01 Information we collect
1.1 Information you provide
- Account information: email, password (encrypted), username.
- Spotify authentication: your
sp_dcsession cookie (recommended), or Spotify email/username and password, depending on the sign-in method. These are sent over HTTPS to process your requested upgrade or renewal. Authentication data may be included in processing records. - Payment information: handled by secure payment providers. We do not store card details.
- Purchase information: purchase ID, transaction history, keys purchased.
- Reseller information: API keys, business details.
1.2 Automatically collected
- Log data: API requests.
- Security data: bot-detection verification, rate-limit data.
02 How we use your information
- Service delivery: process Spotify Premium upgrades and renewals.
- Account management: create and maintain your account, manage API keys.
- Payment processing: transactions via secure providers.
- Email communications: order confirmations, key delivery, password resets.
- Customer support: respond to inquiries, technical assistance.
- Security: prevent fraud, abuse, and unauthorized access.
- Improvements: analyze usage to improve the service.
- Legal compliance: meet legal obligations and enforce our Terms.
03 Data sharing and disclosure
We do not sell your personal information. We share data only in these cases:
3.1 Service providers
- Payment processors: PCI DSS compliant.
- Email service: transactional email delivery.
- CDN provider: DDoS protection, content delivery.
- Hosting provider: server infrastructure.
- Account-processing services: receive the selected Spotify authentication data to complete your requested upgrade or renewal.
3.2 Legal requirements
We may disclose information if required by law, court order, or to protect our rights and safety.
04 Cookies and tracking
We use cookies for:
- Authentication: keep you logged in (HTTP-only, secure cookies).
- Security: CSRF protection, session management.
- Performance: caching for faster page loads.
- Bot protection: automated security verification.
sp_dc is supplied by you in the Cookie sign-in option for Upgrade or Renew. It authenticates your Spotify session and is separate from this website’s session and tracking cookies. Keep it private; never post it in community channels or support messages.05 Data security
We implement industry-standard security measures:
- Encryption: TLS/SSL in transit, AES-256 at rest.
- Password security: bcrypt hashing with salt.
- API security: SHA-256 hashed keys, rate limiting.
- Database: encrypted storage with access controls.
- Monitoring: automated scanning, intrusion detection.
- Staff access: need-to-know basis only.
06 Data retention
- Account data: while your account is active.
- Transaction records: 7 years (legal/tax requirements).
- Support tickets: 2 years for quality assurance.
- Logs: 90 days for security and debugging.
- Deleted accounts: data anonymized or removed within 30 days.
- Spotify authentication records: processing records may include the submitted session cookie or email/username and password. Contact privacy@orphilia.com for retention or deletion questions.
07 Your rights (GDPR)
Under GDPR and CCPA, you have the right to:
- Access: request a copy of your personal data.
- Rectification: correct inaccurate or incomplete data.
- Erasure: request deletion (the "right to be forgotten").
- Portability: export your data in machine-readable format.
- Restriction: limit how we process your data.
- Objection: object to processing of your data.
- Withdraw consent: opt out of marketing communications.
08 Third-party services
We use third-party services to help deliver our service. They have their own privacy policies. We are not responsible for their practices.
All third-party providers we work with are vetted for security and compliance standards.
09 Children's privacy
Our service is not intended for children under 18. We do not knowingly collect data from children. If you believe a child has provided personal information, contact us at support@orphilia.com.
10 Changes to this policy
We may update this policy from time to time. Changes are posted on this page with an updated "Last updated" date. Continued use of the service after changes constitutes acceptance.
11 Contact us
For privacy questions or to exercise your rights:
- Email: privacy@orphilia.com
- Support: support@orphilia.com
- DPO: dpo@orphilia.com
- Response time: within 30 days (GDPR).
Website account controls
Additional information about the current website’s account features, updated October 19, 2026.
Keys and Spotify session codes
Your Spotify session code (sp_dc) is an access credential. Orphilia receives the key, session code, and selected country needed to carry out your activation or renewal request. Treat the code as private, just as you would any other account access detail.
Using a code for one request
A code you enter is used for that request without saving a reusable copy in your Orphilia account unless you select the save option. In the direct-key flow, when offered, the code is not saved for later use.
Choosing to save a code
In account mode, selecting the save option stores an encrypted copy before the activation or renewal is sent. It can therefore be saved even if the service request fails. Selecting a key with a usable saved code lets the server use that copy; the website displays a protected placeholder instead of returning the saved code to your browser.
You can remove it in My account by opening the key’s details and managing the saved session. Replacing a saved code updates the account copy. Leaving the save option unchecked when using a new code does not remove an older saved copy. Removing the copy here does not revoke your Spotify session; use Spotify’s own account controls if you need to end that access.
Revealing your key and administrative access
Stored activation keys and saved session codes are encrypted in the application database. Your keys are masked by default. You can request a full key you currently own from its Details panel using Reveal key. It is sent to your browser only after an authorized request, and the display clears after 60 seconds, when you close details, or when the tab is hidden. A key you copy can remain in your device’s clipboard. Administrators with access to the purchase dashboard can request a full activation key for purchase and support work. Server-side service requests decrypt the credentials needed to carry out your action. Encryption does not mean that the service can never access a value it needs to use.
Services involved in your request
We share the information needed to provide the relevant feature with the services that support it:
- Supabase provides account authentication and database services, including sessions, identity connections, and passkey records.
- Sell.app and your selected payment provider handle checkout, payment, order status, and key delivery. Payment details you enter on their checkout are handled by those services.
- Orphilia processes key information, country availability, activation, and renewal. Legacy purchase synchronization uses the relevant store’s order records.
- Resend delivers transactional email, such as verification, password recovery, transfer invitations, and support updates. Private action links may be included in those emails.
- Vercel hosts and delivers the website and may process request and infrastructure logs.
- A connected sign-in provider, when enabled and chosen by you, supplies the identity information needed to sign in or connect your account.
Connecting Spotify for sign-in is separate from providing a Spotify session code for activation. Passkey verification is managed through your device and authentication provider; Orphilia does not receive your fingerprint or face scan.
We may also disclose relevant records when required by applicable law or when necessary to investigate fraud, protect account access, or resolve a dispute. This website does not include advertising trackers.
Providers may process information in countries different from your own. Their locations, applicable safeguards, and handling depend on the provider and service involved. Contact us if you need information about a particular provider or international transfer. External websites and services also have their own privacy policies.
Transfers and support conversations
If you invite someone to receive a key, we use their email address to deliver and validate the invitation. The sender and recipient can see the identity and key references needed to understand the transfer. The sender should provide an address they are authorized to use for this purpose.
When a transfer is accepted, the key moves to the recipient’s account. The previous owner’s saved session code and nickname are removed. Purchase records stay associated with the original buyer, and transfer history remains available for ownership and dispute review.
Support conversations are available to their customer and support administrators. Staff can use internal notes that are not shown in the customer conversation. Account-access support may use an emailed private link, which should not be shared. A diagnostic check can attach selected purchase/key details and service results to help us investigate an issue.
Security and diagnostic information
We use server-side account and ownership checks, encrypted credential storage, private responses, and request limits to help protect access. Customer and administrative key-reveal events record identifiers rather than the full key. Application error handling aims to exclude passwords, full keys, session codes, and raw upstream response bodies from logs.
No online service can guarantee absolute security. Infrastructure providers can maintain their own access logs. Keep your devices and email secure, review Devices & sessions, and contact us if you notice an unfamiliar sign-in or suspect that a private code or link has been exposed.
Your choices and privacy requests
You can update your display name, manage supported sign-in methods, review sessions, and change preferences in Account settings. You can remove saved Spotify session codes from the relevant key in your dashboard.
To request access to your information, correction, a copy, account deletion, or a review of how we use it, contact support@orphilia.com. These requests are handled through support; there is no automatic account-deletion button. We may need to verify your identity and explain any records we cannot remove or requests we cannot fulfill. Do not send passwords or session codes as proof of identity.
Removing an optional saved session code is different from deleting an activation record held by an external service. Where our tools cannot change a provider-held record, we will explain that limit and review the steps available to address your request under applicable law. We do not promise that deleting a website account reverses a key activation or removes every transaction record.
Depending on where you live, you may also have rights to restrict or object to certain processing, withdraw consent, receive portable data, or complain to your local data-protection authority. The availability of a right and any exceptions depend on applicable law. Contact us if you need help making a request.