VinzaPanel
This page explains what data we collect when you use the VinzaPanel website and the VinzaPanel software you install yourself, what we use it for, and who we share it with. It is written from what our systems actually do, not from a generic clause library.
1. Our principle
VinzaPanel is self-hosted software. The panel runs on your own server, and your operational data — site files, databases, mail, configuration, server logs — stays on your server. We have no access to it and never copy it to our systems.
What we do collect is only what is needed for three things: running your account on this website, processing payments, and validating your panel licence.
2. Data we collect
2.1 Account data
Registration asks for only a username, email address, and password. Passwords are never stored in readable form — we store a one-way hash, so we cannot read them either.
2.2 Profile and billing data
You may optionally complete your profile. The available fields are: full name, company, phone number, address, city, country, bio, and avatar URL. These stay empty until you fill them in yourself.
When you make a purchase, your name, email, and billing address are copied onto the invoice, so the invoice remains historically accurate even if you later change your profile.
2.3 IP addresses
We record IP addresses at four points, all for security reasons:
- The account activity log (an audit trail of significant actions).
- Failed-login throttling (brute-force protection).
- Rate limiting on licence-verification requests.
- Rate limiting on API registration.
We do not record your browser user agent and do not build a device fingerprint.
2.4 Support and attachments
If you open a support ticket, we store its subject, body, replies, and any files you attach. Attachments are stored outside the public directory under randomised names and can only be downloaded through a route that checks your access rights.
2.5 Malware scanning (vConnect)
If your panel participates in the malware-signature feed, it submits a SHA-256 hash of the suspicious file plus brief metadata. The file itself is never transmitted to or stored by us.
3. What your panel sends us
An installed panel contacts our servers to verify its licence. That request contains exactly five fields and nothing more:
| Field | Purpose |
|---|---|
license_key | Your licence key |
server_ip | The IP address of the server running the panel |
hardware_uuid | A hardware identifier, binding the licence to one machine |
panel_url | The panel's address, used to deliver licence-status notifications |
panel_version | The installed panel version |
We store those five values along with first-seen and last-seen timestamps, plus a history of server migrations (old and new IP and hardware ID), because the number of migrations is capped by the licence.
What is not sent: your list of sites, the domains you manage, database contents, credentials, usage statistics, or your own customers' data.
4. Payments
Payments are processed by Midtrans. Card details are entered directly in Midtrans's own interface and never pass through or rest on our servers. We document the technical detail openly on the Payment Security page.
All we send Midtrans is: the order number, the amount, your first name, email, phone number, and the line items purchased.
5. Cookies and tracking
This site uses a session cookie to keep you signed in and a CSRF cookie to protect forms. Both are strictly functional — the service cannot work without them.
We maintain an optional Google Analytics slot that is only active if we fill it in. Beyond that there are no third-party trackers: no Meta pixel, no Hotjar, no session recording. Our captcha images are generated by our own server, not by a third-party service.
6. Sharing
We do not sell your data. It is shared only with:
- Midtrans — to process payments (see section 4).
- Our email provider — to send account verification, licence notifications, and ticket replies.
- Law enforcement — only where there is a valid legal obligation.
7. Retention and deletion
Account data is kept for as long as your account exists. Invoices and payment records are kept longer, because accounting and tax rules require it. You can request account deletion via the contact below; we will remove your profile and account data, except financial records we are required to retain.
8. Your rights
- View and update your profile data at any time from your account panel.
- Request a copy of the data we hold about you.
- Request correction of inaccurate data.
- Request account deletion, subject to section 7.
9. Security
Two-factor authentication is mandatory for admin accounts. Login attempts are throttled per IP and per account. API tokens are stored as SHA-256 hashes, never in plain text. Traffic to this site is encrypted with TLS at the web-server layer.
No system is perfect. If you find a vulnerability, report it to [email protected] — we respond to reasonable reports and will not pursue legal action against good-faith security research.
10. Changes
If this statement changes materially, we update the date above and notify registered users by email.
11. Contact
Privacy questions: [email protected].