Privacy Policy
Effective 4 October 2026 · Bondom Account, Cambodia
This Privacy Policy explains what personal data Bondom Account collects, why we collect it, how long we keep it, and what control you have over it. It applies to our website, our Telegram bot, and our public API.
1. Who is responsible
Bondom Account, operating in Cambodia, is the controller of the personal data described here. Contact details are at the bottom of this page.
2. What we collect
Information you give us, through Telegram
When you sign in, Telegram passes us a signed set of fields. We store only your Telegram numeric ID and your username or first name. We do not receive your phone number, your contacts, your messages, or your Telegram password.
Information created by using the service
- Orders — what you bought, quantity, price, status, and time.
- Wallet activity — top-up amounts, payment references, and your current balance.
- Payment references — the transaction hash used to verify a KHQR payment with Bakong. We never see or store your card number, bank login, or account balance at your bank.
- SMS rentals — the service and country you chose, the temporary number issued, and the verification code received, so it can be shown to you and refunded if it never arrives.
- API usage — if you create an API key: the request method, path, response status, duration, and originating IP address.
Information collected automatically
Our server keeps standard operational logs (IP address, timestamp, requested path, response status) for security and debugging. We do not use third-party analytics, advertising trackers, or profiling tools.
3. Why we use it, and our legal basis
| Purpose | Data used | Basis |
|---|---|---|
| Deliver what you bought | Telegram ID, orders | Performance of a contract |
| Take and credit payment | Payment references, balance | Performance of a contract |
| Support, refunds, warranty | Orders, wallet activity | Performance of a contract |
| Prevent fraud and abuse | Logs, IP, usage patterns | Legitimate interests |
| Keep accounting records | Orders, payments | Legal obligation |
| Run and secure the API | API keys, request logs | Legitimate interests |
We do not sell your data, and we do not use it for advertising.
4. Who we share it with
We share the minimum necessary with:
- Telegram — to authenticate you and deliver your purchases to your chat.
- Bakong and participating banks — to generate and verify KHQR payments.
- Our SMS provider — to rent a number on your behalf. They receive the request, not your identity.
- Our hosting provider — which stores the server and database on our behalf.
We may also disclose data where required by law, or to establish or defend a legal claim. We will not hand over data on an informal request without a lawful basis.
5. Where data is stored
Our database is hosted on a virtual private server. Data may be processed outside Cambodia by the providers listed above, under their own terms. Backups are retained for 14 days on a rolling basis.
6. How long we keep it
| Data | Retention |
|---|---|
| Account (Telegram ID, username) | While your account exists |
| Orders and payment records | Kept as accounting records even after account closure |
| Wallet balance | While your account exists |
| SMS rentals and codes | While your account exists |
| API request logs | Rolling window for security and debugging |
| Admin audit log | Retained long-term — it is the record of who did what |
| Backups | 14 days |
7. Deleting your account
You can ask us to delete your account at any time. What happens depends on whether you have purchase history:
- No orders — the account, wallet balance, API keys and any SMS rentals are permanently deleted.
- With orders — the account is deactivated so it can no longer sign in or buy. Order and payment records are retained as accounting records, because we are required to keep them. They are no longer used for anything else.
Deactivation is reversible; permanent deletion is not. Any remaining wallet balance is forfeited on deletion unless you ask us about it first, so contact us before requesting deletion if you hold a balance.
8. Your rights
Subject to applicable law, you can ask us to:
- confirm what data we hold about you, and give you a copy;
- correct data that is wrong;
- delete your account, as described above;
- restrict or object to a particular use;
- export your data in a machine-readable form.
Ask through the support contact below. We aim to respond within 30 days. We may need to confirm you control the Telegram account in question before acting, so that no one can request someone else's data.
9. Security
Measures we actually apply, not aspirations:
- Sign-in uses Telegram's signed login — we never handle your Telegram password.
- Session cookies are HMAC-signed, HTTP-only, marked Secure in production, and set to SameSite=Lax.
- State-changing forms carry an anti-CSRF token bound to your session.
- The admin password is stored as a salted PBKDF2-SHA256 hash, never in plain text, and admin sessions time out after inactivity.
- API keys are stored only as SHA-256 hashes; the key itself is shown once and cannot be recovered by us.
- Database access goes through parameterised queries, and page output is escaped by default.
- Privileged administrative actions are written to an audit log.
No system is perfectly secure. If we discover a breach affecting your personal data, we will notify affected users and any regulator we are required to inform, without undue delay.
10. Children
The service is not intended for anyone under 18. We do not knowingly collect data from children. If you believe a child has given us data, contact us and we will delete it.
11. Cookies
See our Cookie Policy. In short: we set one cookie to keep you signed in and store nothing else in your browser. There are no advertising or analytics cookies.
12. Changes
We may update this Policy. The effective date above always shows the current version, and material changes will be announced before they take effect.
13. Complaints
If you think we have mishandled your data, contact us first — we would rather fix it directly. You may also complain to the data protection authority in your country where one exists.
Questions about this document? Contact us at
@bondomaccount_bot
or khun_seivkheng@bkrt.