1.Who is responsible
The controller for your personal data is Global Gift Trade LLC, 53 Ilia Vekua St, Tbilisi 0159, Georgia.
Questions about your data: [email protected] or support in your account.
2.What this policy covers
This policy explains which data we collect when you visit giftcard.vision, open an account, sell a card or key, withdraw your balance or contact support, why we need it, who else receives it and what rights you have.
3.What we collect
Account: your email address, a hash of your password (never the password itself), whether your email is confirmed, your two-factor secret if you turn it on (stored encrypted), and your account settings.
Orders: the brand, country and value of each card, the codes and PINs you submit (stored encrypted), photos of physical cards and receipts you upload, the amount we offered and the result of the check.
Payouts: the wallet addresses, networks and memos you save, and every payout with its amount, date and transaction.
Balance: every credit and debit on your balance, so that it can always be traced.
Support: your messages, any files you attach and our replies.
Security and technical data: the IP address you signed up and logged in from, your browser, your active sessions, failed logins and server logs.
Usage statistics: which pages are visited, where visitors came from (for example a search engine or a link), the type of device and browser, and the steps of selling and paying out, such as sign-ups, orders and payouts with their amounts.
4.Why we use it
To run your account and carry out the sales you ask for: checking and selling your codes, crediting your balance, sending payouts and answering support. This is necessary to perform our contract with you.
To keep the site and your account secure and to stop fraud, for example by spotting stolen cards, repeated rejected codes or one wallet used by several accounts. This is our legitimate interest and yours.
To meet our legal duties, in particular under anti-money-laundering law and tax and accounting rules.
To send you emails about your account: confirmations, order and payout updates, security notices and changes to our terms. We don't send advertising emails.
To understand how the site is used and improve it, for example which pages people leave on or where selling gets stuck. This is our legitimate interest.
5.Card codes
Codes and PINs are encrypted the moment you submit them. Inside our team only the staff who process orders can see them. We pass each code only to the company that buys the card from us. 30 days after an order is finished, we delete its codes, PINs and photos. What stays is the order itself (brand, value, amount, result) without the code.
6.Who we share it with
The company that buys the cards from us receives the codes and photos it needs to redeem them, and nothing else about you.
Payouts are sent through the blockchain you choose. A blockchain transaction is public by nature: the receiving address and the amount can be seen by anyone.
Service providers process data on our behalf and only on our instructions: our hosting provider in the EU runs our servers and database, Cloudflare protects and delivers the website, Resend sends our emails, and PostHog gives us usage statistics.
Authorities, courts and card issuers receive data only when the law requires it or when we need it to report or stop fraud.
We don't sell your data and we don't share it for advertising.
7.Transfers outside your country
Our company is in Georgia, our servers are in the EU, and some providers, such as Cloudflare, Resend and PostHog, may process data in other countries, including the United States. Where that happens, we rely on the safeguards the law provides, such as standard contractual clauses.
8.How long we keep it
Codes, PINs and photos of cards: 30 days after the order is finished.
Account data: as long as your account exists.
Orders, balance movements and payouts: as long as anti-money-laundering, tax and accounting law requires, at least five years after the transaction, then we delete them.
Server logs and failed logins: only as long as we need them for security.
9.Deleting your account
When you delete your account, we remove your email address, password, two-factor secret and sessions, and deactivate your saved wallets. Orders, balance movements and payouts, including the addresses paid to, stay in our books without your email, because the law requires us to keep them. You can delete your account yourself in the settings once your open orders and payouts are finished.
10.Cookies
We use one cookie, which keeps you logged in. It is necessary for the site to work and lasts up to 30 days, or until you log out. We use no advertising or tracking cookies.
11.Usage statistics
We measure how giftcard.vision is used with PostHog. It runs without cookies and stores nothing in your browser: when you close the tab, the visit can't be recognised again. Your IP address is anonymised before it is stored, and PostHog doesn't record what you type.
When you are logged in, the statistics are linked to your account id (not your email), so we can see which steps of selling and paying out work and which don't. If your browser sends a “Do Not Track” signal, no usage statistics are collected in the browser.
The statistics are stored by PostHog in the United States. We keep them only as long as we need them to improve the site; you can ask us to delete the statistics linked to your account at any time.
12.Security
Connections to giftcard.vision are encrypted. Passwords are stored as hashes, codes and two-factor secrets are encrypted, and access to customer data inside our team is limited to what each person needs. No system is completely secure, so please use a strong password and turn on two-factor authentication.
13.Your rights
You can ask what data we store about you and get a copy of it. Most of it you can download yourself in the settings.
You can have wrong data corrected, have data deleted when we no longer need it, restrict its use, object to its use for our legitimate interests, and receive your data in a common format.
To use a right, write to [email protected] from the email address of your account. You can also complain to Georgia's Personal Data Protection Service or to the data protection authority where you live.
14.Children
giftcard.vision is only for people aged 18 or older. We don't knowingly collect data from children. If you think a child has opened an account, please tell us and we will delete it.
15.Changes to this policy
If we change how we use your data, we update this policy and the date above. Important changes we announce by email before they apply.