Privacy and personal data
Controller and contact
The controller for the NFA.run service is Sole proprietor Daniil Kokorin, Georgia, Batumi, 15 Tabidze St, registration number В26424221, tax ID 345860151. Questions about personal data and rights requests can be sent to noreply@nfa.run or nfa.run/support. Identify the email used for your account, but do not send sign-in codes, authenticator secrets or payment-card details.
Data used to provide your account and orders
We store account email, role and status; sign-in sessions and security events; order references, items, amounts, payment status and payment-provider transaction references; balance movements; accepted document versions; delivery records and encrypted activation files. These records let us provide sign-in, process the contract, deliver purchases and resolve payment or access problems. We do not collect your PayPal password or full payment-card details on NFA.run.
Support and public reviews
Support conversations, their order links and uploaded images are stored privately. Access is limited to you and authorised staff according to roles and assignments. Internal staff notes are not public. Submit only information needed for your issue. After moderation, a product review displays its chosen name, rating and text publicly; the author’s email is not displayed. Editing a review sends it back to moderation.
Purposes and legal grounds
Account, payment, delivery and support data are processed to take steps at your request and perform the purchase contract. Transaction records may also be retained to meet applicable accounting and legal obligations. Security logs, access controls, abuse prevention and backup procedures serve our legitimate interest in protecting customers, funds and the service. A review is published when you submit it for that purpose. We do not require marketing consent to let you buy and do not currently use the site to send advertising newsletters.
Service providers and locations
The application and database run on Hetzner in Helsinki, Finland. Cloudflare handles network delivery and protection. Timeweb sends sign-in emails and receives the recipient address and message. PayPal processes payments and receives order references, items and amounts; its own privacy notice applies to its service. Acode supplies account activation: the integration uses product types and activation references, not your NFA.run login email or card details. Encrypted recovery copies may be stored separately from the VPS. The controller is based in Georgia; some providers operate internationally, so processing is not confined to the EEA. Contact us for information about the applicable transfer arrangements and data locations.
Retention and protection
Email codes expire after 10 minutes and are stored as keyed hashes. Expired authentication records are removed by scheduled cleanup. Authenticated sessions expire after 30 days without activity. Authenticator secrets and activation files are encrypted; staff access requires additional authentication. Account records are needed while the account is in use. Order, payment, warranty and dispute records are retained for contract handling and applicable legal obligations or claims; the relevant purpose and required legal period determine retention, rather than browser-cookie expiry. A deletion request is assessed against those obligations; records that must be retained are restricted to the necessary purpose.
Your rights
Where applicable law provides them, you can request access, correction, deletion, restriction or portability of your data, and object to processing based on legitimate interests. Contact noreply@nfa.run or use a private support request. We may ask for proportionate verification to avoid disclosing someone else’s data. You can also complain to the competent data-protection authority, including the authority in your EU country of residence. Clearing browser storage alone does not delete server records. This notice may be updated as the service changes; accepted order terms remain saved separately.
Incoming messages to noreply@nfa.run are copied to the project owner and technical administrator using Mail.ru and Yandex Mail so they can respond to your request.
Cryptocurrency payments
When you select Heleket, we send the invoice reference, amount, currency and callback/return addresses. We do not send your NFA.run login email or the item list to Heleket. Heleket processes the chosen coin, network and transaction data on its payment page under its own privacy notice: heleket.com/privacy. We retain the provider reference, payment status and credit or delivery record to process your order and resolve issues.
Google Ads measurement
With your separate, voluntary consent, NFA.run uses Google Ads to match paid purchases to advertising. We send Google the order reference, payment time, actual amount paid excluding bonuses, currency, website source, available gclid/gbraid/wbraid advertising identifiers, measurement consent and denied personalization, and a SHA-256 fingerprint of the buyer’s normalized email when available. Email is hashed only on our server: this advertising integration never sends the plain address to Google or a browser tag. The hash is a matching identifier, not anonymous data. Names, telephone numbers, addresses, basket contents and details of the accounts sold are not sent.
Processing is based on your consent. Shopping and using the store do not depend on it. Without consent this advertising integration sends nothing, including the order event; no Google browser tag is loaded. Ad personalization is disabled. Your choice is stored in your browser for 180 days. Consented advertising identifiers are kept for no longer than 90 days from collection. The hash is stored encrypted only for delivery and retries, removed after Google accepts the live upload, and in all cases no later than that same 90-day limit.
Withdraw consent via Cookie settings → Essential only. The browser stops collection; once the server receives the withdrawal, it stops further uploads and deletes the stored hash and advertising identifiers for linked orders. If offline, withdrawal is retried when connectivity returns; account withdrawal takes effect after sign-in. A completed transmission cannot technically be undone; contact support about previously shared data. Store account and financial records are retained separately from advertising data. Google processes received information, including internationally, under policies.google.com/privacy and policies.google.com/technologies/partner-sites.
With valid consent, the Google tag on the paid order page receives only the server-computed email hash and purchase data. Automatic detection of contact details on the page is disabled. The hash is not stored in cookies or localStorage; the temporary page-memory copy is cleared after event processing, an error or leaving the page. Browser tag requests also expose the IP address, technical browser information, a sanitized page address and permitted advertising cookies to Google. If consent is declined the tag does not load; withdrawing consent after it has loaded reloads the page to stop its further operation.