Privacy Notice

Version 2026-10-15 · Effective October 15, 2026

This notice describes the current OlamidePanel application. The operator of your particular server is responsible for its deployment, hosting vendors, retention practices and applicable privacy obligations. Contact the administrator who provided your account for privacy requests. Additional server-side practices should be disclosed by that operator.

1. Information processed

• Account username, optional display name and email, access role, active status, password salt/hash and session version.
• Your panel-managed files, folder paths, domain inventory, hosting-plan requests, quoted plan/price snapshots, request statuses and customer/operator notes. Payment records can include order references, buyer/seller IDs, amount, currency, test/live mode, provider session/reference, checkout URL and verification timestamps. Merchant API credentials are encrypted at rest using a server-held key. Card numbers and CVV are not collected by this application.
• Recorded management actions with actor, target and timestamp, and terms-acceptance version/time linked to your account.
• Session tokens, CSRF tokens, temporary login-attempt information and server metrics.
• Nginx, operating-system, database and certificate services may process connection IPs, request paths, errors and operational logs. Their exact configuration and retention depend on the operator.

2. Why it is processed

To authenticate accounts, enforce permissions, perform requested file/domain/user operations, prevent abuse, record administrative changes, maintain infrastructure and document agreement to service terms. Optional contact details do not currently enable automated email notifications or password recovery.

3. Cookies and browser storage

The panel_session cookie supports sign-in. It is HTTP-only, SameSite Strict and Secure in the normal HTTPS deployment; its lifetime is one hour. Sessions are also removed by service restart and may be revoked sooner. Browser local storage retains theme and favorites until cleared. The shipped application does not include advertising cookies or third-party analytics scripts. Your operator may add integrations that need separate disclosures.

4. Access and sharing

Authorized panel root/super-admin users can view account metadata and audit records and manage lower-level accounts. File access in the panel is scoped to the account; server operators with operating-system/database access may access stored data and backups. Hosting, database, certificate and other configured service providers may process necessary information. Information may also be disclosed where required by applicable law. When a payment is initiated, Stripe or Paystack receives necessary transaction details and Paystack receives the account contact email; payment details are entered directly on the provider-hosted page. Payment records do not automatically cascade with account deletion and require an operator retention process. The shipped application contains no advertising-data sale or marketing integration; this statement does not describe unreviewed operator modifications.

5. Retention and deletion

Account data is retained until changed or removed by an authorized operator. Panel deletion removes account/domain records and associated acceptance records; files, audit history, system logs and backups can remain. There is no automatic retention/deletion schedule in this release. Ask your operator for its actual retention periods and deletion process. Clearing browser storage removes local theme/favorite preferences; it does not delete server data.

6. Security

The implementation uses password hashing, HTTPS in the standard deployment, session/CSRF checks, role restrictions and protected database configuration. Initial bootstrap credentials remain in a root-only server file until managed by the operator. These measures do not guarantee security. Do not store highly sensitive regulated information without a separately assessed deployment and any required agreements.

7. Your choices and requests

You can edit contact details and change your password in Preferences, sign out and clear browser storage. Ask your account administrator about access, correction, export, restriction or deletion requests. Applicable rights depend on your circumstances and jurisdiction; the GUI does not provide a complete self-service privacy request workflow. The service is not designed for accounts created by children.

8. Transfers and updates

Storage location, cross-border processing, provider identities and any applicable legal bases depend on the operator and must be confirmed with it. A new version of this notice should explain material changes. Acknowledging this notice at sign-in is not optional marketing consent or a waiver of privacy rights.