Privacy Policy

1. Scope

This Policy explains how GasTank handles information when you browse the website, use the customer console or rental API, place an order, or contact us. It covers our service records, not the independent processing carried out by a wallet, public blockchain, explorer or website you choose to use. Browser storage is explained in our Cookie Policy.

2. Information we process

• Account and security information: email address, account identifiers, verification status, password hashes, session information and records of security changes. If you enable an authenticator, we store its secret encrypted and store recovery-code verification hashes. We do not store your account password in plaintext.
• Rentals and payments: wallet and deposit addresses, network, requested Energy and Bandwidth, rental duration, quote and order identifiers, transaction hashes, payment amounts, account balances, freezes, settlement entries, delivery and recall results, and information needed to investigate a payment.
• API access: key identifiers and names, permission scopes, verification hashes, creation, expiry, last-use and revocation records, and request identifiers used to process orders and prevent duplicate charges. Full API keys are shown when created; their verification hashes are stored instead of the full tokens.
• Technical and security information: IP addresses and request metadata processed by our hosting, proxy and application infrastructure, request times, error and diagnostic records, rate-limit counters and information needed to detect misuse. The data retained depends on the logging and infrastructure used by the deployment.
• Messages you send: your contact details and the contents of support correspondence. The contact form opens your email application when a support email is configured; sending a message is handled by your email provider rather than by a separate website form-inbox service.

You can request a direct-payment rental without creating a customer account, but this does not make the transaction anonymous: wallet addresses, payment records and network-request information may still be associated with the order. Wallet addresses can be linked to individuals or other activity.

We do not ask for your external wallet private key, recovery phrase or authority to sign transactions. Do not send these, or passwords, API keys or recovery codes, in support messages.

3. Why we use information

We use information to provide quotes, match payments, delegate and recover resources, maintain balances and audit records, authenticate users, protect accounts, prevent duplicate orders and abuse, investigate failures, respond to requests, and meet applicable legal obligations.

Where applicable data-protection law requires a legal basis, processing may be necessary to perform a requested service or contract, comply with law, or pursue legitimate interests in service security, reliability and dispute handling, subject to the safeguards and balancing required by that law. When consent is required for an optional purpose, we will obtain it separately and allow it to be withdrawn. We do not treat browsing the site or accepting service terms as blanket consent to all processing.

4. Public blockchain information

Payments, activations, delegations and recalls can create public TRON records containing addresses, amounts, timestamps and transaction relationships. We send the information needed for transaction preparation, broadcasting and verification to the relevant network and RPC providers. Public records can be copied and analyzed by anyone and may be linked to other information.

We cannot delete, change or make private data already written to a public blockchain. Closing an account, clearing browser data or submitting a privacy request does not remove those public records.

5. Sharing and external services

We share information only as needed for service delivery, security, a business or legal process described here, or as otherwise permitted or required by law. Recipients can include hosting and storage providers, email delivery providers, RPC infrastructure, and diagnostic or support services used for the deployment. Where enabled, diagnostic services may receive technical error information; credentials and authentication secrets must not be included in support or diagnostic submissions.

If you follow an explorer, wallet, Telegram or other external link, your browser communicates with that provider and its own privacy practices apply. We may disclose relevant information to competent authorities or advisers when legally required or reasonably necessary to establish, exercise or defend legal claims. A business transfer may require a transfer of relevant service records, subject to applicable safeguards and notice requirements.

We do not sell or rent your personal information for advertising. The current application does not include advertising pixels or browser analytics trackers.

6. Retention

We retain records according to the service, security, accounting and legal purposes for which they are needed, and review requests to delete or limit them subject to those purposes and applicable law.

• Email verification and password-reset challenge records become eligible for scheduled cleanup 24 hours after their latest request, regardless of whether they are still valid or have been used. This does not delete the associated customer account or email address. Batch scheduling or failures can delay cleanup.
• Expired balance quotes without an associated order become eligible for cleanup after the configured retention period, currently seven days after expiry. Quotes associated with orders are retained with the order records.
• Account, order, ledger, security-event and API-key audit records are retained for reconciliation, security and dispute handling. Revoking or expiring a key disables access but does not automatically erase its audit record; the current service does not apply automatic deletion to API-key records.
• Operational logs and provider records follow the applicable deployment and provider retention settings. We do not claim a universal deletion period for every system.

Authentication-token validity and record retention are different: keeping a record does not keep an expired session, code or revoked API key usable.

7. Security and your choices

We use measures appropriate to the service, including password hashing, encrypted authenticator secrets, access controls and verification of security-sensitive operations. No online service or public blockchain can be guaranteed secure or continuously available. Use a strong unique password, enable your authenticator, keep recovery codes offline and revoke keys you no longer need.

Depending on applicable law, you may request access, correction, erasure, restriction, objection or a portable copy of information, withdraw consent where processing relies on it, or complain to a competent data-protection authority. Use the contact page to make a request. We may need to verify your identity without asking for wallet secrets and may retain records where required or permitted for legal obligations, security, reconciliation or legal claims. We will explain relevant limitations when responding. Your rights over our records do not let us erase the blockchain or another independent provider's records.

8. Locations, children and changes

Hosting, communications and blockchain infrastructure may process information in countries other than where you live. Where a regulated international transfer occurs, we must use the safeguards required by the law that applies to that transfer. This Policy does not claim a specific storage country or transfer mechanism that has not been selected for the deployment.

The service is not directed to children. If you believe a child provided personal information without appropriate authority, contact us so we can review it.

We may revise this Policy as our service or data practices change, show the updated date, and provide additional notice where required. Questions and privacy requests can be sent through the channels on the contact page.