Privacy policy in full
[Company legal name] ("bypass.so", "we", "us") operates the bypass.so website, dashboard and API (the "Service"). This policy explains how we handle personal data when you visit the website, create an account or use the API.
For account, billing and website data we act as the data controller. For personal data that may be contained in task content you send us, we act on your behalf as a processor, and you remain responsible for having a lawful basis to send it.
| Category | Examples | Source |
|---|---|---|
| Account data | Email address, optional name, a one-way hash of your password, sign-in times | You, when you register or sign in |
| API key data | Your API key and a masked version shown in the dashboard | Created by us |
| Billing data | Top-up amounts, bonus credit, balance changes, invoices | You and our payment providers |
| Task content | Captcha images, audio or text, page addresses and site keys you submit | You, through the API |
| Task records | Task id, task type, timestamps, outcome, price charged | Generated by the Service |
| Technical logs | IP address, request time, endpoint, response code, user agent | Your requests to the Service |
| Support data | Messages you send us and our replies | You |
We do not ask for, and you should not send, sensitive personal data. Do not include personal data in task content unless it is part of the captcha itself.
- To provide the Service: authenticate requests, answer tasks and return results.
- To run billing: hold, charge and credit task prices, apply top-ups and bonus credit, and keep financial records.
- To keep the Service secure: detect and prevent abuse, fraud and attacks, and enforce the Acceptable use policy.
- To support you: answer questions and investigate reported problems.
- To maintain quality: measure speed, success rates and capacity using aggregated figures that do not identify you.
- To communicate: send service, security and billing notices. We send marketing email only if you opt in, and you can opt out at any time.
- Task content is processed transiently. It is held only for as long as needed to produce and deliver the result, and is then deleted.
- Results remain available to fetch with your API key for a short time, up to [1 hour], and are then deleted.
- We do not use task content to build datasets, profile individuals or for any purpose unrelated to answering your task.
- We keep task records, such as task id, type, timing, outcome and price, which do not include the task content itself, for billing, support and abuse prevention.
Where data protection laws such as the GDPR apply, we rely on:
- Contract: to provide the Service you signed up for and to bill for it.
- Legitimate interests: to secure the Service, prevent abuse and improve reliability, balanced against your rights.
- Legal obligation: to keep financial records and respond to lawful requests.
- Consent: for optional marketing email. You can withdraw consent at any time.
| Data | Retention |
|---|---|
| Task content | Deleted once the result is delivered or expires, at most [1 hour] |
| Task records | [90 days], then kept only as aggregated totals |
| Technical logs | [30 days], longer only when needed to investigate a specific security incident |
| Account data | While your account is open, then [30 days] after closure |
| Billing records | As long as tax and accounting law requires, typically [7 years] |
| Support messages | [24 months] after the conversation ends |
We do not sell personal data and do not share it for advertising. We share data only:
- With service providers that host, secure or process payments for the Service, under contracts that limit their use of the data to providing those services.
- When the law requires it, or to protect the rights, property or safety of our customers, the public or us, including to respond to abuse reports.
- As part of a merger, acquisition or sale of assets, in which case this policy continues to apply to your data.
Our providers may process data in countries other than yours. Where required, we use appropriate safeguards such as standard contractual clauses for those transfers.
We protect data with measures including encrypted connections (HTTPS), one-way hashing of passwords, access controls with least privilege, and session cookies that are HttpOnly and Secure. No system is perfectly secure, so please also protect your password and API key.
Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict certain processing, and to withdraw consent.
To exercise these rights, contact us through the contact page from the email address on your account. We will respond within the time the law requires. You can also complain to your local data protection authority.
- Session cookie: when you sign in to the dashboard we set one strictly necessary cookie that keeps you signed in for up to 30 days. It cannot be read by page scripts.
- Local storage: the website may remember small preferences on your device, such as your preferred code example language. It is not sent to us.
- We do not use advertising cookies or third-party tracking scripts.
The Service is not directed to children and we do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, contact us and we will delete it.
We may update this policy from time to time. The "Last updated" date shows when it last changed. We will notify you by email or in the dashboard before material changes take effect.
For privacy questions or requests, use the contact page. Data controller: [Company legal name], [registered address]. [Data protection officer or EU/UK representative, if required].