Privacy Policy

1. Data We Collect

• Account info: name, email address, username, and password (hashed).
• Payment data: Bitcoin/crypto wallet transaction IDs (we do not store card numbers).
• Order info: purchased product SKUs, delivery emails, redemption codes.
• Device & usage data: IP address, browser type, OS, pages visited, timestamps.
• Communications: support tickets and emails you send us.

2. How We Use Your Data

• To process orders and deliver digital products (gift cards, eSIMs, top-ups).
• To send transactional emails (order confirmations, redemption codes, support replies).
• To detect fraud, prevent abuse, and comply with legal obligations.
• To improve site performance and product recommendations based on aggregated, anonymized analytics.

3. Legal Basis for Processing (GDPR)

• Contract performance — processing is necessary to fulfill your orders.
• Legitimate interests — fraud prevention, security, and service improvement.
• Legal obligation — compliance with tax, AML, and applicable regulations.
• Consent — where required (e.g., marketing emails), you may withdraw consent at any time.

4. Cookies & Tracking

• Essential cookies: required for login sessions, cart state, and security tokens.
• Analytics cookies: we use privacy-respecting analytics to measure page performance (opt-out available in Cookie Settings).
• No third-party advertising cookies are placed without your explicit consent.
• You can manage cookie preferences via our Cookie Settings panel or your browser settings.

5. Third-Party Sharing

• Payment processors (Bitcoin/Lightning network nodes) — receive only transaction IDs, not personal data.
• Cloud hosting providers (data stored in EU/US regions under DPA agreements).
• Email delivery services — receive your email address solely to send order confirmations.
• We do not sell, rent, or broker your personal data to any third party for marketing purposes.

6. Your Rights (GDPR & CCPA)

• Access: request a copy of all personal data we hold about you.
• Correction: ask us to correct inaccurate or incomplete data.
• Deletion: request erasure of your data where no legal retention obligation applies.
• Portability: receive your data in a structured, machine-readable format.
• Opt-out of sale (CCPA): we do not sell personal data — no opt-out is needed.
• Lodge a complaint with your national data protection authority at any time.
• To exercise any right, email: [email protected].

7. Data Retention

We retain account and order data for up to 7 years to comply with tax and financial regulations. Analytics data is anonymized after 26 months. You may request deletion of non-legally-required data at any time.

8. Security

All data is encrypted in transit (TLS 1.3) and at rest (AES-256). We apply least-privilege access controls, regular penetration testing, and strict internal data handling policies. No transmission over the internet is 100{9a0af3c4de7acc560d0b7df0cca54b58c84f453e626d151ad61db70ce6911914} secure; we implement industry-standard safeguards.

9. Children's Privacy

bitrefill services are not directed at children under 16. We do not knowingly collect personal data from minors. If you believe a minor has submitted data, contact us immediately at [email protected] and we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be communicated via email or a prominent site notice at least 14 days before taking effect. The date of the latest revision appears at the top of this page.

11. Contact & Data Controller

• Data Controller: Bitrefill AB, Regeringsgatan 29, 111 53 Stockholm, Sweden.
• Privacy inquiries: [email protected]
• Response time: within 30 days of receiving your request.
• DPO contact (EU): [email protected]