Privacy Policy.

1. Controller

The controller is Bakhromjon Kurbonov. Privacy requests: support@triumvo.com. Geographic address: Triq Gort, Malta.

2. Data processed

• Listing and checkout: submitted URL or handle, category, amount, retrieved public metadata, acceptance records, payment identifiers and contact details returned after checkout.
• Payments: Dodo Payments collects card and billing data. Triumvo receives identifiers, amount, currency, status and limited customer information needed to deliver and evidence the transaction.
• Clicks and security: aggregate click counts plus limited hosting and security logs.
• Management: email addresses, access requests, proposed edits, decisions and audit records.

3. Public listings

Rank, confirmed spend, product name, description, logo, category, destination, activity age and click count are public and may be indexed. Public metadata may be fetched from the submitted destination.

4. Purposes and legal bases

• Contract: create checkout, confirm payment, publish or raise a listing and provide management access.
• Legitimate interests: secure and moderate the board, retrieve public metadata, investigate faults and defend legal claims.
• Legal obligation: retain accounting, tax, dispute and compliance records where required.

5. Cookies, local storage and analytics

Triumvo uses strictly necessary Laravel session, CSRF and security cookies. No optional third-party analytics is currently enabled. Aggregate outbound click counts do not identify individual visitors.

6. Recipients

Dodo Payments processes checkout, customer, tax, refund and dispute data as Merchant of Record under its own terms and privacy notice. Data may also be processed by configured hosting, database, email, storage/CDN and security providers, and by advisers or authorities where lawfully required. If the operator enables API Direct metadata enrichment, the submitted public Instagram or Facebook profile URL is sent to API Direct to retrieve public profile metadata. The private Triumvo Worker, when enabled, processes the same public URL within infrastructure controlled by the operator. Both enrichment integrations are optional and disabled by default. Public listing information is available to visitors and search engines. Triumvo does not sell personal data.

7. International transfers

Where a processor operates outside the EEA, the operator must rely on a lawful transfer safeguard.

8. Retention

• Abandoned claims expire after 30 minutes and are scheduled for deletion after 30 days.
• Public listing metadata remains while the listing is active or while a public ranking archive is lawfully maintained.
• Payment, refund, tax, fraud, complaint and dispute records remain for the applicable statutory period or while a claim is open.
• Single-use access links expire automatically; expired operational records are periodically removed.
• Hosting and security logs are retained only for the configured operational-security period. Optional analytics retention is stated in the cookies section.

9. Your rights

Subject to applicable law, you may request access, correction, erasure, restriction, objection or portability. You may complain to Malta’s Information and Data Protection Commissioner.

10. Security

Administrative access, encrypted sensitive settings, CSRF protection, rate limits, audit records, signed payment webhooks, replay controls and server-side payment validation protect the service. No internet service can guarantee absolute security.

11. Children and changes

The paid business service is not directed to children and checkout requires an adult acting for business purposes. This notice may be updated when processing or law changes; the effective date identifies the current version.