Privacy Policy

Data we process

We use only the categories needed for the account, order, and follow-up:

• Account identity: name, email address, and a phone number when you choose to add one.
• A profile photo is optional and appears only inside your account. We resize it and remove embedded metadata. You can remove it from your profile.
• Order records: the card, quantity, and updates to payment and delivery status.
• Transaction reference, amount, currency, and state. The store does not receive your wallet keys or your credentials with the payment service.
• Limited technical signals that keep the site operating and help identify attempted abuse.
• When Telegram is enabled, we process an encrypted conversation identifier and a non-reversible fingerprint, along with language, notification preferences, and connection status.
• When you sign in and consent to analytics, we send Google Analytics a pseudonymous identifier derived from your account so sessions belonging to the same account can be connected. It does not contain your email address, name, or phone number.
• If you submit a product review, we keep its stars, title, text, and display name, and internally link it to the account, order, and delivery to prove the purchase is genuine. We do not publish the order number or account identifier. Selected reviews may also appear on the homepage with the display name and a verified-purchase label.

Why we process data

• Sending the order to the supplier, releasing the code, and updating the state you see.
• Answering support requests and checking complaints or interrupted delivery.
• Detecting fraud, protecting the service, and carrying out requirements that apply to it.
• Verifying, moderating, and displaying approved product reviews to help customers make informed purchase decisions.

Sharing with processors

The service depends on a payment company, voucher supplier, hosting, and infrastructure services. Each receives only what its task requires, and we do not sell your data.

If you choose Telegram notifications, Telegram may process and transfer data through servers outside the United Arab Emirates under its own terms and privacy practices.

We provide a Trustpilot link and widget for collecting service reviews. The direct link remains available, and the interactive Trustpilot widget is loaded from its domain only after you consent to analytics.

When automated Trustpilot invitations are enabled, we send Trustpilot only the email address and order reference after payment and delivery are complete so it can schedule a service-review invitation. We do not send codes, serial numbers, products, amounts, phone numbers, or access tokens, and invitations exclude orders completed before activation.

After a recent order is completed, we may display the Google Customer Reviews opt-in. Google receives the order reference, account email, delivery country, and estimated delivery date to present that choice, and sends a review request only when the customer agrees in the widget. The widget may use cookies or similar technology under Google's policy.

Retention

We retain information about the source of an order for five years from its creation date. Updating the record does not restart that period.

We retain each privacy-choice record for five years from that decision to demonstrate consent, rejection, or withdrawal, then delete it unless a dispute or legal duty requires longer retention. The record contains a random browser identifier, category states, the interaction used, the notice and policy language and versions, and server time; it contains no name, email address, account number, IP address, or device data.

A Telegram connection and its preferences are retained while the connection is active. Disconnecting cancels pending notifications, revokes tokens, and deletes the conversation identifier, connection, and preferences.

Account and order records remain only as long as operations, accounting, regulatory duties, or a dispute require, after which they are deleted or de-identified unless a legal requirement calls for retention. Google Analytics user and event data retention is set to 14 months.

An approved review remains visible while the product and service remain available or until its author asks for deletion, unless a limited record must be kept for a dispute or legal duty. A rejected review is never public.

Security

A code is kept in encrypted form and released after delivery only to the account recorded on the order. Integration keys for payment and supply remain on the server and are never sent to the browser.

Your requests

You may ask to see or correct your data, or to delete what regulatory and accounting duties allow us to delete. Send the request through the store's official support channel.

Cookies

Necessary cookies remember the account session, cart, and language choice. They stay active because the store does not work without them.

Analytics cookies run only after you explicitly agree. Before you agree, or if you decline, Google Analytics operates in limited consent mode and sends cookieless measurements, while analytics cookies and Microsoft Clarity remain disabled.

When you open a dedicated storefront sharing link, two first-party cookies retain the first and latest link codes and their opening times for up to 180 days. This information is copied to the order when payment starts so paid orders can be measured by source. This measurement is separate from Google Analytics and Microsoft Clarity and contains no IP address, device fingerprint, or customer name.

Advertising storage, advertising user data, and personalization activate only when you explicitly choose marketing. If you reject or withdraw, ad_storage, ad_user_data, and ad_personalization remain denied, and Google Signals data does not accumulate for that visit.

Analytics

When site statistics are enabled, we collect hourly counters by public page and language without storing IP addresses, visitor identifiers or search text in those counters. They do not identify people or connect a person's visits. After analytics consent, additional counters may record interactions such as viewing a product, adding to cart and starting checkout. These local aggregates are retained for up to 90 days, with expired records removed during the next hourly cleanup. This local collection respects Do Not Track and Global Privacy Control signals when sent by the browser.

Once you agree to analytics cookies, we measure how the store is used through Google Analytics so we can improve it.

If you are signed in, the measurement is tied to a pseudonymous identifier derived cryptographically from your store account id using a secret key we hold. A third party cannot trace it back to you, and it stays the same for your account across devices.

When you sign in and consent to analytics and marketing, we send a one-way SHA-256 hash of your email and, when available in international format, your phone through Google Analytics user-provided data to improve conversion matching and campaign measurement. We do not send plain-text contact details, names, Google account ids, access or session tokens, or gift card codes. These hashes are pseudonymous, not anonymous, and do not replace your consent.

A visitor who is not signed in gets no identifier at all. Signing out or withdrawing consent clears it immediately, so measurement stops being linked to your account.

You can change your choice at any time from this page, with no effect on your ability to buy.

Necessary cookies remember the account session, cart, and language choice. They cannot be disabled because the store and its security require them. Analytics and marketing storage follow the choice you make in the privacy preferences panel.

We use Google Analytics and Google Tag Manager to measure page and purchase performance, and Microsoft Clarity to understand the user experience. The Google tag always follows Consent Mode v2; without consent it stores no analytics cookies and sends limited cookieless measurements. Microsoft Clarity runs only after analytics consent. You can change your choice at any time through “Privacy preferences” in the storefront footer or Account Settings; withdrawing consent reloads the page to stop components that were previously accepted.

Only when you consent to marketing, Google Signals may use aggregated information from signed-in Google users who enabled Ads Personalization to measure campaigns and understand general interests and demographics. We do not send an email address, name, or phone number to Google as a user identifier.