Privacy Policy
Short version: we collect the minimum needed to run the Service — your username, a hashed password, your IP address on each request, and metadata about the payloads you build. We do not sell your data. We do not run ads or trackers. We hand over records only when legally compelled, and only what's asked for.
1. Who we are
OGIDIGA is operated by Ogidiga Labs LLC, registered in Saint Kitts and Nevis ("we," "us," "our"). We are the data controller for personal information processed through the Service. Contact: privacy@ogidiga.com.
2. What we collect
We collect the following categories of data:
| Category | Examples | Why |
|---|---|---|
| Account data | Username, Argon2-hashed password, optional wallet address, optional email | To operate your account, authenticate you, and contact you about the Service |
| Build data | Shellcode you upload, configuration options selected, generated payloads | To perform the packing operation you requested |
| Metadata | Per-build seed value, payload SHA-256 hash, timestamps, IP address, User-Agent | Rate limiting, abuse detection, forensic logging, service integrity |
| Payment data | Invoice ID, payment currency, transaction hash, amount, blockchain confirmations | Billing, subscription activation, fraud prevention |
| Session data | Session token hash, expiry, linked account ID | Keep you logged in, secure session revocation |
We do not collect: real names, physical addresses, phone numbers, government IDs, biometric data, precise geolocation, or any data about your activity outside the Service. We do not use cookies for tracking, advertising, or analytics. The only cookie we set is your session cookie (HttpOnly, SameSite=Lax).
3. How we use it
Your data is used only for:
- Providing the Service (account access, build execution, artifact delivery)
- Preventing abuse (rate limiting, detecting anomalous patterns, cooperating with legitimate investigations)
- Billing and subscription management
- Security (detecting unauthorized access to your account or ours)
- Legal compliance (responding to lawful requests, tax obligations where applicable)
We do not use your data to train machine-learning models. We do not sell, rent, or trade it to any third party for marketing purposes.
4. Who we share it with
The Service depends on a small set of third-party processors:
- NOWPayments — payment processing. When you create an invoice, we send them the amount, currency, and an internal order ID. They process the transaction and return the status. See nowpayments.io/privacy-policy.
- Our hosting provider — the VPS on which the Service runs. They have physical access to the server hardware but no access to application data beyond what any host has.
- Law enforcement / courts — when we receive a valid legal process compelling disclosure. We disclose only what the process requires, and we notify you unless legally prohibited.
- A target organization — if a target provides credible evidence it was affected by a payload you generated, we may disclose your account identity and the specific build log associated with that payload. See Terms of Service § 12.
5. Where we store it
All Service data is stored on our VPS hosting infrastructure. Data is encrypted in transit (TLS 1.2+). The database itself is not encrypted at rest, but access requires credentials we control. Payload artifacts are stored on the same filesystem and auto-deleted 24 hours after build (or 1 hour after first download, whichever is first).
6. How long we keep it
| Data | Retention |
|---|---|
| Account data (username, password hash) | Until account deletion |
| Session tokens | Expire after 7 days; expired sessions purged periodically |
| Build artifacts (payload files) | Auto-deleted 24 h after build or 1 h after first download |
| Build logs (metadata, config, IP, seed, hash) | Retained indefinitely — required for abuse forensics |
| Payment records (invoice, tx hash) | Retained indefinitely — required for accounting and dispute defense |
7. Your rights
Depending on your jurisdiction, you may have the right to:
- Access the personal data we hold about you
- Correct inaccurate data
- Delete your account and associated data (subject to the retention obligations above)
- Export your data in a machine-readable format
- Object to or restrict certain processing
- Lodge a complaint with your local data protection authority
To exercise any of these rights, email privacy@ogidiga.com from the email associated with your account, or if no email is on file, include your username in the message. We respond within 30 days.
8. Children
The Service is not intended for anyone under 18. We do not knowingly collect data from minors. If we learn that we have, we delete it.
9. International transfers
Data may be processed outside your country of residence. By using the Service you consent to this transfer. Where required, we rely on standard contractual clauses or equivalent legal mechanisms for transfers from the EEA, UK, or Switzerland.
10. Security
Passwords are hashed with Argon2id. Session tokens are stored as SHA-256 hashes, never plaintext. All connections use TLS. Access to production systems is restricted to a single operator using key-based authentication. We do not claim to be immune to attack; we do claim to take it seriously.
11. Changes
We may update this policy. Material changes will bump the "Effective" date at the top. Continued use of the Service after a change constitutes acceptance of the updated policy.
12. Contact
Privacy questions and requests: privacy@ogidiga.com
Last updated: 2026-09-14