Privacy & Security

Privacy Policy

Authoritative standards on data collection, hardware authorization telemetries, total handset data privacy, cryptographic safeguards, and statutory privacy rights.

Effective Date: October 28, 2026 Version: 2.4 Jurisdiction: Laws of Uganda (Electronic Transactions Act, 2011)
Principled Data Protection & Absolute Handset Privacy
This Privacy Policy sets out how The Power Flasher (https://thepowerflasher.com) collects, processes, and safeguards information. We adhere strictly to the Data Protection and Privacy Act, 2019 of Uganda and international privacy standards. We make an absolute commitment: our software never reads, accesses, or transmits personal content from customer mobile phones.

01. Commitment to Privacy & Regulatory Framework

At The Power Flasher, we recognize the importance of data confidentiality for mobile technicians, workshop proprietors, and digital customers worldwide.

This policy governs data handling practices across our web portal, client dashboard, desktop software tools, and server APIs. We operate in full compliance with the statutory principles of data minimization, lawful processing, purpose specification, and security safeguards established under the Data Protection and Privacy Act, 2019 (Republic of Uganda) and internationally recognized data protection frameworks.

02. Scope & Categories of Data We Collect

We collect only the minimum data strictly necessary to authenticate your account, process recharges, and execute server-side repair authorizations:

Data Classification Specific Data Elements Collected Operational Purpose
1. User Account Identity Account username, verified email address, hashed passwords (one-way salted hashes using bcrypt/Argon2id; never plain text), and optional Telegram user handle. User authentication, password recovery, and service notification dispatch.
2. Financial & Billing Records Invoice reference, payment gateway identifiers (e.g. NOWPayments payment ID, Binance Pay Order ID), incoming cryptocurrency deposit address, net amount, and immutable wallet credit transaction history (`credit_log`). Financial reconciliation, anti-fraud auditing, and statutory tax accounting.
3. Client Workstation Telemetry Workstation IP address, operating system build, client tool version, and cryptographic hardware hashes (Disk Serial, Motherboard UUID, BIOS Serial, MAC address). Software licensing enforcement, multi-user piracy prevention, and session integrity.
4. Device Service Metadata Mobile manufacturer, hardware model code, Android/PDA firmware build, and device serial number or IMEI submitted during operation. Verifying firmware compatibility and requesting OEM authorization tokens from server gateways.

03. The Absolute Handset Personal Data Exclusion

Absolute Guarantee: Zero Access to Handset Personal Content

The Power Flasher does NOT access, read, extract, transmit, mirror, store, inspect, or sell any private personal data residing on any mobile phone connected to our software suite.

Our software interacts solely with low-level bootloaders, partition maps (e.g. PIT, GPT), diagnostic modem interfaces, and OEM authentication cryptographic handshake registers. We never access photos, video galleries, WhatsApp/SMS message databases, contact address books, browsing history, call logs, stored emails, personal documents, or app data stored on the handset.

04. Workstation Hardware Fingerprinting & Licensing Data

To prevent commercial license piracy, unauthorized tool cracking, and automated multi-account scraping, our desktop application generates a one-way cryptographic hash of host computer hardware components:

  • Hardware parameters (Physical Hard Drive Serial Number, Motherboard Manufacturer UUID, BIOS Revision, and Network Adapter MAC) are hashed locally on the user's PC using SHA-256.
  • Only the resulting non-reversible cryptographic hash fingerprint is transmitted to our licensing server during login.
  • This fingerprint is used exclusively to validate active license seats and detect illicit credential sharing.

05. Lawful Bases & Specific Purposes for Processing

We process your information exclusively under the following lawful grounds established by data protection law:

  1. Contractual Necessity: Processing required to maintain your credit wallet, authorize desktop software sessions, and deliver requested server repair operations.
  2. Legal & Regulatory Compliance: Retaining financial transaction ledgers, tax compliance records, and responding to lawful judicial warrants.
  3. Legitimate Interests: Protecting our server infrastructure against reverse engineering, fraud, cyberattacks, and unauthorized API abuse.

06. Cookies, Local Storage & Session State

Our web platform utilizes strictly necessary technical cookies and browser local storage:

  • Authentication Tokens (`PHPSESSID` / Bearer Tokens): Maintain your secure authenticated state across dashboard pages.
  • UI Preferences: Save dark-theme toggle preferences and legal consent acknowledgments.
  • No Advertising Trackers: We do not employ third-party behavioral advertising cookies, Google AdSense tracking pixels, Meta tracking scripts, or cross-site data broker trackers.

07. Third-Party Infrastructure & Gateway Providers

We do not sell, rent, or trade your personal data. We disclose information only to vetted third-party service providers acting on our behalf under strict data processing agreements:

  • NOWPayments: Processes cryptocurrency checkouts, address generation, and IPN webhook notifications.
  • Cloud Infrastructure Providers: Host our secure databases and API clusters with high-availability firewalls.
  • Telegram Bot API: Transmits account alerts and customer-requested notifications directly to your authorized Telegram ID.

08. Data Retention, Archival & Automated Purging

We retain personal information only for as long as necessary to fulfill the purposes outlined herein:

Data Record Type Retention Period Post-Retention Action
Financial Ledgers & Invoices 7 Years (Statutory tax compliance requirement) Encrypted archival storage
GSM Server Operation Logs 90 Days Automated database purge / Anonymization
Hardware Licensing Fingerprints Duration of active account lifecycle Permanently deleted upon verified account erasure
Web Server Access & Error Logs 30 Days Automated rotational log purge

09. Cryptographic Security Standards & Encryption

The Power Flasher implements enterprise security standards to protect your data against unauthorized access, loss, or alteration:

  • Data in Transit: All HTTP and API traffic is strictly protected with Transport Layer Security (TLS 1.3) with modern cipher suites and HTTP Strict Transport Security (HSTS).
  • Data at Rest: Database backups and sensitive credentials are encrypted using AES-256-GCM. Passwords are saved exclusively as salted one-way hashes.
  • Access Control: Administrative access is restricted via hardware key multi-factor authentication (MFA) and least-privilege role separation.

10. Your Statutory Privacy Rights & Account Erasure

Under the Uganda Data Protection and Privacy Act, 2019 and international data protection standards, you have the right to:

  1. Right of Access: Request a copy of the personal information we hold concerning your account.
  2. Right to Rectification: Request correction of inaccurate, incomplete, or out-of-date personal data.
  3. Right to Erasure ("Right to Be Forgotten"): Request permanent deletion of your account and associated telemetries, provided no active legal hold or statutory tax retention obligation requires retention of past financial logs.
  4. Right to Data Portability: Request your credit ledger and service history in a structured, machine-readable format (JSON/CSV).

11. Data Protection Officer Contact & Regulatory Redress

To exercise any of your privacy rights, request account erasure, or submit an inquiry to our Data Protection Officer (DPO), please contact our compliance desk:

Data Protection Officer: [email protected]
Compliance Channel: https://t.me/powerflasherbot

If you believe your personal data has been handled contrary to statutory requirements, you also possess the legal right to submit a formal complaint to the Personal Data Protection Office (PDPO) under the National Information Technology Authority, Uganda (NITA-U).