Privacy policy

The operator of personal data is [the seller identified on the contact page](/legal/contacts). Privacy requests may be sent to the address on [the seller’s contact page](/legal/contacts).

Data we process

The storefront processes the email address attached to an account, identifiers supplied by an authentication provider, session and one-time sign-in data, order and payment identifiers, ordered credit amounts, prices, currencies, payment statuses, consent records, and security and technical logs such as time, request path, source address and user agent.

Payment card details are entered on the payment provider's page and are not received or stored by the storefront. Gift card codes are kept by the card issuer and are requested by the storefront only when a paid card must be shown or emailed.

Why we process it

The data is used to create and protect the buyer's account, authenticate the buyer, accept and reconcile payment, issue and deliver gift cards, show order history, send fiscal receipts and service messages, prevent abuse, investigate failures and disputes, comply with accounting and legal duties, and answer privacy requests.

The legal grounds may include performance of the contract, legal obligations, legitimate interests in security and fraud prevention, and the buyer's consent where consent is required.

Recipients

Data is disclosed only as needed to operate the purchase: to the authentication and email providers used by the buyer, to ЮKassa for payment and fiscal receipts, and to infrastructure processors. The gift card issuer receives the card amount and an idempotency identifier, but not the buyer's email address or storefront account.

Retention and rights

Account and order data is kept while the account is used and for the periods required for accounting, consumer claims, fraud prevention and other legal duties. Short-lived authentication records expire automatically. Technical logs are retained only for operating and securing the service.

The buyer may request access, correction, deletion, restriction or withdrawal of consent by writing to the address on [the seller’s contact page](/legal/contacts). A request does not require deletion of records that the operator must retain by law or needs to establish, exercise or defend legal claims.