🔒 Privacy Policy
1. Who is responsible
WebX11 is operated by Akan Goksu Valdes, Spain (European Union), who is the data controller for the processing described here. Contact for anything in this policy or to exercise a right: darkmotox11@gmail.com · Telegram @darkdroidx11. We answer within one month.
The server is hosted in France. Both the controller and the hosting are inside the European Union, so the GDPR governs this processing.
2. What we actually store
The previous version of this page said we collect no personal data. That was wrong. This is the complete list, and it is short on purpose:
| Category | Exactly what | Where it comes from |
|---|---|---|
| Account | username, e-mail address, bcrypt password hash, encrypted WebDAV token, session hash + salt, created/last-login timestamps | you, at registration |
| Payment & delivery | order reference (WX11-…), amount, currency, payment provider, provider transaction id, status, buyer e-mail, download token | checkout, and the provider (bunq / PayPal / crypto network) |
| AI usage | per request: model, prompt/eval token counts, cost in USD, cached-token share, the account the call was billed to | the AI gateway, automatically |
| Security | IP address, timestamp, method and path of each request; ban records while a ban is active (longest here: 24 h) | web server and fail2ban, automatically |
| Feedback | the text you type into the feedback widget, plus the page you were on | you, if you send it |
| Güneş membership | a salted, non-reversible hash of your Telegram id, join date, consent version and session token hashes — no name, username, photo, e-mail, phone or IP | the Güneş membership service |
3. Why we process it (legal bases)
- Contract (GDPR Art. 6(1)(b)) — account, hosting, delivering what you bought, keeping the ledger that proves what you paid and what you used.
- Legal obligation (Art. 6(1)(c)) — retaining invoices and transaction records for the period accounting law requires.
- Legitimate interest (Art. 6(1)(f)) — keeping the service up and abuse-free: security logs, rate limiting, ban records, and pricing every AI request so one user cannot consume another's allowance. We keep this data minimal precisely so the interest stays balanced.
- Consent (Art. 6(1)(a)) — only where we ask explicitly, e.g. the Güneş membership consent tick-box. You can withdraw it at any time.
4. Cookies
Authentication only, both set HttpOnly and SameSite=Lax:
wx11_session— your WebX11 login session.gunes_session— your Güneş Uygarlığı membership session (if you have one).
No analytics, no advertising or social cookies, no third-party scripts on this site.
5. Who else sees your data
We do not sell data. These processors see only what their function requires:
- Telegram — if you sign in with the Telegram widget, or receive a delivery message. Telegram sees the login interaction under its own policy.
- bunq, PayPal, crypto networks — they process the payment; we receive the reference, amount and status, not your card or bank credentials.
- AI model providers — prompts are sent to the provider that serves the model you chose, in order to answer you. Requests are priced and logged here.
- Hosting provider — the server in France that runs the service.
Some of these (Telegram, model providers) may process data outside the EU. Where that happens, the transfer relies on the provider's own safeguards (standard contractual clauses or an adequacy decision).
6. How long we keep it
- Account data — until you delete your space or ask us to erase the account.
- Web server access logs — 14 days (daily rotation, 14 copies).
- Ban records — while the ban is active, longest 24 hours here.
- Purchases and AI usage — for the period accounting requires, and because purchased credit stays valid for 12 months, the ledger that shows its consumption is kept for that window.
- Güneş membership — until the member asks to be removed; then the row is deleted, not flagged.
7. Your rights
You can ask for: access to your data, a copy of it (portability), correction, erasure, restriction of processing, and you can object to processing based on legitimate interest. Write to darkmotox11@gmail.com — no form, no account required. If you are not satisfied, you may complain to the Spanish supervisory authority, the AEPD (aepd.es), or to the authority in your own country of residence.
8. Two separate systems
Güneş Uygarlığı (/gunesuygarligi/) runs its own
invite-only membership in its own database. A Güneş member is not a WebX11
account and gets no hosting, WebDAV or AI-credit rights. That community has its own
notice: gizlilik ·
üyelik koşulları.
9. Children
The service is not directed at children. We do not knowingly hold data of anyone under 16; if you believe we do, write to us and we will delete it.
10. Security
Passwords are stored as bcrypt hashes (cost 12), never in clear. WebDAV tokens are encrypted at rest. Sessions are server-side and stored as hashes. The site is served over TLS only. Access to the server is key-based. No system is perfect: if a breach affects your data, we will inform you and the supervisory authority as Art. 34 requires.
11. Changes
Material changes are announced on the site and to registered users, and the date at the top of this page moves. This page is generated from a single list of facts, so it cannot drift away from what the code actually does.