How personal data is processed in connection with the 10 Seconds website and ephemeral messaging service.
Sterling and Pierce Holding L.L.C-FZ ("we", "us", "the Publisher") operates 10 Seconds and acts as data controller where it determines the purposes and means of personal data processing described in this policy. Any processing performed on behalf of a business customer under an Enterprise pack is governed by the applicable Data Processing Agreement.
This policy carefully distinguishes two very different kinds of processing that happen inside 10 Seconds: (A) the temporary processing of your encrypted private chats, which creates no persistent record on our servers, and (B) the processing of your account, billing, support and affiliate information, which does create records retained for legally justified durations. These are described separately below.
Your private chat sessions are built on an ephemeral architecture. The following statements reflect the actual implementation of the standard service:
Removal from the chat interface, expiry of a message, and destruction of the server-side session are distinct operations. The 30-minute ceiling and the 10-to-20-second display window serve different purposes; neither implies that a readable conversation history is stored on our servers for any period.
Messages are end-to-end encrypted using TweetNaCl (Curve25519 key exchange, XSalsa20 stream cipher, Poly1305 authentication). Encryption is performed on the sender's device before transmission; the server processes ciphertext only.
Your private cryptographic key is generated on your device, encrypted locally with AES-GCM derived from your password via PBKDF2-SHA256 (600 000 iterations), and only the encrypted blob is sent to our servers. We cannot decrypt it; a lost password is unrecoverable by design.
Important legal point: encryption and the absence of server-side message retention do not mean that no personal data is processed by 10 Seconds. Information may remain personal data even when encrypted or processed only transiently, and the account, billing, support and affiliate flows described below do involve personal data that is retained.
Removal of a message from the chat interface is not a guarantee that every copy has been erased from a participant's device. Participants may photograph, record (including screen recording), copy, download where permitted, or otherwise retain information independently of the service. We do not control copies created by another participant or their device.
Forensic watermark: every chat session renders an invisible watermark across the chat area containing the viewer's username and the current date. If a leaked screenshot surfaces, this watermark allows the originating account to be identified. Participants are also notified in real time when a screen-capture event is detected on another participant's device.
Encryption does not eliminate risks arising from compromised devices, exposed credentials, malicious software, browser extensions, or disclosure by another participant. The service does not guarantee absolute anonymity, untraceability, or protection against every form of device-level compromise or external network observation.
The absence of messaging records must be distinguished from information processed to manage access, billing, support, and (optionally) the affiliate programme. The following paragraphs describe exactly what is processed in each flow.
| Data | Description |
|---|---|
| Username | Pseudonym chosen by the user. No real name is required for the chat identifier. |
| Password hash | bcrypt (cost 10, OWASP 2026 standard) hash of a client-side-hashed password. The plaintext password is never transmitted to our servers. |
| Encrypted private key blob | User's private cryptographic key, encrypted locally with the user's password (AES-GCM 256-bit, key derived via PBKDF2-SHA256 at 600 000 iterations). Not decryptable server-side. |
| Public key | NaCl Curve25519 public key — by nature public. |
| Account status, dates, type | Active / inactive flag, subscription start and end, account type (personal / enterprise_master / enterprise_sub), last login timestamp. |
| Data | Description |
|---|---|
| First name, last name | Stored encrypted at rest using Fernet (AES-128-CBC + HMAC-SHA256) with a server-side master key held outside the database. |
| Encrypted at rest with Fernet. | |
| Billing address | Encrypted at rest with Fernet. |
| Country (ISO code) | Used to compute applicable VAT. |
| Company name, VAT / registration number | Optional, for business purchases. Encrypted at rest with Fernet. |
| Invoice history | Issued invoices, amounts, transaction reference. Sensitive fields encrypted at rest. |
Card data is handled exclusively by Stripe, Inc. (hosted checkout, PCI-DSS). We never receive your card number. Cryptocurrency payments are processed by CoinPayments.net Inc.; we receive only the transaction reference and status.
When you contact contact@10seconds.io, we process the email address you write from and the content of your message, strictly to answer the request. Do not send passwords, private keys, wallet recovery phrases, or unnecessary conversation contents to support.
If you join the affiliate programme (opt-in), we additionally process: your affiliate link / token, the sponsor ↔ referee relationship, commission events, payout preferences and payout documents. Affiliate-flow events (sign-ups with a sponsor, commission creation, blocked attempts) are recorded in an anti-fraud audit log. If you do not participate in the programme, no such data is created.
Where the GDPR applies, our processing relies on the following distinct legal bases, which we do not confuse:
| Processing | Legal basis |
|---|---|
| Account creation, chat relay, message delivery, delivery of a paid service | Art. 6(1)(b) GDPR — performance of the contract requested by you. |
| Issuing and retaining invoices, accounting records | Art. 6(1)(c) GDPR — compliance with a legal obligation (tax, accounting). |
| Legal consent records (timestamp, document version, IP, user-agent) | Art. 6(1)(c) GDPR — proof of valid contractual acceptance. |
| Security and anti-fraud logging (including affiliate-flow audit log) | Art. 6(1)(f) GDPR — legitimate interest in service integrity. Content of messages is never processed on this basis. |
| Responding to legally valid requests from competent authorities | Art. 6(1)(c) GDPR. |
| Optional affiliate programme participation | Art. 6(1)(b) GDPR for the programme contract; opt-in action required. |
An obligation under non-EU law is not automatically treated as a legal obligation under Art. 6(1)(c) GDPR. Applicable UAE requirements (notably Federal Decree-Law No. 45/2021 on Personal Data Protection) and GDPR legal grounds are assessed separately where both regimes are relevant. Where processing relies on consent, consent is requested separately and may be withdrawn without affecting the lawfulness of earlier processing. Accepting the Terms of Service does not constitute consent to all personal data processing.
| Capability | Our position |
|---|---|
| Read message content | Not technically possible. End-to-end encrypted; the server processes ciphertext only. |
| Reconstruct conversation history | Not technically possible. No message database exists. |
| Access a user's private cryptographic key | Not technically possible. Generated and encrypted on the user's device, decryptable only with the user's password. |
| Reset a user's password while preserving their key | Not possible. The key is encrypted with the password; a reset invalidates the key. |
| Enterprise master reads a sub-account's chats | Not possible. Master can create / rename / reset sub-accounts' passwords but has no access to their private keys or chat content. |
| Access account metadata (username, dates, invoices) | Yes, as described in Section 5. |
| Identify the origin of a leaked screenshot | Possible via the forensic watermark burned into every session. |
| Respond to a valid legal order | Within the limits of what is actually held — see Law Enforcement information. |
These constraints are genuine architectural features. They do not guarantee: (a) protection from device-level access; (b) immunity from a valid legal order directed at a user's device; (c) protection against network-level metadata analysis performed by third parties outside our systems.
We maintain three technical log streams, each with a defined purpose. No chat message content is ever written to any log. Logs are structured so they never contain personal data in readable form, even after a full server compromise.
u_a7f3b2; every room identifier is replaced by c_<hex>. The transformation uses a server-side master key held outside the application database and never checked into source control — it is not reversible without that key.| Log | What it contains | Rotation |
|---|---|---|
app.log | Application errors only (ERROR level). Usernames pseudonymised, encrypted at rest with Fernet. | Size-based rotation at 100 KB, 1 backup kept. |
security.log | Security events (failed logins, admin actions, suspicious access patterns). Usernames and room identifiers pseudonymised, encrypted at rest with Fernet. | Size-based rotation at 10 MB, 10 backups kept. |
affiliate.log | Affiliate-programme events (sign-ups with sponsor, commission creation, admin changes, blocked attempts). Only generated for users who opt into the affiliate programme. Encrypted at rest with Fernet. | Size-based rotation at 10 MB, 20 backups kept. |
Rotation is driven by file size, not by elapsed time; the actual retention depends on service traffic. Older rotated backups are deleted automatically when the backup count is exceeded.
These combined measures (ERROR-only level, HMAC-SHA256 pseudonymisation, and Fernet at-rest encryption) ensure that even in the event of a full server compromise, an attacker cannot reconstruct who communicates with whom, when, or on what basis. Together they satisfy the technical safeguards expected under Art. 32 GDPR and the equivalent provisions of the UAE PDPL.
| Record | Retention |
|---|---|
| Message content | Not retained. Purged from server memory within the session lifetime (max 30 minutes). |
| Account credentials (username, hashed password, encrypted key blob) | Retained while the account exists. On explicit account deletion, credentials are removed; derived audit traces may be anonymised rather than deleted where legally required. |
| Invoices and payment records | Retained for the legally required period under applicable tax and accounting law (10 years in most EU jurisdictions and in the UAE), then deleted. |
| Billing information | Retained with invoices for the same legal period. |
| Legal consent records | Retained for 5 years from acceptance, to prove valid contractual consent, then deleted. |
| Affiliate records | Retained while the affiliate relationship is active, then for the legally required period for related invoices and commissions. |
Where legally mandatory retention is longer than the Publisher's commercial need, the mandatory period applies. Account closure does not require immediate deletion of invoices, transaction records, or records necessary for legally justified claims.
We disclose personal data only in the following situations:
We have no commercial partner other than the two payment sub-processors named above. We do not sell, rent, or lease any personal data for marketing, advertising, profiling, or any other third-party purpose. There is no advertising cookie, no analytics tracker, no profile sold.
No AI model training or inference on user content. We do not use message content, metadata, encrypted blobs, billing information, support correspondence, or any other personal data processed by 10 Seconds to train, fine-tune, evaluate, or operate general-purpose or domain-specific artificial-intelligence models — whether operated by us or by any third party. This commitment is contractually binding and reflected in our Data Processing Agreement §4.
Our establishment in Dubai does not, by itself, establish where every processing operation takes place. For EU users, personal data transfers to the UAE and to third-party processors are conducted under appropriate safeguards. The UAE is not currently subject to an EU adequacy decision; transfers are therefore conducted under GDPR Art. 46 safeguards, including EU Standard Contractual Clauses where applicable.
We have neither the legal mandate nor the technical capability to verify:
Billing data is collected solely to issue a legally compliant invoice and is not verified by us. Accuracy of all identity and billing information is your sole responsibility. Providing false identity or billing information does not transfer any resulting liability — tax audit, VAT reclaim issue, legal process, chargeback dispute, investigation by a competent authority, or sanctions screening failure — to the Publisher.
KYC/AML performed by Stripe (card payments) and CoinPayments (cryptocurrency payments) under their own policies is separate from our processing and remains governed by those providers' terms. We do not receive your card numbers, your wallet balances, or any KYC file held by them. Further detail is available in our KYC & Identity Policy.
Nothing on this website — including displayed invoices, account dashboards, VAT numbers echoed back from input, or communications from contact@10seconds.io — constitutes identity certification, source-of-funds attestation, proof of residency, confirmation of regulatory status, or any form of accreditation in any jurisdiction. Any such claim made by a third party on the basis of a 10 Seconds account, invoice, or communication is made entirely at that party's own risk and without our endorsement.
Access to 10 Seconds, and use of any network-level privacy or security software a user may independently choose to install on their own device, are subject to the laws of the user's jurisdiction. The Publisher does not supply, distribute, bundle, promote, or endorse any such software. The Publisher does not advise on whether any particular tool or any particular use is lawful in a given jurisdiction — this assessment is beyond the scope of a software subscription and remains the sole responsibility of the user, who must verify compliance with applicable local law, including any authorisation or notification requirement, before installing or using any such tool.
Full details are in our Cookies Policy. In short:
HttpOnly, SameSite=Lax, Secure in production. Content: your signed logged-in user identifier. Lifetime: browser session — the application does not mark the session as permanent and does not use "remember me" at login, so the cookie is cleared when the browser is closed and on logout. Full technical detail in the Cookies & Browser Storage Policy §2.chat_display_<room>) that remembers the display name you entered for a given chat; cleared when the browser tab is closed.Our session and CSRF cookies qualify as strictly necessary under Article 5(3) of ePrivacy Directive 2002/58/EC; no prior consent is required for strictly necessary cookies, but we inform you anyway for transparency.
Where the GDPR applies, you have rights to: access, rectify, erase, port, restrict processing of, and object to processing of your personal data; and to withdraw a consent you have given, without that withdrawal affecting the lawfulness of earlier processing.
Requests may be sent to contact@10seconds.io. We request only information reasonably necessary to verify and handle the request; we do not require a government identity document by default. Where the GDPR applies, we respond without undue delay and normally within one month; where legally permitted because of complexity or the number of requests, this period may be extended by two further months, in which case we explain the extension within the first month.
Important limitation of what we can deliver: we cannot recover message content (never stored), we cannot decrypt your private key (not held by us), and we do not re-create deleted communications or create a new archive in order to answer a request. Where we no longer hold the requested information, we explain the applicable limitation without using it to deny rights concerning information that remains available.
Where the UAE Federal Decree-Law No. 45/2021 on Personal Data Protection applies, the equivalent data subject rights are honoured through the same contact address.
You may at any time lodge a complaint with your national supervisory authority (EU data protection authority in your Member State; the UAE Data Office under the UAE PDPL framework) without first contacting us.
Where US state privacy laws apply (notably California CCPA/CPRA, Virginia VCDPA, Colorado CPA, Connecticut CTDPA, Utah UCPA, Texas TDPSA, Oregon OCPA and comparable laws), you may have rights of access, correction, deletion, portability, opting out of sale or targeted advertising, limiting use of sensitive personal information, and (in several states) appealing a refusal.
Requests and appeals may be submitted to contact@10seconds.io. We comply with applicable deadlines, authorised-agent procedures, and the protections against unlawful discrimination required by the relevant law. We do not sell personal information and we do not use personal information for targeted advertising; opt-out mechanisms are therefore not necessary, but we honour explicit opt-out signals (including, where applicable, Global Privacy Control) where received.
We implement appropriate technical and organisational measures proportionate to the risk, aligned with OWASP ASVS 2026 and NIST SP 800-63B:
max-age=31536000; includeSubDomains; preload (RFC 6797); strict Content Security Policy Level 3; cross-origin opener and resource policies set to same-origin.hmac.compare_digest) to prevent timing attacks.127.0.0.1 and never exposed externally; MySQL accessed through a 32-connection pool per worker, preventing connection-exhaustion denial-of-service.No system is perfectly secure. The confidentiality of your communications depends materially on the security of your end device and your password. Vulnerability reports are welcome at contact@10seconds.io; we acknowledge every valid report within 72 hours.
We may update this Privacy Policy to reflect changes to the service, our providers, or applicable requirements. Material changes are notified via the platform through a blocking acknowledgment screen that must be reviewed before further use of the service. The date at the top of the page identifies the latest update. Changes do not retroactively reduce rights attached to processing that has already occurred.
Version 2026.15 · Effective 2026-10-23.
Published by Sterling and Pierce Holding L.L.C-FZ, Meydan Free Zone, Dubai (UAE).
Contact: contact@10seconds.io — single point of contact for all matters.