Privacy Policy

1. Who we are

mxsender is a listing-monitoring service: you submit marketplace search links and we notify you when a new listing appears. The operator identified above is responsible for your personal data. You can reach us about any privacy matter at privacy@mxsender.com.

By using the Service you acknowledge the practices described in this policy. If you do not agree with it, please do not use the Service.

2. Data we collect

We collect only what we need to run the Service:

• Telegram account data — your Telegram user ID, username, first name and language, provided by Telegram when you interact with the bot.
• Website / app account data — if you register on the web, your email address, a hashed password and an optional display name; in the mobile app, an anonymous device identifier.
• Monitoring data — the marketplace search URLs you submit and your monitor settings (name, schedule, filters), plus the listings we detect for them.
• Payment data — your chosen plan, amount, currency and transaction identifiers from our payment providers. We never receive or store your full card number, banking credentials or crypto-wallet private keys.
• Usage and activity data — actions you take in the bot or on the site, notifications we send you and whether you opened the links in them (see “Links in the alerts we send”), audit/event logs used for security and support, and — if you opened the bot from a link on our website — the pages you viewed in that website session beforehand (see “Linking your website visit to your account”).
• Technical data — your IP address and approximate country, browser/device information and similar metadata provided automatically when you connect.
• Support data — the message, optional email and context you provide when you contact support.
• Cookies and similar technologies — see the Cookies section below.

3. How we use your data and our legal bases

We use your personal data for the following purposes, each with a legal basis under the GDPR:

• Provide and operate the Service — create your account, run your monitors and manage your settings (performance of a contract).
• Deliver alerts and notifications — send you new-listing alerts and service messages (performance of a contract).
• Process payments and subscriptions — take payment, manage renewals and keep required records (performance of a contract; legal obligation).
• Support and communication — respond to your requests and send important service notices (legitimate interests; performance of a contract).
• Security and abuse prevention — detect, prevent and investigate fraud, abuse and technical issues (legitimate interests; legal obligation).
• Analytics and improvement — understand how the Service is used and improve it (consent, where required, otherwise legitimate interests).
• Legal compliance — comply with laws and respond to lawful requests (legal obligation).

4. Cookies and analytics

Our website uses a strictly necessary session cookie and a cookie that remembers your language preference; these are required for the site to work and do not need consent.

We also run our own first-party, self-hosted analytics to understand how the site is used and to improve it. It is not a third-party service and shares nothing with anyone else. It sets two essential cookies: "mxs_sid", a short-lived session identifier, and "mxs_vid", a visitor identifier stored in your browser for up to 13 months.

This tool records which pages you view, where on the page you click (the position only — never the content of form fields, inputs or keystrokes), how far you scroll, how long you stay on a page, the site you came from, and an approximate country derived from your network by our CDN. It does not store your IP address: your IP is folded into a one-way hash used only to tell visits apart. Because your network address is part of that hash, the identifier changes whenever your connection changes, so it does not reliably recognise you across separate visits — it measures a visit, not a person over time. It collects no personal data — no names, emails, passwords or form values. We keep this data for about 90 days and then delete it. We honor the Global Privacy Control (GPC) and Do Not Track (DNT) signals: if your browser sends either, we do not give you a persistent visitor identifier and measure your activity for the current session only.

We use Google reCAPTCHA on forms to protect the Service from spam and abuse. With your consent, we use Google Analytics 4 (with Consent Mode v2) to measure usage. Where the law requires prior consent — in the EU/EEA, the United Kingdom, Türkiye, Brazil, South Korea and Canada — analytics and marketing cookies are set only after you accept; in other countries we rely on your continued use of the site, and you can opt out at any time through the "Cookie settings" link in the footer. You can withdraw or change your choice at any time through that link or your browser settings.

5. Linking your website visit to your account

Our website shows a tracked link to our Telegram bot. When you open the bot through that link, the link carries a one-time reference to your visit, which lets us connect the account you create in the bot with the browsing session that clicked it.

When that connection is made, the pages you viewed on this website in that same session, before you opened the bot, are attached to your account: the page you arrived on, the pages you viewed next, the time of each and the website that referred you. They are stored with your account and are visible to us in the same activity list as the things you later do in the bot. We copy at most the first 50 pages of that session, and never a page viewed after your account was created. The analytics records themselves are deleted after about 90 days, but this copy stays with your account for as long as your account exists.

We do this to understand how people find the Service, to support you and to improve it (legitimate interests). It covers only the one browsing session that led you to the bot: the connection runs through the short-lived "mxs_sid" session cookie described above, so your earlier or later visits are not linked to you, and the visit of someone who never opens the bot is never attached to a person.

If your browser sends a Global Privacy Control or Do Not Track signal, you still get no persistent visitor identifier — only the single-session link described here is possible, and nothing about you is kept beyond it. If you would rather no website session were attached to your account, open the bot directly in Telegram instead of through a link on this site. You can also object to this processing, or ask us to delete the stored path, at privacy@mxsender.com (see Your rights).

6. Links in the alerts we send

The links to listings in the alerts we send you do not point at the marketplace directly: they go through our own short-link domain, mxnd.li, which redirects you to the listing. The domain is ours and the redirect runs on the content-delivery provider we already use (see How we share your data); no advertising or analytics company is involved, and no one else receives this data. When you open such a link, we record that this alert was opened: which notification it was (and therefore which of your monitors, which listing and which channel), the time, an approximate country supplied by our CDN, a coarse device type read from your browser identification (iOS, Android or desktop) and the address of the site you came from. We do not record your IP address and we do not see what you do on the marketplace afterwards. We use this to tell whether our alerts are useful — which searches get opened and which are ignored — and to help you when you contact support (legitimate interests). A simple count per alert (whether it was opened and when it was first opened) stays with your account; the individual open records are deleted after about 12 months. Every alert names the marketplace the listing came from, so if you prefer this not to be measured, you can open that site yourself instead of following our link. You can also object to this processing, or ask us to delete these records, at privacy@mxsender.com (see Your rights).

7. How we share your data

We do not sell your personal data and do not share it for cross-context behavioral advertising. We share it only with service providers who process it on our behalf under contract, and only as needed to run the Service or comply with law:

• Telegram — to deliver bot messages and notifications.
• Payment providers — NOWPayments (crypto/USDT) and Telegram Stars, to process your payments.
• Cloudflare — for content delivery, security and approximate geolocation.
• Google — for analytics and reCAPTCHA, subject to your consent where required.
• Hosting and infrastructure providers — to host and operate our servers and email.
• Authorities and advisers — where required by law, or to protect our rights, users and the Service.

8. International data transfers

Your data may be processed in countries outside your own, including outside the European Economic Area. Where we transfer personal data internationally, we rely on an adequacy decision or appropriate safeguards such as the European Commission's Standard Contractual Clauses, so your data keeps an equivalent level of protection.

9. How long we keep your data

We keep your personal data for as long as your account is active and as long as needed for the purposes in this policy. Payment and tax records are kept for the periods required by law. When data is no longer needed we delete or anonymize it. You can ask us to delete your account and associated data at any time (see Your rights).

10. Your rights

Subject to applicable law, you have the following rights over your personal data:

• Access — obtain a copy of the data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure — ask us to delete your data ("right to be forgotten").
• Restriction — ask us to limit how we use your data.
• Portability — receive your data in a portable, machine-readable format.
• Objection — object to processing based on our legitimate interests.
• Withdraw consent — withdraw consent at any time, without affecting prior processing.
• Complain — lodge a complaint with your local data-protection or consumer-privacy authority.

11. Regional privacy rights

Depending on where you live, additional rules may apply. We extend the core rights above to all users where reasonably possible, even when a local law does not require every right.

• EEA, UK, Switzerland and Ukraine — you may contact us to exercise GDPR/UK GDPR, Swiss FADP or Ukrainian privacy rights and may complain to your local supervisory authority (for example the ICO in the UK or the Ombudsman in Ukraine).
• California and other US privacy-law states — you may request to know, access, correct, delete or receive a copy of personal information, and you have the right not to be discriminated against for exercising privacy rights. We do not sell personal information or share it for cross-context behavioral advertising, and we do not use sensitive personal information for purposes that require a separate limit-use choice.
• Brazil, Canada and Turkey — where the LGPD, PIPEDA, KVKK or similar laws apply, you may request confirmation of processing, access, correction, deletion/anonymization where available, portability where applicable, and withdrawal of consent.
• How to exercise rights — email privacy@mxsender.com. We may need to verify your identity before fulfilling a request and may keep information when required for payments, security, legal obligations or legal claims.

12. Data security

We protect your data with technical and organizational measures, including encryption in transit (HTTPS), hashed passwords, access controls and least-privilege practices. No method of transmission or storage is completely secure, but we work to protect your data and to notify you and the authorities of a breach where the law requires.

13. Children

The Service is not directed to children under 16 (or the age of digital consent where you live). We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us at privacy@mxsender.com and we will delete it.

14. Automated decision-making

We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing. Our automated systems monitor marketplace pages, not you, and we do not score, rank or evaluate you automatically.

15. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we change the "Last updated" date above, and we will notify you of material changes through the Service. Please review this page periodically.

16. Contact us

For any privacy question or to exercise your rights, contact us at privacy@mxsender.com. We respond to requests within the timeframes required by law.