This Privacy Policy explains how Metalagro Ltd, a private limited company registered in Bangladesh (Business Identification Number 000457843-0101), with its registered office at PBL Tower, Dhaka 1212, Bangladesh, operating the HotPlot service (hereinafter "HotPlot", "we", "us", or "our") — the controller of your personal information — collects, uses, stores, shares, and protects your personal information when you use the hotplot.ai website, our progressive web app, and related services (collectively, the "Service"), as well as the rights you have.
By using the Service, you confirm that you have read and understood this Policy. This Policy, together with the Terms of Service, forms an agreement between you and us.
What Information We Collect
Information You Provide Directly
| Scenario | Information |
|---|---|
| Registration & Login | Email address, password (stored only as an irreversible hash), display name, avatar, language preference |
| Third-Party Login | When you choose to log in via Google, Facebook, Apple, TikTok, or Telegram, the platform returns a unique identifier, display name, avatar, and (if available) email address |
| Age Verification | The time and region where you confirm you are at least 18 years old |
| Purchases | Order content, amount, payment method type, transaction ID returned by the payment provider. We do not store full card numbers or CVV |
| USDT Payments | The wallet address you used for payment and the on-chain transaction hash |
| Customer Support & Reports | Content and attachments you provide in tickets, reports, or feedback |
| Creator Program | Organization name, contact information, works and materials, payout wallet address (encrypted storage, only masked display in the interface) |
| Redemption Codes / Referrals | Codes you enter, referral links you share or use |
Information Automatically Collected When Using the Service
Viewing Data: Shows you watch, playback progress, whether you finished watching, likes/saves/follows, search history.
Playback Sessions: Session identifier generated for each playback, device identifier (stored in browser), IP address, playback mode (preview / full), quality, playback start and end times, and playback quality metrics (time-to-first-frame, failure reasons, etc.).
Account Activity: Coin balance changes, unlock records, VIP status, check-ins and reward distributions, ad viewing sessions.
Device & Technical Information: Browser type and version, operating system, screen size, language, timezone, approximate country/region (inferred from IP), referring page and source.
Attribution: Parameters carried in links when you access via ads or promotional links (e.g., utm_*, fbclid, gclid, ttclid), as well as referral/promotion codes.
Cookies and Similar Technologies
We use the following types of cookies and local storage:
| Category | Purpose | Consent Required |
|---|---|---|
| Essential | Login sessions, age verification status, language, playback authorization, anti-forgery tokens, anonymous visitor identifier, referral/attribution (within 30 days) | No (necessary for service operation) |
| Analytics | Track page visits, playback behavior, and errors to improve the service | Yes |
| Personalization | Recommend shows based on viewing history, remember player preferences | Yes |
| Marketing | Measure ad performance, show you relevant promotions | Yes |
You can change your preferences at any time under "Settings → Privacy & Cookies"; refusing non-essential cookies does not affect your ability to use core features.
How We Use This Information
| Purpose | Legal Basis (where GDPR applies) |
|---|---|
| Create and manage accounts, provide playback, record viewing progress, resume across devices | Contract performance |
| Process purchases, grant Coins and VIP, maintain order records, handle refunds and disputes | Contract performance, legal obligation |
| Enforce paywalls, preview durations, concurrent device limits, regional availability | Contract performance, legitimate interest |
| Prevent fraud, reward abuse, multi-accounting, chargebacks, and misuse; ensure system security | Legitimate interest, legal obligation |
| Send transactional notifications (orders, password reset, security alerts) | Contract performance |
| Send marketing emails, in-app push notifications, promotional offers | Your consent (can be withdrawn at any time) |
| Recommend shows, personalize homepage | Your consent |
| Statistical analysis, product improvement, playback quality enhancement | Your consent (analytics cookies) or legitimate interest (de-identified aggregate statistics) |
| Measure ad and promotion effectiveness, settle affiliate commissions | Legitimate interest, your consent (marketing cookies) |
| Creator revenue calculation, settlement, and withdrawal | Contract performance, legal obligation (tax) |
| Respond to customer support requests, handle reports, comply with legal requirements | Contract performance, legal obligation |
We do not use your personal information for automated decision-making that produces legal or similarly significant effects.
Who We Share Information With
We do not sell personal information, nor do we share it for third parties' own marketing purposes. We share information only in the following circumstances:
Payment Processors: Stripe (cards, Apple Pay, Google Pay), PayPal, WeChat Pay, Alipay, and USDT payment gateways. They process your payment information in accordance with their own privacy policies.
Email Service: Forward Email, used for sending verification emails, password resets, and notifications.
Login Providers: Google, Facebook, Apple, TikTok, or Telegram, as you choose to use.
Attribution & Analytics: AppsFlyer (cross-platform attribution, only enabled with consent) and the analytics tools we have enabled.
Ad Partners: When you choose "watch ad to unlock", ad networks receive ad session identifiers and device information to serve ads and confirm completion.
Translation Services: DeepL, Google Translate are used solely for translating show content and interface text — they do not receive your personal information.
Creators: Creators can only see aggregated viewing and revenue data for their works; they cannot see viewers' personal information.
Legal Requirements & Rights Protection: As required by court orders, regulatory requests, or necessary to prevent fraud and protect user and public safety.
Business Transfer: In the event of a merger, acquisition, or asset sale, your information may be transferred as part of the assets, and we will provide advance notice.
International Transfers
Our servers are located in
serverlocation(s), and some of our service providers are based in the United States or other countries. If you are located in the EU, UK, or Switzerland, we will use EU Standard Contractual Clauses (SCCs) or equivalent mechanisms for such transfers, and apply supplementary measures such as encryption.
Data Retention
| Data | Retention Period |
|---|---|
| Account Profile | For as long as your account exists; cleared within 30 days after account deletion (except where legally required to retain) |
| Viewing Progress & History | For as long as your account exists; you can delete it at any time under "Watch History" |
| Playback Sessions & Quality Logs | Deleted or de-identified after 180 days |
| Orders, Payments & Coin Transactions | 7 years after the transaction (accounting and tax requirements) |
| Customer Support Tickets & Reports | 2 years after case closure |
| Security & Audit Logs | 12 months |
| Anonymous Visitor Identifier & Attribution Parameters | 30 days |
| Cookie Consent Records | 12 months, after which consent is re-requested |
| Creator Settlement & Withdrawal Records | 7 years |
Your Rights
Regardless of where you are located, you may:
Access & Export: Request a copy of your data under "Settings → Privacy"; we will provide it in a machine-readable format within 30 days.
Rectify: Update your display name, avatar, and language in "Settings → Profile"; for email changes, please contact support.
Delete: Request account deletion under "Settings → Privacy". Upon deletion, Coins, VIP, and unlock records will become invalid and non-refundable; transaction records required by law will be retained in de-identified form.
Withdraw Consent: Turn off analytics, personalization, or marketing at any time under "Privacy & Cookies"; unsubscribe from marketing emails via the link at the bottom.
Object & Restrict: Object to our processing based on legitimate interests, or request restriction of processing.
Data Portability: Receive data you have provided to us in a commonly used format.
EU / UK / Swiss Users: The above rights are exercised in accordance with the GDPR / UK GDPR; you also have the right to lodge a complaint with your local data protection authority. We have not appointed a representative in the EU or the UK under Article 27 GDPR / UK GDPR. You can reach us directly using the contact details in Section 12.
California Users (CCPA / CPRA): You have the right to know the categories and purposes of personal information we collect, request deletion, request correction, and the right not to be discriminated against for exercising your rights. We do not sell or "share" (for cross-context behavioral advertising) personal information; should this change in the future, we will provide a "Do Not Sell or Share My Personal Information" option. Categories of information we have collected in the past 12 months are set out in Section 1.
Other Regions: Users in Brazil (LGPD), Canada (PIPEDA), and other jurisdictions may also exercise their rights under local laws via the contact information below.
To exercise your rights, please submit a request through "Help & Support" or email us at
support@hotplot.ai. We may need to verify your identity.
Security
We implement technical and organizational measures appropriate to the risks to protect your information, including: full-site HTTPS encryption; passwords hashed with bcrypt and never stored in plaintext; login session tokens stored only as hashes; payment information processed by PCI DSS-certified providers, with no access to full card numbers; creator payout addresses stored encrypted; video access controlled via signed tokens and expiry; back-office operations based on role-based permissions with audit logging; regular database backups stored offsite.
No system can guarantee absolute security. In the event of a data breach that may affect your rights, we will notify you and relevant regulatory authorities within the timeframe required by law.
Minors
The Service is for adults aged 18 or older (or the age of majority in your jurisdiction, whichever is higher). We do not knowingly collect personal information from minors. If you become aware that a minor has provided us with information, please contact us and we will delete it as soon as possible.
Third-Party Links and Embeds
The Service may contain links to third-party websites (e.g., payment pages, social sharing, app stores). These sites have their own privacy policies, and we are not responsible for them.
Do Not Track Signals
There is currently no universally accepted standard for "Do Not Track" signals, and our service does not respond to such signals. You can control tracking through the cookie settings described in Section 1.3.
Changes to This Policy
We may update this Policy. Material changes will be notified at least 14 days in advance via email, in-app message, or site announcement before they take effect. Continued use of the Service constitutes acceptance of the updated Policy. Historical versions are available upon request.
Controller and contact
Your personal information is controlled by:
Metalagro Ltd
Private Limited Company (Bangladesh)
PBL Tower, Dhaka 1212, Bangladesh
Business Identification Number (BIN): 000457843-0101
Phone: +8801898634651
Email: support@hotplot.ai
To exercise any right in Section 6, or to ask anything about this Policy, write to support@hotplot.ai or use Help & Support inside the Service. We aim to respond within 30 days, and will tell you if we need longer.