This Privacy Policy explains how BuyCryptoCard ("we", "our", "us") handles personal data when you visit buycryptocard.com or use your account: what we collect, the reasons, who receives it and the choices you have.
1. Who handles your data
BuyCryptoCard is responsible for the personal data described in this policy. Privacy questions can be sent to [email protected].
2. Data we collect
Account details
Your name, email address, a one-way hash of your password, the date you registered and whether your email address has been confirmed.
Sign-in and security details
Your two-factor authentication secret and recovery codes, which are stored encrypted, and a record of each sign-in attempt: time, IP address, browser, operating system and device type. We use this record to protect your account and to warn you when a new device signs in.
Orders and payments
The card amount and fees of each order, the payment method and network you chose, and the payment information we receive: from a payment processor, its payment reference, the amount and currency received and the time; for a direct wallet payment, the transaction ID you submit and any screenshot you upload. For refunds we also keep the reason you give and the payout address and network you enter.
Card details
The details of each card issued to you: number, security code, expiry date, cardholder name, billing address and balance. We store the number, security code and expiry date in encrypted form, and they appear on screen only after you confirm with a code from your authenticator app.
Messages
What you write to us through support tickets or the contact form, and our replies.
Technical information
Standard server logs (IP address, page requested, time and browser type), kept for security and fault-finding.
3. Why we use it
- To open and run your account and supply the cards you order, which is necessary to perform our agreement with you.
- To confirm payments, prevent fraud and abuse, and keep accounts safe, based on our legitimate interests and, where they apply, our legal obligations.
- To send service emails such as confirmation links, order and card updates, refund decisions and security alerts. These are part of the service and stay on while you have an account.
- To reply to questions and support requests.
- To meet legal, accounting, tax and regulatory duties and answer lawful requests from authorities.
We do not sell personal data, and we do not use it for third-party advertising.
4. Who receives it
- Card-issuing partners, as far as needed to issue, manage, freeze or close your cards and to process refunds.
- Crypto payment processors whose hosted checkout you use. They receive your name, email address, the order reference and the amount so they can take the payment. Their own privacy policies apply to anything you enter on their pages.
- Hosting and email providers that run our servers and database and deliver our emails, under agreements that require them to protect the data.
- Bot-protection services, such as Cloudflare Turnstile, which check that the sign-up, sign-in, password-reset and contact forms are used by people.
- Telegram, if you decide to contact support there. Telegram's privacy policy applies to those messages.
- Authorities, courts or other parties where the law requires it or where it is needed to protect our rights, our customers or the public, for example when reporting fraud.
- A buyer or successor if the business is sold or reorganised, under equivalent protections.
5. Blockchains are public
Crypto transactions are recorded on public ledgers. Anything written to a blockchain, including your wallet address and the amount you send, is public by design. We do not control it and cannot change or delete it.
6. How long we keep it
- Account, order, card and refund records: while your account is open, and afterwards for as long as accounting, tax and anti-fraud rules require, which is usually five to seven years depending on the country.
- Sign-in history: 180 days.
- Uploaded files such as payment screenshots: until the related order and any dispute are settled, then deleted.
- Contact-form messages that do not lead to an account: up to 24 months.
7. How we protect it
Connections to the site are encrypted with HTTPS. Card details and authentication secrets are encrypted at rest. Two-factor authentication is required for customers and staff, requests are rate-limited, access is restricted by role, uploaded files are kept in private storage, and staff actions are written to an audit log. No system can be completely secure, but we work to keep the risk low, and if a breach occurs we will inform you and the authorities where the law requires.
8. Your rights
Depending on where you live, you may be able to see the data we hold about you, have it corrected or deleted, limit or object to some uses, receive a portable copy and withdraw consent where we rely on it. Some records have to be kept for legal reasons even after a deletion request. To use these rights, email [email protected] from the address linked to your account. You can also complain to the data-protection authority where you live.
9. Cookies
We only use cookies the site needs to work: a session cookie that keeps you signed in, a security cookie that protects forms against cross-site request forgery and, when bot protection is switched on, the cookies that service sets to tell people from automated traffic. A payment processor's checkout page sets its own cookies. We do not use advertising or cross-site tracking cookies.
10. Transfers to other countries
Our providers may process data outside your country. Where the law requires it, we rely on suitable safeguards such as standard contractual clauses.
11. Children
The service is meant only for people aged 18 or over, and we do not knowingly collect data about anyone younger.
12. Changes
When this policy changes, the new version will appear on this page. We will tell you about significant changes by email or in your dashboard.
Questions about this document: [email protected]