp message data — handled by our WhatsApp connection service (Evolution API) on our own servers; message data held there is purged by a daily cleanup job
Live chat messages — stored in Redis with a 24-hour TTL; not persisted to the database

5. Third-Party Services

We share data with the following service providers only as necessary to operate the Service:

Stripe — card payment processing. Stripe stores your billing details under their own Privacy Policy.
Cryptomus — cryptocurrency payment processing, when you choose to pay in crypto. It receives the payment amount, your order reference and the details you give them at checkout.
Zoho Mail — delivery of our emails (verification codes, account, billing and support notifications). It receives your email address and the message content.
Google (Tag Manager and Analytics) — website analytics on our public pages. See Cookies below.
Evolution API — the software that connects your WhatsApp number to the Service. It runs on our own servers, not a third party's, and WhatsApp itself (Meta) carries the messages.
AI providers — if AI mode or Ticket AI is enabled, customer messages are sent to the configured AI provider (OpenAI, Anthropic, Google, Groq, or a custom endpoint) to generate a reply. We keep a short AI conversation history for 24 hours (see Data Storage and Retention); the message itself is also kept in your message logs.
SMM panels — order IDs and verification details are sent to your configured SMM panel API to fetch order status and verify customers on your behalf.

6. Security

We implement industry-standard security measures including:

Passwords hashed using bcrypt with SHA-256 pre-hashing
JWT-based session management with server-side invalidation
Rate limiting on all authentication endpoints
OTP verification for account and staff registration

No method of transmission over the internet is 100% secure. We cannot guarantee absolute security but take reasonable measures to protect your data.

7. Your Rights

Depending on your jurisdiction, you may have the right to:

Access the personal data we hold about you
Request correction of inaccurate data
Request deletion of your account and associated data
Receive a copy of your message logs (request it through the contact form below)
Object to certain processing of your data

To exercise these rights, contact us through the contact form.

8. Cookies

We use two kinds of cookies:

Authentication cookies — keep you logged in to the dashboard. They are strictly necessary for the Service to work.
Analytics cookies — set by Google Analytics (loaded through Google Tag Manager) on our website to count visits and see which pages are used. Google processes this data under its own Privacy Policy. You can block these cookies in your browser settings or with Google's opt-out add-on.

We do not use advertising cookies.

9. Children's Privacy

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected such information, please contact us immediately.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or a notice in the dashboard. Continued use of the Service after changes become effective constitutes your acceptance of the revised policy.

11. Contact

If you have questions or concerns about this Privacy Policy or our data practices, please reach out through our contact form.