Privacy policy

Who operates this service

The service is operated as UltraFX. The website configuration does not currently identify a registered legal entity or a postal privacy contact. For a privacy question, sign in with Discord and open a private support ticket, or contact the UltraFX team in its Discord server. The operator should add its legal name and contact details here if required for the places where it offers services.

Information we use

• Discord account and membership: Discord user ID, username, avatar, and current server membership and roles. Sign-in uses Discord OAuth with the identify scope. The bot checks server membership and roles to provide the appropriate dashboard access.
• Support tickets: ticket category, subject, messages, status, staff assignment and notes, activity history, and any rating or feedback you submit. If a website ticket is forwarded to Discord, it is also associated with its Discord support channel.
• Orders: selected products and quantities, price and currency, order details, uploaded references, order messages, fulfilment status, and staff verification or refund records. A verified purchase creates a linked support ticket.
• Payment and referral records: the order amount, selected payment provider, provider invoice/payment reference and status, whether payment was confirmed, and any recorded refund reference. If an affiliate code is used, we also store that code, the referred order, the 10% commission calculated on its total, and whether the commission is pending, earned, paid, or reversed.
• Reviews: the rating, optional written review, related product and order, and moderation decision.
• Technical and security data: the dashboard uses request origin checks and rate limits. For dashboard staff actions, it stores a keyed one-way fingerprint of the network address observed by the server and dashboard session identifier, alongside the staff member, action, target record, reason code, and timestamp. Discord actions are audited without dashboard IP or session data. The audit log does not store the raw address or session token. Audit records are not automatically expired; the operator should apply an appropriate retention schedule.

Payments and affiliates

Checkout can redirect you to PayPal or Stripe, depending on the option selected and which providers are configured. PayPal receives the business recipient, product description, amount, currency, and order reference. Stripe receives the order description, amount, currency, and order reference to create a hosted Checkout Session; it processes payment details and sends signed payment-status notifications to this website. Payment-account, card, and supported wallet details are handled by the payment provider and are not entered into or stored by this website. For Stripe orders, we retain the Checkout Session reference and latest status, and only mark an order paid after verifying Stripe's signed webhook. A return to this site alone does not confirm payment.

Affiliate attribution is optional. A referral code may be retained in your browser and is sent with an order only when you submit checkout. It does not discount your price or use a customer wallet balance. An affiliate earns 10% of a referred order after PayPal payment is verified by staff or Stripe confirms payment. Refunds or cancellations reverse eligible commissions. Affiliate payouts are processed outside this website; the dashboard stores the payout reference entered by an authorised manager.

Files and storage

Order reference files are limited to four PNG, JPEG, WebP, or PDF files, up to 2 MB each. They are stored in the site's private dashboard-uploads directory and are served only to the order customer or authorised staff. The server checks file signatures and verifies a stored integrity signature before serving files. When configured, the server sends a SHA-256 file hash (not the file contents) to VirusTotal for a hash lookup. VirusTotal can process that hash under its own terms; unknown hashes are not uploaded and are not considered clean, and a hash with no malicious or suspicious detections is not a guarantee that a file is safe. Uploads cannot be submitted when VirusTotal hash lookup is unavailable. Ticket, order, affiliate, review, and staff audit records are stored in the MongoDB database configured for the deployment. The hosting and database providers process information to operate the service.

Cookies and browser storage

• An HTTP-only, same-site session cookie keeps you signed in for up to 12 hours.
• A short-lived OAuth state cookie protects the Discord sign-in flow and expires after 10 minutes.
• Your basket, referral code, and ticket read markers are saved in this browser's local storage. They are not sent to the server until you submit a relevant request; you can clear them through your browser settings.
• Browser notifications are optional and are controlled by your browser. The dashboard does not use advertising or analytics cookies.

How information is used and shared

We use the information above to authenticate users, check server membership and role permissions, provide support, process and verify orders, deliver products or services, manage affiliate commissions, prevent abuse, and maintain records. Order and ticket data is visible to the relevant customer and authorised UltraFX staff. Affiliate management is limited to the configured Bot Developer and Founder roles.

Information is shared with Discord for sign-in, server membership, support channels and operational activity logs; with PayPal when you choose to pay; and with the service providers that host the website, database, and uploaded files. Website activity logs sent to the configured Discord log channel contain identifiers and action metadata, not support-message bodies or private staff notes. We do not sell personal information or use it for third-party advertising.

Retention, security, and your choices

Ticket, order, commission, review, and activity records are kept in the configured database for support, fulfilment, fraud prevention, and business-record purposes. Uploaded files remain in the deployment's storage until removed by the operator. The site does not currently publish a fixed deletion schedule. Backups and copies held by providers may take time to expire.

Access is restricted by Discord sign-in, current server membership, and role-based permissions. The site uses secure session cookies when served over HTTPS, same-origin checks for changes, request limits, and private file-download checks. No internet service can guarantee absolute security.

You may ask to access, correct, or delete information associated with your Discord account, subject to records that must be retained for legitimate support, safety, or legal reasons. Contact the UltraFX team through a private ticket. You can also clear browser-local basket, referral, and read-marker data in your browser. Applicable privacy rights depend on your location.

Changes and contact

We may update this policy when the service or its data use changes. The revision date above will be updated when that happens. For questions, sign in and open a private support ticket or contact the UltraFX team in Discord.

Sign in to contact support →