Privacy Policy

Your privacy matters to us. This document explains what information Pynex collects, why, how it is kept and what choices you have. It applies to our website, user panel, live chat, shop and project services.

• Account data: mobile number (for one-time-code sign-in) and, optionally, name and e-mail.
• Contact and "Start a project" forms: name, contact method, project type, features, approximate budget and timeline, current site URL and the description you write.
• Orders and payments: order number, amount, status and date. Payment happens at the bank gateway; your card details never reach us.
• Tickets and live chat: message text, timestamps and the page from which you started chatting.
• Technical data: browser and device type, language, IP address (in live chat stored only as a one-way hash to detect abuse) and server security logs.
• Visit statistics: only if the site admin enables Google Analytics, anonymous visit statistics are collected.

- Secure sign-in, account recognition and abuse prevention.
- Answering requests, preparing proposals, delivering projects and orders.
- Support through tickets and live chat, and order-related notifications (SMS or e-mail).
- Improving speed, security and usability.
- Meeting legal obligations and protecting our legal rights.
We do not use your data for third-party targeted advertising and we do not sell it.

We process data based on (a) your consent when you submit a form or start a chat, (b) necessity to perform a contract/order, (c) our legitimate interest in security and abuse prevention, and (d) legal obligation.

You can chat with support without signing up. So your messages survive a page refresh, a random code is stored in your browser's local storage.
- As a guest, support sees only your messages and optional name — not your name or number.
- If you later sign in, the same conversation is linked to your account so support knows this guest is that customer and can see your order history. You are told about the link in the chat.
- If a browser previously used with another account signs in with a new account, support sees an internal warning (shared device or account switch) so that someone else's data is never shown to you by mistake.
- When you sign out, the chat code is removed from the browser so the next person on that device cannot see your conversation.
- Internal support notes are never shown to the visitor.

We use the minimum needed and no advertising cookies:
- Sign-in session (access and refresh tokens) to keep you signed in.
- Preferences: language (Persian/English) and light/dark theme.
- Live chat: the chat code and the time you last viewed messages.
- Security: items that limit suspicious requests.
You can clear these in your browser settings; you will then need to sign in again and preferences reset.

Only as needed and with service providers: the payment gateway (transactions), the SMS service (sign-in codes and notifications), hosting and infrastructure (running the server) and, if enabled, Google Analytics. They may not use the data for other purposes. We may also disclose data when required by law or a competent judicial authority.

- Account data while the account is active.
- Orders and invoices for as long as financial and legal obligations require.
- Contact-form and chat messages typically up to 24 months for follow-up and support.
- Guest chats with no messages or follow-up are purged periodically.
After that, data is deleted or anonymised.

We use encrypted connections (HTTPS), password-less one-time-code sign-in, rate limiting, hashing of sensitive technical data, role-based access in the admin panel and backups. No system is 100% secure; if a breach affecting you occurs we will notify you as soon as possible. Please keep your sign-in code and credentials confidential too.

- Access and correction: view and edit your name and e-mail in the "Profile" section.
- Deletion: request deletion of your account and related data (except what the law requires us to keep).
- Restriction and objection: you may object to processing based on legitimate interest.
- Withdraw consent: at any time, without affecting earlier processing.
- Copy: ask for a readable copy of your data.
Use live chat or a ticket to exercise these rights; after verifying your identity we usually reply within 30 days.

Our services are not designed for people under 18. If you learn your child has sent us data, tell us and we will delete it.

Data and access you give us for a project or security assessment is confidential and used only for that work. We do not copy your end-users' sensitive data beyond what is necessary and delete it after the work ends (or as agreed). Security reports are delivered only to your authorised representative.

Data is stored on servers we or our hosting provider operate. If any part of the service (e.g. analytics) is processed outside Iran, it happens only after the site admin enables it and with minimal data.

Material changes are announced by updating the date above and, where needed, a notice on the site. Continued use after publication means you accept the new version.

For any privacy question or request use live chat, a ticket in your panel or the contact page.