Privacy Policy

This Privacy Policy is issued by Soni's World LLC, a New York limited liability company, doing business as ResiFactory ("Soni's World", "ResiFactory", "we", "us", or "our"). It describes how we handle personal information in connection with our website at resifactory.net, our customer dashboard, our network and infrastructure services, and our customer support channels (collectively, the "Service").

The Service provides network infrastructure and related products, including residential, mobile, and ISP proxies, dedicated and Apple-silicon (Mac) servers, retail accounts and associated mailbox provisioning, downloadable software and license keys, and a developer API. Proxy bandwidth is offered on a pay-as-you-go basis from a prepaid account balance, servers are charged to your payment method through our payment processor, and some other products (such as mailbox provisioning) are offered as recurring subscriptions. Some products are offered from time to time, on a waitlist, or only to eligible accounts, and not every product is available to every user. This policy applies to information we collect from and about account holders, prospective customers, and visitors to our website.

This policy applies to the ResiFactory Service described above. Where we operate a separate website, product, or property under its own terms or privacy notice, that separate notice governs it; this policy does not extend to properties that publish their own privacy notice.

What This Policy Covers and Does Not Cover

This policy covers personal information that we, as a controller (or, where applicable, business), determine the purposes and means of processing for. It does not cover:

• The content of the traffic you route through our network, or the websites, applications, and services you access using the Service. You control and are responsible for that activity, and you act as the controller of any personal data contained in it. Your responsibilities are described in our Terms of Service and Acceptable Use Policy.
• Third-party services with their own privacy policies, including Discord (login and support) and our payment processors. See Third-Party Services and Links below.

By using the Service, you acknowledge the practices described in this policy. If you do not agree, do not use the Service.

We collect information that you provide, information that is generated automatically as you use the Service, and a limited amount of information from the third parties that authenticate and bill you. We deliberately minimize what we collect and do not ask for more than the Service requires.

Account Data and How You Sign In

What account data we hold depends on the sign-in methods you use. We support signing in through Discord and, where enabled on your account, an email address and password you create with us, a Google or Apple account, and passkeys or security keys. More than one method may be linked to a single account. We use this data to create and secure your account, to sign you in, and to identify you in support.

• Discord. When you authorize the login, Discord shares a limited set of identifiers with us, which typically includes your Discord user ID, username, avatar, and the email address associated with your Discord account. We do not receive your Discord password.
• Email and password. We store your email address and a salted, one-way scrypt hash of your password. We do not store your password itself, and we cannot recover it — a forgotten password is reset, never retrieved.
• Google or Apple. We store the provider’s own stable identifier for you (its subject claim), the email address the provider supplied when you linked the account, whether the provider had verified that address, and a display name where one is given. We do not receive your Google or Apple password.
• Passkeys and security keys. We store the credential’s public key and identifier, a signature counter, and descriptive properties such as the transports it supports and any nickname you give it. The private key never leaves your device and is never sent to us, so a passkey cannot be extracted from our systems.
• Recovery codes. Where you generate recovery codes, we store only a one-way hash of each code, along with when and from what IP address a code was used. We cannot display a recovery code back to you.

With your authorization through Discord, we also receive short-lived access tokens and store, in encrypted form, a refresh token that lets us keep your account connected and, where our community features apply, add you to our Discord server. We use this token only for those purposes and to maintain continuity of your account. If you reach us through a referral link, we record a referral code (including via a first-party cookie described under Cookies and Similar Technologies) so that we can attribute the referral and administer our referral program.

Billing and Payment Records

All prices are in US Dollars (USD). Proxy bandwidth is pay-as-you-go: you buy it into a prepaid account balance and consume it as you use our network. Servers and other subscriptions are charged to your payment method through our payment processor. Card payments are processed by Stripe and cryptocurrency payments are processed by a third-party crypto payment processor. We do not collect or store full card numbers or crypto wallet credentials; those are handled by the processors. We retain transaction records such as amount, currency, date and time, payment method type, processor transaction or reference identifiers, account balance changes, and (for card payments) limited details returned by Stripe such as the card brand, last four digits, and result. For cryptocurrency payments, we receive only limited confirmation and reference data from the crypto processor, such as the transaction or reference identifier, the amount and currency, and the payment status; we do not receive your wallet credentials.

Service-Usage Data

To operate the Service, meter consumption, and bill accurately, we record:

• Bandwidth consumed, measured in gigabytes (GB), and remaining account balance;
• Proxy generation events (for example, when you create endpoints, sessions, or credentials);
• Domain-level accounting (the destination hosts associated with your traffic, recorded for usage measurement, billing accuracy, and abuse prevention; we do not log the content of your traffic). Destination-host data is used only for these purposes, is retained for a limited period, and is not sold, shared, or used to build marketing or behavioral profiles of you;
• Session metadata and timestamps, including session identifiers, region or targeting selections, session duration, and connection counts;
• Dedicated-server provisioning and lifecycle records (for example, server identifiers, billing period, and start/stop events);
• Where you rent a dedicated server or similar resource from us, security and abuse-monitoring signals from that resource (such as running processes, network connections, resource usage, and installed or downloaded software), as described in our Acceptable Use Policy.

Orders and Fulfillment Data

When you order a product that we fulfill to you — such as a retail account, a mailbox or mail-server subscription, a server, or a software license — we record information needed to process and deliver that order. This includes the product and quantity ordered, order and reservation identifiers, order status and fulfillment timestamps, any fulfillment email address, mailbox handle, or IMAP/forwarding details you provide or that we assign, any risk acknowledgments you make at checkout, and, where we deliver credentials to you, those credentials in encrypted form while they are associated with your order. We use this data only to fulfill and support your order, to prevent fraud, and to keep a transaction record. If you join a product waitlist, we record the contact details you provide (such as an email address) and a hashed form of your IP address.

Developer API Data

If you use our developer API, we store metadata about your API keys — including a one-way hash of the key (we do not store the key itself after it is first shown to you), the scopes you assigned, and creation and last-used timestamps — and we keep a per-request log of API calls (such as the endpoint, method, response status, size, timestamp, and the IP address the request came from) for security, abuse prevention, and to meter usage against your account balance.

Technical and Log Data

Our systems automatically generate logs for security, fraud prevention, reliability, and abuse handling. These may include the IP address you connect from, device and browser information such as user agent, request timestamps, authentication and error events, and similar diagnostic data. We also maintain an account-security event log that records sign-ins and security-relevant changes to your account — for example password changes, passkey or security-key enrolment and removal, recovery-code generation and use, and session revocations — each stored with the IP address and browser user agent involved. We keep this log so that you can review your own recent account activity from your dashboard settings, and so that we can detect and investigate suspected unauthorized access to your account. We log IP addresses in certain contexts — for example when you download credentials or make requests to our developer API — and retain them for a limited period for security and abuse prevention (see Data Retention). In other contexts, such as waitlist sign-ups, we store only a one-way hashed form of your IP address, used for abuse and fraud-prevention matching, rather than the raw address.

Communications

When you contact us through Discord tickets, by email, or otherwise, we retain those communications and their contents, including any information you choose to provide, so that we can respond, keep a record of the request, and improve support.

Free Trial Checks

If you claim a free trial, we record which Google account it was claimed with, a one-way code made from your network address, and a one-way code made from basic settings your browser reports, such as its screen size, time zone, languages and how it draws graphics. We also set a trial cookie. We use these only to make sure each person, device and network claims a free trial once.

This section summarizes, for transparency and for purposes of US state privacy laws (including the California Consumer Privacy Act as amended by the CPRA), the categories of personal information we collect, the sources, the purposes, and the categories of recipients. The specific data points within each category are described in Information We Collect above.

Categories Collected

• Identifiers. Discord user ID, username, avatar, and the email address associated with your Discord account; where you use them, an email address you register with us, a Google or Apple subject identifier and the email address linked with it, and passkey or security-key identifiers; account identifiers we assign.
• Commercial information. Transaction and billing records, top-ups, account balance changes, products and services purchased, orders and fulfillment records, and dedicated-server provisioning records.
• Internet or other network activity information. Service-usage and accounting data, bandwidth consumed, proxy generation events, domain-level accounting, session metadata and timestamps, developer-API request logs, account-security event logs, technical and log data, website and dashboard interaction data (pages viewed, links and buttons clicked, the referring website or campaign, device type and browser), and email delivery and link-click records.
• Geolocation data. Coarse, IP-derived location and the region or targeting selections you choose; we do not collect precise device GPS location.
• Payment information (held by processors). Card and cryptocurrency payment details are collected and stored by our payment processors, not by us; we retain only the limited confirmation and reference data described above.
• Customer-communications content. The contents of Discord tickets, emails, and other communications with us.

Sources of Personal Information

• Directly from you (account setup, top-ups, support communications, and your configuration choices);
• Automatically from your use of the Service (usage, accounting, technical, and log data);
• From the third parties that authenticate and bill you (Discord, Google or Apple for login identifiers, where you sign in with them; Stripe and the crypto payment processor for payment confirmation and reference data).

Business and Commercial Purposes

We use these categories for the purposes described in How We Use Your Information, namely providing the Service, metering and billing, fraud, abuse, security, and sanctions compliance, support and communications (including account tips and reminders and, where described above, news and offers), operating and improving the Service, including measuring the use of our website and dashboard, and legal and compliance.

Categories of Recipients

We disclose personal information to the categories of recipients described in How We Share Your Information, namely our service providers and processors, our payment processors (Stripe and the crypto payment processor), Discord (a sign-in option and our support provider), Trustpilot (for review invitations), and, where applicable, legal, safety, and law-enforcement recipients and parties to a business transfer.

Sensitive Personal Information

We do not intentionally collect special categories of data under the GDPR (such as health, racial or ethnic origin, or biometric data). Account login identifiers and similar data may be treated as "sensitive personal information" under certain US state laws. We use such information only for the purposes of providing, securing, and supporting the Service, processing payments, preventing fraud and abuse, and complying with law. We do not use or disclose sensitive personal information for purposes that would trigger the right to limit its use under applicable law (for example, we do not use it to infer characteristics or for cross-context behavioral advertising). Because we do not use sensitive personal information for those purposes, there is no use to limit; you may nonetheless contact us at [email protected] with any related request.

We use the information described above for the following purposes:

• Providing the Service. Creating and authenticating your account, provisioning proxies and dedicated servers, generating endpoints and sessions, and delivering the network functionality you request.
• Metering, billing, and fulfillment. Measuring bandwidth in GB and debiting your account balance, recording server rental terms, processing top-ups through Stripe and the crypto processor, charging server fees and any recurring subscription fees (such as mailbox subscriptions) through our payment processor to a payment method you have authorized, fulfilling and delivering the products you order, operating our developer API, and maintaining accurate transaction and usage records.
• Fraud, abuse, and security. Detecting and preventing fraudulent payments (including chargeback and stolen-payment-instrument abuse), account takeover, credential sharing, and prohibited use; using IP and hashed-IP data and usage patterns to investigate and stop abuse.
• Sanctions and trade compliance. Complying with applicable economic-sanctions, embargo, and export-control laws, including by reserving the right to screen account, billing, and payment data against applicable restricted-party lists (such as those administered by the US Office of Foreign Assets Control (OFAC)) and to decline or restrict service where required by law.
• Support and communications. Responding to Discord tickets and emails; sending service, security, billing, and account-related notices; sending account tips and reminders, such as a welcome message, low-balance and renewal reminders, and a note when your account has been quiet for a while; sending news and offers about our own products as described under Marketing Communications below; and notifying you of material changes to our policies.
• Operating and improving the Service. Monitoring the performance, capacity, and reliability of our network and infrastructure; measuring how visitors and customers use our website and dashboard (which pages are visited, which features, buttons, and links are used, which website or campaign referred a visit, and which visits lead to sign-ups and purchases); diagnosing problems; and improving features and the way we present the Service. This measurement is first-party: we collect and store it ourselves rather than through an analytics vendor.
• Legal and compliance. Complying with applicable law, responding to lawful requests, enforcing our Terms of Service and Acceptable Use Policy, and establishing, exercising, or defending legal claims.

We do not use your information for third-party advertising and we do not engage in behavioral advertising or profiling that produces legal or similarly significant effects about you. Our analytics are first-party: we collect and store them ourselves, we do not use third-party behavioral or cross-site analytics, and we do not share analytics data with advertisers or data brokers. We never use the destination domains or websites you reach through our proxies for marketing or for analytics about you.

Marketing Communications

If you have purchased from us, or you chose to receive them when you signed up or in your settings, we may email you news about our products, restocks, and offers. Every such email includes a one-click unsubscribe link, and you can change your choices at any time in your dashboard settings or from the preferences link in any email. Unsubscribing from news and offers, or from account tips and reminders, does not stop service, security, billing, and account notices, which we need to send to provide the Service. We send these emails through a service provider that delivers email on our instructions. To learn which emails are useful, we record whether an email was delivered and which of its links were clicked, using links that pass through our own website. We do not use tracking pixels to detect when you open an email.

We do not make decisions that produce legal effects concerning you, or similarly significantly affect you, based solely on automated processing within the meaning of Article 22 of the GDPR, except in limited fraud-, abuse-, and sanctions-prevention contexts described below.

To protect the Service and comply with law, we use automated rules and signals to flag potentially fraudulent payments, account abuse, and prohibited use, and, where we conduct such checks, potential sanctions or export-control concerns. These checks may, for example, temporarily limit or suspend a transaction or account, or require additional verification, while we investigate. Where such a measure significantly affects you, it is subject to human review, and you may contact us at [email protected] to express your point of view, request an explanation, and ask us to reconsider the outcome. We do not use automated profiling for advertising or to make solely-automated decisions outside of fraud, abuse, security, and legal-compliance purposes.

If you are in the European Economic Area (EEA), the United Kingdom, or another jurisdiction with similar requirements, we rely on the following legal bases under the EU General Data Protection Regulation (GDPR) and the UK GDPR to process your personal information:

• Performance of a contract. Processing that is necessary to provide the Service you have signed up for, including account creation through the sign-in method you choose, provisioning proxies and servers, metering usage, and billing your account balance.
• Legitimate interests. Processing necessary for our legitimate interests, where these are not overridden by your rights and freedoms. This includes securing the Service, preventing fraud and abuse (including the use of IP and hashed-IP data), maintaining records, ensuring network reliability, improving the Service, measuring how our website and dashboard are used, and telling existing customers about our own similar products and offers (which you can stop at any time).
• Consent. Where we rely on your consent, for example for any non-essential cookies (if introduced) or optional communications. You may withdraw consent at any time without affecting the lawfulness of prior processing.
• Compliance with a legal obligation. Processing necessary to meet our legal, tax, accounting, and regulatory obligations, to comply with applicable sanctions and export-control laws (including, where we conduct it, screening against restricted-party lists such as those maintained by OFAC), and to respond to lawful requests from competent authorities.

If you have questions about the legal basis for a particular processing activity, contact us at [email protected].

We use a minimal set of cookies and similar technologies that are essential or functional for operating the Service. We do not use third-party advertising trackers, cross-site behavioral advertising cookies, third-party behavioral analytics SDKs, or data brokers' tracking pixels.

Essential Cookies

We use essential session and authentication cookies to keep you securely logged in after you authenticate through any sign-in method linked to your account, to maintain your session, and to protect against cross-site request forgery and similar security risks. The Service will not function correctly without these cookies.

Functional Cookies and Local Storage

If you arrive through a referral link, we set a first-party referral cookie (currently for about thirty days) so we can attribute the referral to the account you create. We also set a first-party visitor cookie that holds a random identifier and lasts up to thirteen (13) months. It lets us measure how our website is used and connect a visit to an account created or a purchase made afterwards. It is not shared with anyone, is not used for advertising, and does not track you on other websites. We also store small, non-tracking preferences in your browser's local storage, such as your dashboard layout choice. These are first-party, are not used to build advertising or cross-site profiles, and you can clear them through your browser.

If you claim a free trial, we set a first-party trial cookie that holds a random identifier and lasts up to thirteen (13) months. It is used only to stop the same browser claiming a trial twice.

Analytics

We measure the use of our website and dashboard with our own first-party analytics. We record the pages you view, the buttons and links you click, how long a page stays open, the website or campaign that referred you, your approximate country (derived from your connection, not from GPS), and your device type and browser. We do not store your IP address in these analytics. If you are signed in, or you later sign in or create an account, we associate this activity with your account. Our content-delivery and infrastructure provider may also give us aggregate, cookieless traffic metrics. When you interact with a payment form, the payment processor's own scripts (for example Stripe) load and may set their own cookies or telemetry under their privacy policies; those scripts load only when needed for payment.

Controlling Cookies

Because our cookies are first-party and limited to authentication, session security, core functionality, referral attribution, and our own first-party analytics, and we do not use advertising or cross-site tracking cookies, we do not present an advertising consent banner. You can control or delete cookies through your browser settings, but disabling essential cookies will prevent you from logging in or using the Service.

Opt-Out Preference Signals

We recognize the Global Privacy Control (GPC) and similar browser-based opt-out preference signals as a valid request to opt out of the sale or sharing of personal information where applicable law requires. Because we do not sell or share personal information for cross-context behavioral advertising, there is nothing for these signals to opt out of, but we honor them where required.

We share personal information only as described below. We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

Service Providers and Processors

We use third-party service providers and processors to operate our network and infrastructure, host systems, send communications (including the emails described under Marketing Communications), and support fraud prevention. These providers process information only on our documented instructions, under contractual confidentiality and data-protection obligations, and only as needed to perform services for us. They are contractually prohibited from selling the information, from using it for their own purposes, and from using it for cross-context behavioral advertising. We describe these providers generically and do not name our network or infrastructure suppliers.

Payment Processors

Card payments are shared with and processed by Stripe, and cryptocurrency payments are processed by a third-party crypto payment processor, in each case to complete your transaction and add funds to your account balance. These processors handle your payment details under their own privacy policies, and we receive only limited confirmation and reference data, not full payment credentials.

Identity and Support Provider

Discord is one of the sign-in methods you can use and provides primary support, and it processes your information under its own privacy policy.

Review Invitations

After you place a paid order, we share your email address, the username on your account, and an order reference with Trustpilot, an independent review platform, so that Trustpilot can invite you to review us. We do this once per customer, and we do not share your payment details, credentials, usage data, or anything else with Trustpilot for this purpose. You do not have to leave a review and can simply ignore the invitation; Trustpilot handles this information, and any review you choose to write, under its own privacy policy.

Legal, Safety, and Law-Enforcement Disclosures

We may disclose information when we believe in good faith that it is reasonably necessary to: comply with applicable law, regulation, legal process, or an enforceable governmental or law-enforcement request; meet sanctions and export-control obligations; enforce our Terms of Service and Acceptable Use Policy; investigate, prevent, or address fraud, security, abuse, or technical issues; or protect the rights, property, or safety of Soni's World, our users, or the public. Law-enforcement and abuse-related requests should be directed to [email protected].

Business Transfers

If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of our assets, personal information may be transferred as part of that transaction. We will require the recipient to honor this Privacy Policy or notify you of any material changes to how your information is handled.

No Sale of Personal Information

We do not sell your personal information for money or other valuable consideration, and we do not share it for cross-context behavioral advertising, as those terms are defined under applicable US state privacy laws. Disclosures we make to our service providers and processors under written contracts that restrict their use of the information to performing services for us are not "sales" or "shares" under those laws.

We retain personal information only for as long as necessary to fulfill the purposes described in this policy, unless a longer retention period is required or permitted by law. The criteria we use to determine retention periods include how long your account is active, the time needed to provide and support the Service, our legal, tax, and accounting obligations, the resolution of disputes, and the prevention and investigation of fraud and abuse. Our typical retention periods for key categories are:

• Account data (including any password hash, linked provider identifiers, and passkey or security-key records) is retained for as long as your account is active and for up to twenty-four (24) months after closure to handle reactivation, disputes, and our legal obligations, after which it is deleted or de-identified unless a longer period is required by law, except as described for free trial records below.
• Billing and transaction records are retained for as long as required for tax, accounting, audit, and anti-fraud purposes, typically up to seven (7) years from the date of the transaction in line with applicable record-keeping law. Your account balance does not expire while your account remains in good standing.
• Service-usage and accounting data (bandwidth, generation events, domain-level accounting, and session metadata) is retained for billing accuracy and dispute resolution, typically for up to twelve (12) months, with aggregated, de-identified data retained longer for capacity planning.
• Orders and fulfillment data, including any credentials we deliver to you, is retained for as long as needed to deliver and support the order and to resolve disputes and prevent fraud; credentials we store are held in encrypted form, and we delete or de-identify this data when it is no longer needed for those purposes or as required by law.
• Technical and log data (including connection logs, developer-API request logs, credential-download records, and diagnostic data) is retained for a limited period sufficient for security, troubleshooting, and abuse and fraud prevention. Developer-API request logs, which include a raw IP address, are typically retained for up to ninety (90) days, after which they are deleted or aggregated. Credential-download records (which include the IP address used) are retained together with the related order and account records for as long as needed to resolve disputes and prevent fraud. Where we instead use a hashed (one-way) form of IP data (for example for waitlist sign-ups), we may retain it for abuse and fraud matching for up to twelve (12) months.
• Account-security event logs (a record of sign-ins and of security-relevant changes to your account, such as password changes, passkey or security-key enrolment and removal, recovery-code generation and use, and session revocations, each stored with the IP address and browser user agent involved) are retained for up to twelve (12) months, so that a meaningful period of account history stays available to you for review in your dashboard and to us for investigating suspected unauthorized access.
• Website analytics data (individual page views, clicks, and similar events) is retained for up to ninety (90) days, after which it is deleted and kept only in aggregated reports, which are retained for up to twenty-five (25) months.
• Email records (which emails we sent you, whether they were delivered, and which links were clicked) are retained for up to twenty-five (25) months. If you unsubscribe, or an email to you bounces or is reported as spam, we keep a one-way hashed form of your email address so that we can keep honoring that choice, including after your account is deleted.
• Free trial records (the sign-in account a trial was claimed with and the one-way codes above) and our record of which Google or Apple accounts have been linked to which ResiFactory accounts are kept for as long as we offer free trials, including after you unlink that sign-in account or close your account, so that a free trial cannot be claimed twice.
• Communications (Discord tickets and emails) are retained for as long as needed to support you and maintain a record of the interaction, typically up to twenty-four (24) months after the interaction is resolved.

Where we are required to retain information to comply with a legal obligation, resolve a dispute, or enforce our agreements, we retain it for as long as necessary for that purpose. When information is no longer needed, we delete it or aggregate or de-identify it so it can no longer reasonably be associated with you.

We implement administrative, technical, and organizational measures designed to protect personal information against unauthorized access, disclosure, alteration, and destruction. These measures include:

• Encryption of data in transit using industry-standard transport security (TLS/HTTPS) across our website, dashboard, and API;
• Access controls and the principle of least privilege, so that staff and systems can access only the information needed for their role;
• Authentication through the sign-in method you choose — Discord, Google or Apple, a passkey or security key, or an email and password. Where you set a password with us we store only a salted, one-way scrypt hash of it and never the password itself; where you enrol a passkey or security key, its private key stays on your device;
• Tokenization of payment data through Stripe and our crypto processor, so that we do not store full payment credentials;
• One-way hashing of IP data used for abuse and fraud-prevention matching;
• Encryption at rest of particularly sensitive stored values, such as any account credentials we deliver to you and connected-account tokens;
• Logging, monitoring, and segregation of systems to detect and respond to security events.

Traffic between your client and our proxy endpoints uses HTTP or SOCKS5, which do not encrypt that connection, including your proxy credentials, so you should use HTTPS to reach your destinations.

Security Incidents

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. In the event of a personal-data breach that affects your information, we will, without undue delay and where feasible, take steps to contain and investigate the incident and will notify affected users and the appropriate supervisory authorities or regulators as and to the extent required by applicable law, including the GDPR and UK GDPR (Articles 33 and 34) and US state data-breach notification laws.

You are responsible for safeguarding the sign-in methods linked to your account — any Discord, Google or Apple account you sign in with, any password you set with us, and the devices holding your passkeys or security keys. If you believe your account has been compromised, contact us immediately at [email protected] or through Discord.

We are based in the United States, and our customers use the Service from around the world. When you use the Service, your information may be transferred to, stored in, and processed in the United States and in other countries where we or our service providers operate. These countries may have data-protection laws that differ from those in your country of residence.

Where we transfer personal information from the EEA, the United Kingdom, or other jurisdictions that restrict cross-border transfers, we rely on appropriate safeguards recognized under applicable law, such as the European Commission's Standard Contractual Clauses (and the UK Addendum where relevant), together with supplementary measures as needed. By using the Service, you understand that your information may be processed in the United States and other jurisdictions. To request more information about the safeguards we use, contact [email protected].

Depending on where you live, you may have rights over your personal information. We honor these rights where and to the extent applicable law grants them to you, regardless of where you are located.

EEA and UK Rights

If you are in the EEA or the United Kingdom, then, where and to the extent applicable law grants you these rights, you have the right to: access your personal information; request correction of inaccurate data; request erasure; restrict or object to certain processing (including processing based on legitimate interests); request data portability; and, where we rely on consent, withdraw that consent. You also have the right to lodge a complaint with your local data-protection authority, although we encourage you to contact us first so we can try to resolve your concern.

California Rights (CCPA/CPRA)

If you are a California resident, then, where and to the extent applicable law grants you these rights, you have the right to: know what personal information we collect, use, and disclose (see Categories of Personal Information We Collect above); access a copy of that information; request correction of inaccurate personal information; request deletion of your personal information; limit the use of sensitive personal information; and opt out of the sale or sharing of personal information. As stated above, we do not sell or share personal information for cross-context behavioral advertising, so there is no sale or share to opt out of, and we do not use sensitive personal information for purposes that trigger the right to limit. We will not discriminate against you for exercising your rights, and we will not deny service, charge different prices, or provide a different level of service because you exercised a privacy right.

Other US State Rights

Residents of other US states with comprehensive privacy laws may, where and to the extent applicable law grants them these rights, have similar rights to access, correct, delete, and opt out of certain processing, and to appeal a denied request. We extend comparable rights to these residents where and to the extent required by applicable law.

How to Exercise Your Rights

To exercise any of these rights, email [email protected] or contact us through Discord. We will verify your request, typically by confirming control of the Discord account or email associated with your account, before acting. You may use an authorized agent where the law permits, subject to verification. We respond within the timeframes required by applicable law.

Appeals

If we decline your request, we will explain why. Where applicable law (for example, in Colorado, Connecticut, Virginia, and other states) gives you the right to appeal, you may appeal our decision within the statutory window by replying to our decision or emailing [email protected] with the subject line "Privacy Appeal." We will review the appeal and inform you of the outcome, and our reasons, within the period required by applicable law. If your appeal is denied, we will also tell you how to contact the relevant regulator or attorney general.

The Service is intended solely for adults aged 18 and over and is not directed to children. We do not knowingly collect personal information from anyone under 18 (or under the age of majority in your jurisdiction, if higher). You must be at least 18 years old, and able to enter into a binding contract, to create an account or use the Service, as set out in our Terms of Service.

If you believe that a person under 18 has provided us with personal information, contact [email protected] and we will take reasonable steps to delete that information and close any associated account.

The Service relies on, links to, or interacts with third-party services that operate under their own privacy policies and terms. We are not responsible for the privacy practices of these third parties, and we encourage you to review their policies.

• Discord provides one of the ways to sign in and primary support. Your use of Discord is governed by Discord's own terms and privacy policy.
• Payment processors. Stripe processes card payments and a third-party crypto payment processor handles cryptocurrency payments, each under its own privacy policy.
• Infrastructure, delivery, and analytics providers. We use a content-delivery and infrastructure provider to deliver and protect our website and for cookieless, aggregate web analytics, and we use a third-party email-delivery provider to send transactional email, each under its own privacy policy. Consistent with the rest of this policy, we do not name the network and infrastructure suppliers we use to provide the proxy Service.
• Target websites and services. The websites, applications, and services you access through our proxies and servers are operated by third parties and have their own privacy policies and terms of use. You are solely responsible for complying with applicable law and with the terms of the websites and services you access through the Service, as described in our Acceptable Use Policy.

Some public pages of our website show a Trustpilot widget with our rating and reviews. It is loaded from Trustpilot's servers, which receive your IP address and browser information when it loads, and Trustpilot handles that information under its own privacy and cookie policies.

Any data you exchange with those third parties is between you and them, and is outside the scope of this Privacy Policy.

We offer the Service to customers worldwide, including in the European Economic Area (EEA) and the United Kingdom, and we process EEA and UK personal data in connection with the Service. We have assessed our obligations under Article 27 of the GDPR and the UK GDPR regarding the appointment of an EU and/or UK representative.

We have not appointed a separate Article 27 representative at this time. Where the appointment of an EU or UK representative becomes required, we will designate one and publish the representative's contact details in this policy. In the meantime, EEA and UK data subjects, and supervisory authorities, may direct all data-protection inquiries and requests to us at [email protected], and we will respond as required by applicable law. We have not appointed a separate Data Protection Officer; our data-protection inquiries are handled through this contact route.

We may update this Privacy Policy from time to time to reflect changes to the Service, our practices, or legal requirements. When we make changes, we will revise the "Last updated" date below and post the updated policy at resifactory.net/privacy. If the changes are material, we will provide additional notice, such as through the dashboard, by email, or via Discord, where appropriate.

Your continued use of the Service after an updated policy takes effect constitutes acceptance of the changes, to the extent permitted by applicable law. Where a change would introduce processing that requires your consent under applicable law (for example, certain new processing relying on consent under the GDPR or UK GDPR), we will obtain that consent separately rather than relying on your continued use. We encourage you to review this policy periodically. Last updated: November 10, 2026.

If you have questions, requests, or concerns about this Privacy Policy or how we handle your personal information, you can reach us at:

• Privacy and data-protection requests (including EEA/UK inquiries): [email protected]
• General, billing, and refund requests: [email protected] (see our Refund Policy)
• Legal notices, abuse reports, and law-enforcement requests: [email protected]
• Discord: through your Discord support ticket

The Service is operated by Soni's World LLC, a New York limited liability company doing business as ResiFactory. This Privacy Policy is governed by the laws of the State of New York, United States, without regard to its conflict-of-laws principles, except where overriding data-protection law in your jurisdiction applies. For related terms, see our Terms of Service and Acceptable Use Policy.