1. Introduction

Welcome to shop2topup.com. We're committed to protecting your privacy and being upfront about how we handle your data.

This policy explains what information we collect, how we use it, how we protect it, and what rights you have.

By using shop2topup.com, you agree to the practices described here.

1.1 Who We Are

Website: shop2topup.com
Contact: [email protected]
What we do: Digital game codes and top-up marketplace

1.2 Our Privacy Approach

Here's what sets us apart: we don't sell or share your data with marketers, we don't use tracking cookies or ad pixels, and we don't build user profiles for advertising. We only use your data to run the service, keep things secure, and understand general market trends through anonymous analytics.

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

2.2 Transaction Information

For each transaction, we collect:

2.3 Usage and Analytics Information

We collect limited usage data for business analytics:

• Country or region from your IP (for market analysis only)
• Regional sales patterns (aggregated and anonymized)
• Popular products by region (aggregated and anonymized)
• Which products are purchased most frequently
• Product category preferences (aggregated)

3. How We Use Your Information

3.1 Service Delivery

We use your information to:

• Process transactions: Confirm crypto payments and deliver digital products
• Manage accounts: Create, maintain, and secure your account
• Provide customer support: Respond to inquiries and resolve issues
• Send transactional emails: Order confirmations, delivery notifications, password resets
• Maintain platform balance: Track and display your account balance
• Deliver API services: Provide API access to resellers

3.2 Analytics and Business Intelligence

We use aggregated, anonymized data to understand our market better:

All analytics are conducted on aggregated, anonymized datasets. We don't track individual user behavior or create profiles for marketing.

3.3 Security and Fraud Prevention

We use your information to:

• Screen cryptocurrency wallets: Check for sanctioned, fraudulent, or high-risk wallets
• Detect fraud: Identify suspicious patterns or account abuse
• Prevent money laundering: Comply with AML/CTF regulations
• Block malicious actors: Prevent access from known bad actors
• Secure accounts: Monitor for unauthorized access attempts

3.4 Reviews and Moderation

When you post a review, we use the data to:

• Display your rating and comment publicly on the product, category, and global review pages
• Run automated moderation that scans every comment for profanity, contact information, and links — flagged reviews are routed to manual review
• Allow our moderation team to approve, reject, edit, or hide reviews that violate our content rules
• Aggregate rating averages and review counts across products
• Detect coordinated abuse, multi-account voting rings, and review manipulation attempts

Once published, reviews remain visible indefinitely unless removed by our moderation team.

4. How We Share Your Information

4.2 Limited Sharing - Service Providers Only

We share data only when necessary with:

All service providers are contractually bound to confidentiality, prohibited from using your data for their own purposes, must comply with data protection laws, and are selected based on their security standards.

5. Data Retention

Even if you delete your account, transaction records are retained for compliance but disassociated from your personal identifiers (email, name).

5.2 Account Data - While Active + Retention Period

Active Accounts:

• All account data retained while your account is active
• No automatic deletion for inactive accounts

Deleted Accounts:

• 30-day grace period: Account in "pending deletion" status, recoverable upon request
• After 30 days:
  • Personal identifiers deleted (email, OAuth profile, display name)
  • Session data deleted
  • Transaction records retained (see above)
  • Aggregated analytics retained (anonymized)

5.3 Other Data Retention

• Security and access logs: 12-24 months
• Error logs: 6-12 months
• API keys (active): While active
• API keys (revoked): 30 days after revocation
• Support communications: 2-3 years

6. Data Security

Technical Security Measures

• HTTPS/TLS encryption for all data in transit
• AES-256 encryption for sensitive data at rest (passwords, API keys)
• Hashed passwords using bcrypt or Argon2 (irreversible)
• Firewalls and intrusion detection systems
• DDoS protection and rate limiting
• Regular security scans and vulnerability assessments

Your Responsibility

You're responsible for:

• Choosing a strong password (minimum 12 characters)
• Not sharing your credentials
• Enabling two-factor authentication (2FA) if available
• Logging out on shared or public devices
• Reporting suspicious activity immediately to [email protected]

Data Breach Notification

In the unlikely event of a data breach, we will:

• Investigate immediately to determine scope and impact
• Contain the breach to prevent further unauthorized access
• Notify affected users within 72 hours via email
• Report to authorities as required by law
• Provide guidance on protective steps you can take

7. Cookies and Tracking Technologies

7.2 What We DON'T Use

• Advertising cookies (Facebook Pixel, Google Ads, retargeting)
• Third-party tracking cookies
• Social media widgets with tracking
• Behavioral profiling cookies

Note: Essential cookies are required for the platform to function. Disabling them will prevent you from logging in or making purchases.

8. Your Privacy Rights

Rights for All Users

Regardless of your location, you have these rights:

• Right to Access: Request a copy of your personal data
• Right to Correction: Update inaccurate or incomplete information
• Right to Deletion: Request deletion of your personal data (except transaction records for compliance)
• Right to Data Portability: Download your transaction history in structured format (CSV, JSON)
• Right to Opt-Out: Unsubscribe from optional marketing emails

Additional Rights for EU Users (GDPR)

• Right to restriction of processing
• Right to object to processing
• Right to lodge a complaint with data protection authority
• Right to withdraw consent

Additional Rights for California Users (CCPA)

• Right to know what personal information we collect
• Right to delete personal information
• Right to opt-out of sales (We do NOT sell personal information)
• Right to non-discrimination

How to Exercise Your Rights

To exercise any privacy rights:

Summary - What Makes shop2topup.com Privacy-Focused

Your privacy matters to us. We built shop2topup.com to be a secure, transparent marketplace where you can shop with confidence.