1. Who processes the data
The data is processed by the Provider, the operator of the Exstru service (the website exstru.com, the Telegram bot @exstru_bot, the web dashboard and the API). For questions about your data, write to the “Feedback” section of the Service.
2. What data we receive
Sign-in via Telegram. Your Telegram ID, first and last name, username, profile photo link and interface language — Telegram passes these to us when you sign in. We do not receive passwords or your phone number. For the session, the browser name (User-Agent) is stored.
Orders. The website brief: the niche, country, languages, domain and the company details you provided — name, address, phone, email, description, founder’s name and other brief fields. The full brief is kept while the order is in progress; after the build, the order record keeps the company name, niche, language, domain and build outcome.
Money. Amounts of top-ups, purchases and charges, payment statuses and their numbers at the payment provider. We do not ask for the address of the wallet you pay from.
Team. Who is on the team, staff members’ limits and spending, invitations.
Referral Program. Who invited you, accruals, applications for Partner status and for payouts, and the USDT wallet address for payouts.
Requests. The texts of your requests sent through “Feedback” and any files you attached to them.
Contacting you. Contacts and the manager’s notes on working with your account, and your opt-out from messages if you chose it.
Where you came from. Advertising campaign tags (utm), the first page you visited on the website and the website you came from — only its domain, not the full address.
Your IP address is used only at the moment of the request — to limit the request rate — and is not stored.
3. Why
- to build the website you ordered and deliver the archive;
- to keep track of your balance, credits, purchases and API subscription;
- to support teamwork: limits, history, invitations;
- to accrue and pay out referral commission and check it for abuse;
- to answer requests and notify you about money matters: bonus credits expiring, API renewal, auto-buy, support replies;
- to understand which channels bring in clients;
- to protect the service: request rate limiting, blocking those who breach the Terms of Service.
The bot does not send marketing messages, and we do not sell data.
4. Who the data is shared with
Only with those the service cannot work without:
- OpenRouter — a gateway to the artificial intelligence models that write texts and create images. The models receive the order brief, including the company details for the “Contact”, “About” and legal pages. Image descriptions contain the niche, country and topic, but not contact details.
- Pexels and Pixabay — receive only search keywords for selecting photos on Basic websites.
- Heleket — the payment provider: the amount, currency and invoice number. Your name and Telegram data are not passed to it.
- Telegram — sign-in, bot messages and, at your request, the website archive sent as a file to the chat.
- Hosting — the server on which the Service runs and the data is stored.
In addition, to government authorities in cases expressly provided for by law.
5. What other people see
- The owner of a team workspace sees each staff member’s name and username, the date they joined, their last activity, limits and spending. Staff members see the owner’s name, the credit balance, their own statistics and all of the team’s websites with the name of whoever ordered each one.
- A Partner sees Referred Users only under a masked name (for example, @tr***ff), their registration date, their purchases and the Partner’s own commission on them.
- The Provider’s staff see account data to the extent needed for support, payout checks and accounting.
6. How long data is kept
- the website archive — 14 days after the build, then it is deleted;
- the full order brief — until the build is finished;
- the sign-in session — 7 days in Telegram and 14 days in a browser;
- notifications in the dashboard — 90 days after they are read;
- visit tags and rejected API requests — 90 days;
- account activity events, other than money-related ones — 24 months;
- the account, balance, payments, orders, requests and referral data — for as long as the account exists; money records — for as long as accounting requires.
Database backups are made regularly: on the server they are kept for up to 14 days, and copies off the server are kept only in encrypted form.
8. Visitors to your websites
Websites built by the Service do not send their visitors’ data to the Provider: they contain none of our code or counters and make no requests to our servers. Forms on a website send submissions to your server and your email — if you chose the archive with a form handler — or nowhere. You, as the website owner, are responsible for processing your visitors’ data.
9. Your rights
Through “Feedback” you can ask what data about you is stored, correct it, delete your account or opt out of messages from the manager. We will reply within 3 business days. When an account is deleted, only the payment records needed for accounting and the data without which a dispute cannot be resolved are retained. Unused credits and the balance of a deleted account are not refunded (Terms of Service, clause 4.6).
You can sign out of the dashboard and revoke an API key yourself at any time.
10. Security
The connection to the Service is encrypted (HTTPS). Sessions and API keys are stored only as a hash: they cannot be recovered from the database. The Provider’s staff have access to data according to their roles and to the extent their work requires.
11. Changes
We update this policy when the way the Service processes data changes. The new version is published on this page with its date.