Privacy policy

What information PayForServices receives when you visit, why it is used and how to manage your preferences.

1. Scope

This policy covers public pages and accounts available by invitation on payforservices.net, including its Russian and English versions. “Website” and “PayForServices” refer to this web resource; a separate section at the end of this document is provided for the operator’s details.

The website provides a catalogue, guides and sign-in for accounts created by the operator for invited users. Public registration remains closed. Orders and payments are not accepted, and there are no payment or document-upload forms. The operator is testing access to a gifted digital product through the account area. Account data processing is described below.

2. Information and purposes

When you request a page, the server receives information needed to establish the connection and respond to your browser. Some of this information, including an IP address, may constitute personal data. Browsing without an account does not make your visit entirely anonymous.

Connection

IP address, request date and time, requested URL including parameters, and response status. Used to deliver pages, diagnose errors and protect the website against abuse.

Browser details

Browser type and version, operating system information and referring page, to the extent your browser sends them in request headers. These may appear in technical logs.

Country

A country code estimated from your IP address. Used to select a language, not to establish your identity or precise location.

Language

Your RU or EN preference is stored in your browser. Without a saved choice, connection country and browser language are considered.

A search phrase may form part of a page URL and enter request logs when that URL is loaded. Do not enter passwords, activation codes, payment information or other confidential details in the search field.

Technical processing supports website availability and security; a language preference is saved when you choose it. Viewing a page or reading this policy is not treated as separate consent to advertising, mailing lists or future processing. Where applicable law requires consent for a particular operation, that consent must be requested separately from these documents.

Accounts by invitation

Sign-in uses a username, or an email address associated with the account, and a password. Third-party account sign-in and OAuth are not used. The test account uses fictional details, without a participant’s real name, email address or phone number.

Account access

A username, an associated email address if present, a WordPress password hash and session data. The password is processed during sign-in, password changes and code disclosure; the server stores its hash rather than a plaintext password.

Digital products

The link between a product and its account, product name, value, and the times it was added and first revealed. These records allow the owner to see the products available to them.

Activation codes

Stored encrypted on the server. In the account area, a code is disclosed to its owner after they submit the form and confirm their current password. An ordinary page request does not include the code in the response.

Form protection

Attempt counters are stored under HMAC hashes of the IP address and entered identifier. Single-use forms use stored hashes of protective tokens and their bindings, along with the action and expiry. These service records do not store raw IP addresses, usernames, passwords or activation codes; connection-log IP processing is described separately.

This information provides access to the account and its products and protects sign-in and code disclosure against unauthorised access. Account recovery is handled through the operator’s contact details. Automatic password-reset emails are not provided; passwords and activation codes are not requested by email.

3. Country and language selection

To estimate your country, your connection’s IP address is sent over an encrypted server-to-server connection to FolkLore, which uses IPinfo. PayForServices receives only a country code in response. The request does not include your name, email, passwords, payment information or browser fingerprint. We do not request device location permission or use GPS.

The PayForServices server caches the country code under a keyed hash of the IP address. The raw IP is not stored in that cache record. This reduces the information retained, but does not make all processing anonymous: the IP address is still involved in the connection, server logs and the provider request.

Your manual language choice takes priority. It changes the website’s displayed language, but does not disable server-side IP processing or country lookup. Direct links to Russian and English pages keep their language. If country lookup is unavailable, browser language or English is used. VPNs, proxies and mobile networks can affect the accuracy of the result.

4. Preferences on your device

Your language preference is stored in localStorage as pfs-language, with the value ru or en. This record contains no unique visitor identifier. It is created when you choose a language or elect to keep the current language in a suggestion, not simply when you open a page.

You can remove it using “Use my location” in the RU / EN menu or by clearing the website’s data in your browser. The cookies and stored preferences policy explains retention, cookies and browsing without a saved choice.

Sign-in uses a protective form cookie and WordPress session cookies. Their purposes and lifetimes are described in the accounts and sessions section. The website does not store passwords or activation codes in localStorage.

5. Recipients and external resources

Technical information is processed by the infrastructure hosting the website. Server administration and hosting maintenance may involve access to technical logs for those tasks.

FolkLore and IPinfo are involved in country lookup as described above. IPinfo states in its privacy policy that its services are hosted in the United States. Request processing may therefore take place outside your country. Our cache periods do not determine IPinfo’s retention periods.

The public interface does not embed third-party web analytics, advertising pixels or social widgets. Fonts and illustrations are served by our website. Following an external link opens a resource whose owner processes information under its own rules.

Visit data is not sold or provided to advertising networks for targeting. Data may be disclosed to public authorities where there is a lawful basis and to the extent required by it.

6. Retention

Browser language

Until you or your browser remove the preference. No automatic expiry is set.

Country cache

The PayForServices server uses a result for one hour. FolkLore’s cache of IPinfo lookups lasts up to one hour. These are cache validity periods, not a guarantee that every backup is immediately erased.

Access log

Daily rotation is configured, retaining up to 14 archived logs. Empty logs are skipped, so 14 archives do not always mean 14 calendar days.

Sign-in and session

The guest-form cookie lasts up to 30 minutes and is deleted after successful sign-in. Authentication cookies are session cookies, without a “Remember me” option; the server-side session lasts 12 hours. Signing out ends the current session, while changing the password ends the account’s previous sessions.

Attempt protection

Rate-limit counter windows last 10 minutes; a single-use form token lasts 15 minutes. Expired tokens immediately become invalid, and elapsed windows no longer count towards limits. Records are physically cleaned up on account-page requests and by an hourly WP-Cron task. Its execution depends on requests to the website, so removal at the exact expiry time is not guaranteed.

Account and products

Account details, digital-product assignments, and the times products were added and codes revealed are retained until the operator deletes them, taking applicable grounds for retention into account. Automatic deletion of accounts and these records has not been configured.

The rotation rule covers the website access log. It does not set a single retention period for security logs, infrastructure backups or service providers’ records. Clearing your browser’s data does not remove server records already created.

7. Security

The website uses HTTPS. Country lookup is transmitted over an encrypted connection between servers, and service credentials are not sent to your browser. Access to server files and configuration is restricted through technical access permissions.

These measures reduce risk but cannot guarantee the absolute security of every internet connection. Do not submit passwords, verification codes or payment information through website search or external pages impersonating PayForServices.

8. Rights and requests

Depending on applicable law, you may have rights to receive information about processing, access your data, request correction, erasure or restriction, object to processing, and complain to a competent data protection authority. Data portability and withdrawal of consent apply where provided by law and relevant to the processing basis.

The scope of these rights, response periods and any exceptions depend on applicable law. For example, a legal duty to retain records may limit erasure. Where processing is based on consent, withdrawing it does not affect the lawfulness of processing already carried out.

To locate a technical record, useful details generally include the page URL, approximate date and time of the visit, and a description of the issue. An IP address alone does not prove identity: it may be shared or change over time. Do not send passwords, protective tokens, activation codes or card details. Identity documents should not be sent without a separate, justified need. A section for contact details is provided under “Operator and contact details” below.

9. Policy revisions

The current revision date appears at the top of this page. This document is to be updated when website features or data processing change. Publishing a new revision does not itself provide consent for new purposes.

Our terms of use cover the use of website materials. This policy and its Russian version describe the same website practices.