Privacy Notice

Gameplug LLC, a Wyoming limited liability company ("Gameplug", "we", "us"), is the controller of the personal data described in this Notice. We operate gameplug.net. Our principal office is 30 N Gould St, STE R, Sheridan, WY 82801, USA, and we sell digital products worldwide.

Gameplug is the seller and merchant of record for all orders. Our payment processors — Stripe, Inc. (cards, Apple Pay, Google Pay and other local methods) and NOWPayments (cryptocurrency) — act as independent controllers for the payment transaction itself and process card and payment data on our behalf. Their own privacy notices apply to data they collect directly from you during checkout.

This Notice applies to personal data we collect when you visit our website, create an account, place an order, communicate with our support team, sign up for marketing, or otherwise interact with our services.

We collect the following categories of personal data:

• Account data — name, email, password (hashed), country, language preference, optional profile fields.
• Order data — items purchased, prices, currency, delivery email, billing address (when required), supplier order ID, and a fingerprint (not the value) of each delivered key.
• Payment data — handled directly by Stripe / NOWPayments. We receive only the result, a transaction reference, and the provider fee. We never see your full card number, CVV, or crypto wallet private keys.
• Key-reveal audit data — when you open a key delivery page and scratch to reveal your key, we record the date, time, IP address, and device user-agent. Used exclusively for fraud / chargeback defence.
• Dispute / case data — your description, any screenshot you attach, status, supplier's verdict, and a computed claim-risk score.
• Communication data — emails to support, live-chat conversations (Chatwoot), our replies.
• Device & usage data — IP, browser, OS, referrer, pages visited, aggregate analytics.
• Marketing preferences — email subscription status + consent/unsubscribe timestamps.

We do not knowingly collect "sensitive personal information" under the California Privacy Rights Act (CPRA): no government ID, no precise geolocation, no biometrics, no health, no racial/ethnic origin, no sex-life data.

• To create and operate your account, and authenticate you.
• To process orders, deliver keys, and send confirmation / delivery emails.
• To run anti-fraud + chargeback defence (risk scoring, key-reveal audit, dispute case management).
• To respond to support requests and resolve disputes.
• To send transactional emails and (only if you opted in) marketing emails about deals and releases.
• To monitor and improve site performance, debug bugs, and prevent abuse.
• To comply with legal obligations, including tax records and lawful requests.

If you are in the EEA, the UK, or Switzerland, we rely on these Article 6 GDPR bases:

• Contract (Art. 6(1)(b)) — to provide the products and services you ordered.
• Legitimate interests (Art. 6(1)(f)) — fraud prevention, security, chargeback defence, service improvement. You may object at any time.
• Consent (Art. 6(1)(a)) — non-essential cookies and marketing emails. Withdrawable at any time.
• Legal obligation (Art. 6(1)(c)) — tax / accounting records (typically 7 years) and lawful requests.

We share personal data only with service providers needed to run the business:

• Payment processors — Stripe (cards; also the recipient of our dispute evidence, including purchase and key-reveal IP records, when we contest a chargeback), NOWPayments (crypto — receives no personal data beyond the payment itself).
• Digital-goods suppliers — CodesWholesale, Kinguin, Keybin and others receive only product SKU and quantity. Reloadly (gift cards and mobile top-ups) additionally receives the delivery email address and, for top-ups, the recipient phone number — that data is necessary to deliver those products.
• Email delivery — Brevo (SendinBlue).
• Customer support — Chatwoot (self-hosted by us). Support-chat messages, together with your name, email and recent order summaries, are also processed by Groq (our AI assistant provider) to generate replies; a human can always take over.
• Review invitations — Trustpilot, when we invite you to review a delivered order.
• Operational alerts — order notifications (including the order email address) reach our staff via Telegram's Bot API.
• Security & anti-fraud services — bot protection by Cloudflare (Turnstile); IP-geolocation and IP-reputation lookups (ipwho.is, AbuseIPDB) for fraud prevention.
• Analytics — PostHog (consent-gated product analytics) and Sentry (error monitoring).
• Hosting and infrastructure — our hosting and CDN providers, including Cloudflare.
• Legal authorities — only with valid legal process or to protect rights, life, or safety.

We do not sell personal information for money, and we do not share personal information for cross-context behavioural advertising. We have not done so in the past 12 months.

• Account data — active account + 30 days after deletion.
• Order records, invoices, accounting — 7 years.
• Delivered key fingerprints + reveal audit — 3 years from delivery.
• Dispute / refund cases — 7 years.
• Marketing consent records — until you unsubscribe + 5 years for proof of consent.
• Server logs — typically 90 days; longer for security incidents.

We run two automated systems that may produce decisions affecting you:

• Order risk scoring — orders above a threshold are held for manual review by our team before fulfilment.
• Claim-risk scoring — when you report a problem with a key, dispute history is scored and high-risk claims are flagged for manual investigation; they are not auto-rejected.

You have the right to a human review of any held order or flagged claim — contact us.

Depending on where you live, you may have the rights below. To exercise any of them, email [email protected]. We respond within 30 days (45 for complex California requests).

EEA / UK / Switzerland (GDPR / UK GDPR):

• Access — receive a copy of personal data we hold.
• Rectification — correct inaccurate data.
• Erasure — request deletion subject to retention obligations.
• Restriction — limit how we use data while a request is pending.
• Portability — receive your data in a machine-readable format.
• Object — to processing based on legitimate interests or direct marketing.
• Lodge a complaint with your local data-protection authority.

California (CCPA / CPRA):

• Right to know categories and specifics of PI collected/used/disclosed/sold/shared (we do not sell or share).
• Right to delete (subject to legal exceptions).
• Right to correct inaccurate PI.
• Right to limit use of sensitive PI (we do not knowingly collect any).
• Right to opt out of sale/sharing.
• Right to non-discrimination.

Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Oregon (OCPA), Montana (MCDPA): substantially the same access, deletion, correction, portability, and opt-out rights as California. Same contact address.

Four categories of cookies and similar storage:

• Strictly necessary — session, authentication, CSRF, cart, security. Cannot be disabled.
• Functional — language, currency and theme preferences.
• Analytics — product analytics (PostHog). Only activated after you accept.
• Marketing — measurement of our own promotions. Only set if you opt in; we never use third-party advertising cookies.

You can change your choice at any time via the Manage cookies link in the footer. See the Cookie Policy for the full inventory.

We honor the Global Privacy Control (GPC) signal — if your browser sends GPC, we treat it as an opt-out of analytics and any future sharing or sale.

Our service providers operate in the EU, UK, US, and other jurisdictions. For transfers outside the EEA/UK we rely on the European Commission's Standard Contractual Clauses (and the UK IDTA addendum where applicable) and on adequacy decisions where available.

TLS in transit; encrypted columns for sensitive at-rest data (including delivered game keys); HTTP-only Secure cookies; rate limiting; IP allowlists for administrative endpoints; HMAC-SHA256 / SHA-1 / SHA-512 signature verification on every payment webhook. No system is perfectly secure — contact us immediately if you suspect a problem.

The service is intended for users aged 18 or older. We do not knowingly collect data from children under 13 (or under 16 in the EEA / UK). If you believe a child has provided personal data to us, contact us and we will delete it promptly. This service complies with the US Children's Online Privacy Protection Act (COPPA).

California Civil Code § 1798.83 — we do not disclose PI to third parties for their direct marketing. We honor Do-Not-Track (DNT) by not setting non-essential tracking cookies when DNT is enabled.

We may update this Notice from time to time. Material changes will be announced via a site notice and, where required, by email. The "Last updated" date at the top reflects the most recent revision.

Questions, requests, or complaints: [email protected].

Postal: Gameplug LLC, 30 N Gould St, Ste R, Sheridan, WY 82801, United States. EU representative under GDPR Art. 27 (when required): contact us at the address above for the current designation.