Commission Privacy Notice

1. Controller, scope, and contact

The Deftrial commission service is operated by Operator identity pending configuration; request intake is closed from Indonesia; city/region pending configuration. For information collected directly through this shop, that operator determines the operational purposes and methods of processing.

This Notice covers the storefront, request form, private order workspace, optional ticket, queue, payments, files, and communications through the selected channel used to operate the commission. Privacy questions, data requests, or complaints may be sent to deftrial@gmail.com.

2. Information that may be collected

Information may include name, email, WhatsApp/phone number, social contact username where provided, contact preference, commission title and brief, intended use, deadline, references, ticket messages where activated, attachments, review decisions, delivery files, payment status, payment proof, Terms acceptance records, and operational security logs.

Do not send passwords, PINs, OTPs, full card data, identity cards, a complete home address, health information, or other sensitive information unless it is genuinely necessary. The Artist may ask the Customer to remove or replace files containing excessive data.

3. Purposes and processing grounds

Information is processed as reasonably necessary to receive and assess requests, communicate, create quotations, verify payment, manage schedules and the queue, create receipts and accounting exports, create and deliver art, administer licenses, record decisions, provide support, prevent fraud, maintain security, meet legal/accounting duties, and handle complaints or disputes.

The applicable basis may differ by activity, including steps requested before a contract, performance of the commission agreement, legal duties, proportionate legitimate interests such as security and fraud prevention, or separate consent where the law actually requires it. Acknowledging this Notice records transparency; it is not unlimited consent for every possible use.

4. References, real people, and sensitive material

The Customer is responsible for ensuring references can lawfully be provided and do not violate another person’s privacy, copyright, dignity, or consent. References involving a real person must be limited to what the work requires and must not be used for doxxing, deceptive deepfakes, non-consensual intimate material, harassment, or another prohibited purpose.

If a file appears to contain child exploitation, a credible threat, fraud, or illegal material, access may be restricted and records may be preserved or reported where necessary and lawful.

5. Payment information

The Workspace stores the payment/order ID, selected method, USD contract value, exchange-rate snapshot, checkout amount and currency, displayed destination and recipient name, status, time, transaction reference, evidence, and verification outcome. For DANA, ShopeePay, or BCA, the record may include the destination number and recipient name configured by the operator.

Refund records also state whether the transaction reduces the contract value or is a payment reversal that reopens the balance. This classification is used for consistent balance calculation and for reconciliation or dispute evidence.

The system may also store payment intents, hashed idempotency keys, webhook inbox records, reconciliation outcomes, and notification outbox records so browser retries, duplicate callbacks, provider interruption, or email failure do not silently duplicate or lose a transaction. Scheduled checks retain integrity-protected heartbeats and operational counts, not chat content, credentials, or raw payment payloads.

To prove that operational email is actually received, an administrator may send a one-time confirmation code to the monitored address. The code and address are held temporarily as hashes; the temporary email record is removed after confirmation, expiry, or the attempt limit.

The shop does not request or store account passwords, PINs, OTPs, verification codes, remote access, balances, unrelated transaction history, PayPal passwords, or complete card data. Evidence should be limited to the relevant transaction, and the Customer should conceal unrelated information.

QRIS providers, banks, acquirers, Midtrans, PayPal, DANA, ShopeePay, card issuers, and other providers may process transaction data under their own services and policies. Only information needed for the transaction, verification, refund, fraud prevention, accounting, or dispute should be used.

6. Public queue and private workspace

The public queue should display only anonymized operational information such as general status and position. Identity, contact details, brief, references, chat, payments, and deliveries must not be shown there.

The initial customer link exchanges its private token once for a session scoped to one order; normal workspace pages do not need to carry the token in the URL. The link can be revoked and replaced. The Customer must protect it as confidential access and promptly report suspected exposure.

7. Service providers, disclosures, and cross-region processing

Where the Customer chooses Instagram, X/Twitter, Telegram, WhatsApp, or another communication platform, messages and metadata are also processed by that platform under its own policies; this shop does not control the external platform. Information may be processed by hosting/cPanel, storage, email, security, backup, and payment providers to the extent needed to operate the service. Limited information may also be disclosed to an adviser, mediator, payment provider, relevant platform, or competent authority to handle a transaction, claim, fraud, safety issue, or legal duty.

Some providers may operate systems outside the operator’s city or country. Provider selection and transfers should reasonably consider necessity, contracts, security, and legally required safeguards. This shop does not sell or rent customer data for advertising profiles.

8. Retention, deletion, and backups

Formal complaints retain a category, chronology, evidence hash, provider reference where relevant, resolution state, and retention hold while active. Email notifications may use PHP mail or authenticated SMTP; SMTP passwords are read from a protected file outside the public web directory and are not copied into order records.

Current operational targets are approximately 180 days for inactive requests and 730 days for completed orders. Limited longer retention may be needed for accounting, tax, transaction evidence, licenses, security, chargebacks, claims, backups, or legal obligations.

After the retention period ends and no legitimate administrative hold applies, the system builds a minimum allowlisted record: access tokens are replaced and customer identity, contact details, free-text briefs, messages, private notes, and files that are no longer needed are removed. Linked operational records—including idempotency, payment intents, webhooks, notifications, and safety queues—are also deleted or minimized. A minimum record of transaction values, payments/refunds, status, legal-acceptance versions and hashes, license terms, and reconciliation evidence may remain where needed for accounting, contract evidence, security, claims, or legal duties. The action is logged, does not silently change payment status, and remains failed until related files and records are actually cleaned.

Deletion from the active application may not immediately remove rotating backup copies or records that must still be kept. Production backups are created as authenticated encrypted bundles, may be divided into bounded chunks for large files, are kept outside the public directory, and are tested by restoring to a separate location. The backup key must be stored separately. Backup data must not be reused for a new purpose and should disappear through a reasonable rotation cycle.

9. Security and technical limits

Controls include protected file storage, file-type and image-dimension validation, server-assigned filenames, size limits, scoped order sessions, administrator sessions, CSRF protection, password hashing, rate limits, and signed event/checkpoint commission history. HTTPS and hosting-server protection must still be correctly configured on the production domain.

Sensitive administrator changes are recorded in a signed journal containing the operator name, action, target, time, and hashed technical fingerprints. API keys and password contents are not written to that journal. Production administration requires a password, TOTP, and fresh confirmation for high-risk actions.

No online system can promise absolute security. The Customer should use a secure device and email account, avoid sharing tokens, and report suspicious access or files promptly. Material incidents will be handled according to the facts and applicable legal duties.

10. Customer rights and requests

Subject to applicable law and proportionate identity verification, the Customer may request information, access, correction, updating, restriction, withdrawal of consent where consent is actually the basis, or deletion. A request does not necessarily mean every record can immediately be erased; transaction evidence, security, claims, and legal obligations may require retention.

A request should include the order number, email used, the type of request, and enough information for verification without sending excessive identity data. An initial response will be provided within a reasonable period through deftrial@gmail.com.

11. Customers under 18

This real-money service is intended for a person who is at least 18 and legally capable, or for a transaction genuinely managed by an authorized parent/guardian. A child must not independently submit sensitive information, payment, or private material.

If the operator learns that a child’s data was submitted without an adequate basis or guardian involvement, the request may be stopped and the information reviewed for deletion, protection, or another action required by law.

12. Sessions, server logs, and local storage

The shop uses a session cookie needed for form security and administrator login. The browser may also store the selected theme locally. The system is not designed with third-party advertising trackers.

The initial customer link carries its token in a browser fragment that is not sent as part of the HTTP request, then exchanges it for a session limited to one order. The token can be revoked and replaced. Browser history, screenshots, shared devices, extensions, and browser synchronization remain outside the application’s complete control.

The hosting server, firewall, CDN, or payment provider may log IP addresses, user agents, access times, and security metadata under their configurations. The application’s order-acceptance record does not store a raw IP address, but that does not mean the hosting infrastructure has no technical logs.

13. Form drafts stored on the device

To prevent the form from being lost after a refresh, the browser keeps a temporary draft in sessionStorage for that tab. The Customer may choose to keep it for up to seven days in localStorage on the same device. This data remains in the browser and is not sent to the server until the form is submitted.

A draft may contain the nickname, email, contact details, commission choices, and brief. Legal-consent checkboxes, security tokens, and reference files are not restored. Do not enable seven-day storage on a shared device. The Clear Draft button removes the application’s copy; browser settings, extensions, browser sync, or device backups remain outside the application’s control.

14. AI-assisted safety review

When the Artist enables this feature, a Customer’s title, brief, and ticket messages may be sent over HTTPS to the DeepSeek API provider to flag observable risks such as threats, harassment, hate, payment manipulation, doxxing, spam, or prohibited requests. Passwords, PINs, OTPs, payment credentials, and file attachments are not intended to be sent to this text analysis.

The AI result is visible only to the administrator as a second opinion and requires human review. It is not used for advertising, credit scoring, automated legal decisions, personality diagnosis, or factual claims about hidden intent. AI can be wrong, miss context, or misread language. A Customer may request human review or contact deftrial@gmail.com if a decision was influenced by an inaccurate result.

For documented repeated abuse, an email, phone number, or handle may be transformed into a one-way HMAC fingerprint on an internal watch/block list. The list is not public, does not permanently blacklist IP addresses, and must not be used to punish honest criticism or a good-faith dispute.

15. Changes, complaints, and related documents

The version of this Notice is recorded so changes can be tracked. Material changes operate prospectively and do not unilaterally alter the license, price, or duties of an accepted order.

A complaint should first be sent to deftrial@gmail.com. The Customer remains free to use an available complaint mechanism or competent authority under applicable law. This Notice is read together with the Commission Terms and Conditions.