Privacy Policy

**Account.** Email address, display name, password hash or the identifier of the sign-in provider you use, and the date of creation. If you sign in with a crypto wallet, the wallet address and the signed message that proves you control it.

**Orders.** The products bought, prices, currency, the email address or wallet address you gave for delivery, the language of the site, the country of your connection, and the status of the order and of its payment. For a gift, the recipient's email address and name, and the message you wrote.

**Payments.** For a cryptocurrency payment: the coin, network, amount, the deposit address we assigned, the transaction hashes and the addresses the funds came from. This data is public on the blockchain by nature. We never see your private keys. For other payment methods, the reference the provider gives us; the provider holds your payment details under its own policy.

**Proof of delivery.** Each time a code is revealed we record the date and time, the IP address, the country derived from it, the browser and device identification string, the language of the browser, how the order was accessed (account, guest link or wallet), and the version of the statements you accepted.

**Support.** The tickets you open, their category, the messages and attachments you send, and our replies.

**Technical data.** Server logs with IP address, requested page, time and browser; the data needed to detect fraud and abuse (repeated orders, mismatched countries, known-bad addresses); and the cookies and local storage described in the Cookie Policy.

**Identity documents.** Only if we ask you to verify your identity or the origin of funds for a specific order, and only the documents you then send us.

We do not collect data from children. The site is for adults; if we learn that a minor has given us data, we delete it.

• **To sell and deliver** what you order, run your account, send the order emails, and give you support: because it is necessary to perform our contract with you.
• **To prove delivery and defend claims**: the reveal record exists so that a dispute about a code can be decided on facts, and so that we can answer a chargeback, a refund claim or a court. This is our legitimate interest, and yours, in reliable records.
• **To prevent fraud and abuse**: checking orders, countries, addresses and patterns, and asking for verification when something does not add up, in our legitimate interest to run a safe store and in the interest of the platforms and issuers whose codes we sell.
• **To comply with the law**: keeping accounting and tax records, answering lawful requests from authorities, applying sanctions rules, and anti-money-laundering obligations where they apply.
• **To improve the site**: aggregate statistics that do not identify you. We use no advertising trackers today. If we add an analytics tool, the Cookie Policy will list it and you will be able to refuse it.

We send you emails about your orders and your account. We do not send marketing emails unless you subscribe, and you can unsubscribe at any time.

We share personal data only with providers that work for us under contract, and only what each needs:

• hosting and infrastructure in the European Union (servers in Germany) and a content delivery and security network in front of the site;
• the email delivery service that sends order and account emails;
• the object storage that holds product images and support attachments;
• payment providers for the methods you choose, which receive the order reference and amount;
• platforms and issuers of the codes, only the data needed to investigate a claim about a specific code;
• our accountants and legal advisers, and authorities when the law requires it.

We do not sell personal data and do not share it for advertising.

Velkeys LLC is a United States company; the site runs on servers in the European Union, and some providers are in the United States. When data of a person in the European Economic Area, the United Kingdom or Switzerland is transferred outside those territories, we rely on the European Commission's standard contractual clauses or the UK addendum with the receiving provider, or on an adequacy decision where one exists.

• **Orders, payments and proof of delivery:** 10 years from the order, because tax and accounting law require the records and because claims about an order can arise for years.
• **Account:** until you delete it or after 3 years without activity, after which the orders stay under the previous rule without the account.
• **Support tickets:** 3 years after the ticket is closed.
• **Server and security logs:** 90 days, longer only for an incident under investigation.
• **Identity documents:** deleted 30 days after the verification is decided; 180 days when the order was flagged as high risk, unless the law requires longer.
• **Fraud records** (addresses, emails and patterns linked to confirmed fraud): 5 years.

When a period ends we delete the data or make it anonymous.

Codes are stored encrypted and shown only after your authentication and your explicit consent. Passwords are stored hashed. Access to the systems is restricted, logged and protected with two-factor authentication. Payments are received on addresses we control and moved to cold storage. No system is perfectly secure; if a breach affects your data we notify you and the authorities as the law requires.

Depending on where you live, you have the right to access the data we hold about you, to receive a copy, to correct it, to delete it, to restrict or object to its use, to take it to another provider, and to complain to a data protection authority. In the European Economic Area and the United Kingdom these rights come from the GDPR and the UK GDPR; in California, from the CCPA; other laws give similar rights.

To exercise them write to [email protected] from the email address of your account, or with proof that the data is yours. We answer within one month. We can refuse to delete data we must keep by law or need to defend a claim, and we tell you when that is the case.

Objecting to the use of your data for fraud prevention or for proof of delivery does not prevent us from keeping the records of orders you already placed.

The cookies and local storage we use, and how to change your choice, are described in the Cookie Policy.

We update this policy when the site or the law changes. The date at the top tells you when the current version took effect; a material change is announced on the site before it applies.

Questions, requests and complaints: [email protected]. Velkeys LLC, 5830 E 2nd St, Ste 7000 #18990, Casper, WY 82609, United States.