Xameleon Privacy Policy

Last updated: November 10, 2026 · Data controller: Xameleon.cloud OÜ, Estonia

1. Introduction

Xameleon ("we", "us", "our") is operated by Xameleon.cloud OÜ (registry code 17528811, Tartu mnt 67/1-13b, Kesklinna linnaosa, Tallinn, 10115, Estonia), which acts as the data controller. We are committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard data when you use our services.

2. Information We Collect

Account Data: name, email address, and authentication provider (Google, Telegram, Apple, or email).

Usage Data: IP addresses, proxy usage statistics, request logs, and service performance metrics.

Analytics Data: only if you accept analytics cookies, Google Analytics records the pages you open and the steps you take on the site, your approximate location, language, device and browser type, and the identifier stored in its cookies. Our server reports your sign-up, order and payment to Google Analytics with that identifier (the Cookie Policy lists what is sent) and keeps the identifier with your order for that purpose only; section 7 says when it is deleted. We do not send your name, e-mail address or card details to Google Analytics.

Communication Data: messages you send via contact forms, email, or Telegram support.

Payment Data: the order number, the amount and currency, the payment method you choose, the payment status and the identifier of the payment at the payment provider; for a cryptocurrency payment also the coin and the amounts reported by NOWPayments. We do not receive or store your card number: card details are entered only on the payment page of Stripe.

Affiliate Program Data: if you take part in the affiliate program, we store the following.

• Partners: the link to the account, the partner code, status and individual percentage (if one is set), the payout details (the asset, network and address you give us), the time and version of the Affiliate Program Terms you accepted, and an internal note of our administrators.
• Visits through a link: the landing page, the domain of the website the visitor came from, the time, and a hash of the IP address made with a secret key (it cannot be turned back into the IP address).
• Referred customers: which partner referred the customer, when and how (link, promo code or administrator), and any partner discount applied to an order.
• Commissions: the order, the customer, the payment amount, the rate, the commission amount, the status, the date it becomes available and the reason for a cancellation.
• Payouts: the amount, a copy of the payout details at the time of the request, the status, the transaction hash, the time, the administrator who processed it and a comment.

3. How We Use Your Data

• Provide and maintain the Service
• Process transactions and send billing notifications
• Communicate service updates, security alerts, and support responses
• Analyze usage patterns to improve the Service (analytics cookies only with your consent)
• Send optional marketing communications (with your consent)
• Run the affiliate program: credit customers to partners, calculate and pay commission, and send partners e-mail or Telegram messages about joining and payouts
• Comply with legal obligations

4. Data Sharing

We do not sell your personal data. We may share data with trusted service providers (for example hosting, database, e-mail delivery and security providers) who are contractually obligated to protect it.

Payment providers. Payments are processed by independent payment providers: Stripe (cards, Apple Pay and Google Pay) and NOWPayments (cryptocurrency). To take a payment we send them only what is needed: to Stripe the order number, the amount and your e-mail address, and to NOWPayments the order number and the amount. You enter your payment details on their own pages (stripe.com and nowpayments.io). We do not receive or store your card number. Each provider is responsible for the data it receives and handles it under its own policy: Stripe Privacy Policy, NOWPayments Privacy Policy.

Analytics. If you accept analytics cookies, we use Google Analytics 4. Google Ireland Limited and Google LLC process the analytics data on our behalf as our processor, and may do so in the United States and other countries; Google describes the safeguards it applies to such transfers in its own terms and policies: Google Privacy Policy. Google signals and ad personalization are switched off, and we do not use the data for advertising.

A partner sees the customers they referred only as a number, for example "Customer #1", without a name or e-mail address. Our administrators receive Telegram messages about new partners and payout requests.

5. Cookies

We use essential browser storage to keep you signed in and to remember your preferences. With your consent we also use Google Analytics cookies (_ga and _ga_MFV7JV3QDR) to measure how the site is used: they are set only after you accept them in the cookie notice and last up to 13 months. You can withdraw your consent at any time with "Cookie settings" in the footer; the cookies are then deleted and analytics stops. We do not use advertising cookies. You may also control cookies through your browser settings. Read our Cookie Policy.

If you reach the site through a partner's link or promo code, we remember the partner code in your browser: in local storage after you accept cookies, and in session storage until the end of the visit if you have not. See the Cookie Policy.

6. Your Rights (GDPR)

• Access: request a copy of your personal data
• Rectification: correct inaccurate data
• Erasure: request deletion of your data
• Portability: receive your data in a portable format
• Objection: object to certain processing activities
• Withdraw consent: withdraw your consent to analytics cookies at any time with "Cookie settings" in the footer; this does not affect processing that took place before.

7. Data Retention

We retain account data for as long as your account is active. Usage logs are retained for 90 days. You may request deletion at any time.

Data in Google Analytics is kept for 14 months. If you have accepted analytics cookies, the identifier of your Google Analytics cookie is kept with your order only until the payment is reported to Google Analytics, and is then deleted from the order. If the order is cancelled or stays unpaid for 30 days, the identifier is deleted as well.

The hash of the IP address of a visit through a partner link is erased after 90 days; the record of the visit itself stays for statistics. Commission and payout records are kept for accounting purposes.

Order and payment records (the order, the amount, the payment method, the status and the payment identifier) are kept for accounting purposes for as long as the law requires, even if you ask us to delete your account data.

8. Security

We implement industry-standard security measures, including encryption and access controls, to protect your data.

9. Children's Privacy

The Service is not directed to children under 16. We do not knowingly collect data from minors.

10. Contact

For privacy inquiries or to exercise your rights, contact: [email protected]