Privacy Policy

ISPLABS LIMITED is the primary service provider and controller responsible for personal data processed in connection with our services.

Registered office: 128 City Road, London, United Kingdom, EC1V 2NX. Contact: ilja@phylex.net.

We may share personal data with payment providers, hosting and infrastructure providers, security and anti-fraud providers, analytics providers, customer support tools, professional advisers, and public authorities where required by law.

For supported regional payments, payment details may be processed by LAVA.RU, Phylex Pay and their partner banks or payment providers for payment acceptance, settlement, accounting and related compliance purposes. ISPLABS LIMITED remains the service provider and controller for the Phylex account relationship.

We may disclose personal data to service providers acting on our behalf, affiliated payment collection partners where applicable, professional advisers, payment processors, banks, fraud-prevention providers, and competent authorities where necessary to provide services, process payments, enforce our terms, protect our rights, investigate abuse, or comply with applicable law.

Account and service data is generally retained while the account or service relationship remains active and for a limited period afterwards where needed for account closure, support, security, fraud prevention, disputes, or legal claims. Service data scheduled for deletion may remain temporarily in restricted backups until the relevant backup cycle expires.

Invoices, transaction records, payment references, and accounting or tax records may normally be retained for up to six years after the relevant financial period or transaction, and longer where required by law, an audit, a payment dispute, sanctions or fraud controls, or legal proceedings. Support and security records are retained according to their sensitivity, operational relevance, and the applicable limitation or compliance period, with access restricted to authorized personnel.

We do not process or store customers' full payment card details or online banking credentials on our servers. Card and regional payments are processed by Stripe, LAVA.RU, Phylex Pay, partner banks or other payment providers as applicable; cryptocurrency payments are processed by Cryptomus, and bank transfers by the relevant banks or payment providers, including Tide (ClearBank Limited) and Wise.

Payment credentials are submitted directly to the applicable payment provider or financial institution over its payment interface or banking network. We do not have access to full card details, cryptocurrency wallet private keys, or customers' online banking credentials.

We and the applicable payment providers or banking partners may receive and retain limited payment-related information such as payer name, account or wallet identifiers, partial card or bank metadata, billing country, payment status, anti-fraud signals, transaction references, and transfer remittance details as needed for reconciliation, accounting, support, fraud prevention, compliance, refunds, and dispute handling. Retention is limited according to the relevant purpose and applicable legal obligations.

Where reasonably required for fraud prevention, sanctions, payment-source, contractual or legal compliance, Phylex may request a KYC or KYB review and place the account in read-only mode while existing paid services remain running.

Stripe Identity processes identity documents and mandatory matching live-selfie checks. Phylex processes the submitted profile, bank statement, company registration, director-authority, ownership and significant-control evidence in private object storage for manual compliance review. There is no non-biometric alternative to the identity check.

Compliance evidence is retained indefinitely by default with access restricted to authorized staff. An administrator may enable a documented automatic deletion period for resolved reviews; the audit status, checksum and event history may be retained after source-file deletion where justified by security or legal obligations.

Because our providers, infrastructure, support tools, and payment partners may operate in multiple countries, your personal data may be processed outside your country and, where applicable, outside the UK or EEA. Where required, we take reasonable steps to use appropriate safeguards for such transfers under applicable data protection law.

When you contact us, for example via a contact form or email, personal data is processed solely for the purpose of processing and responding to your enquiry and only to the extent necessary for this purpose.

We use cookies and similar browser storage where necessary to provide requested website functions, maintain security and sessions, and remember choices such as language, currency, country, and VAT display. These technologies are not used by us to sell personal data.

The current public website does not intentionally place advertising or behavioural-tracking cookies. If non-essential analytics, advertising, or comparable technologies are introduced, they will be disabled until valid consent is obtained where required, and an appropriate preference control will be provided.

You can remove cookies, local storage, and session storage through your browser controls. Removing functional preferences may reset language, currency, country, VAT, interface, or cached-display settings, but should not prevent access to the public legal pages.

locale cookie - remembers the selected interface language for up to one year.

locale local storage - remembers the selected interface language until it is changed or browser storage is cleared.

selectedCountry, selectedCurrency, and includeVat local storage - remember regional price-display and VAT preferences until changed or browser storage is cleared.

Session storage entries used for review and rating display cache are retained for the current browser session and reduce repeated requests to our server-side review integration.

Interface-state cookies or local storage may be used where a requested account or navigation feature needs to remember its state. Session and authentication technologies used in the customer area are retained for the session or the security period configured for that feature.