Privacy Policy

This policy describes the personal data BuyVCC handles when you visit buyvcc.net, open an account, order a card or contact us. We keep it as short as the subject allows. If a word here is unclear, write to support@buyvcc.net and we will explain it.

The short version

• We collect what we need to run accounts, take payments, issue cards and keep the service safe — not more.
• Every card number, CVV and expiry date is encrypted at rest and appears only after a fresh two-factor code.
• We do not sell personal data, and the website carries no advertising or analytics trackers.
• We share data only with the partners that make the service work, and with authorities when the law requires it.

What we collect

When you create and use an account

Your name, email address and password (kept only in hashed form, which cannot be reversed), plus the secret that links your authenticator app (stored encrypted). Each sign-in attempt is recorded with its time, IP address, browser, operating system, device type and whether it succeeded. We use this record to warn you about sign-ins from new devices and to investigate suspicious access.

When you order and pay

The balance you chose, the fees and total, the name you asked to appear on the card, and the order's status history. From our payment partner we receive a payment reference, the amount and currency that arrived, and the time of payment. We do not receive your wallet's private keys or your exchange login, and you never type card or bank details on our site.

When a card is issued

Whatever the card program supplies for the card: its number, CVV, expiry, the holder name, the billing address and the balance. The number, code and expiry date are encrypted in our database. We also log each time the full details are displayed, so unusual access can be spotted.

When you ask for a refund or contact us

For refunds: why you are asking, plus the wallet address and network you want the money sent to. For support tickets and the contact form: your name, email address, the subject and message, and for the contact form also the IP address and browser it was sent from, which helps us filter spam.

Cookies and local storage

We use a session cookie to keep you signed in and a security cookie that protects forms from cross-site attacks. If you pick a light or dark theme, the choice is saved in your browser's local storage. When bot protection is switched on, Cloudflare Turnstile may process technical data about your browser to tell people from automated traffic. We do not use cookies for advertising.

Why we use it

• To provide the service you asked for: running your account, processing orders, issuing cards, handling refunds and answering questions.
• To keep accounts and cards safe: two-factor sign-in, new-device alerts, fraud checks during order review and rate limits against automated attacks.
• To meet legal duties: keeping financial records and responding to lawful requests from authorities.
• To tell you what is happening: emails and dashboard notifications about your orders, cards, refunds, tickets and security. While your account is open these service messages stay on, because they protect you. We do not send marketing email.

Who else sees it

We share personal data only as far as each party needs it:

• Our payment partner, which runs the crypto checkout and receives the order reference, total, your name and your email address.
• Card issuing partners, which supply the cards and may need holder and billing details or usage information.
• Hosting and email providers, which store the service's data and deliver its emails on our behalf.
• Cloudflare, when Turnstile bot protection is enabled on forms.
• Authorities and courts, when the law requires us to disclose information, or when it is needed to investigate fraud or protect people from harm.

Some of these providers process data in other countries. Where that happens we rely on their contractual commitments to protect it.

How long we keep it

Account data stays while your account is open. Sign-in records are deleted automatically after 180 days. Order, payment, card and refund records are financial records, so we keep them for as long as accounting rules, our partners or the law require, even after an account is closed. Support tickets and contact messages are kept while they are useful for helping you and then deleted. Encrypted card details of closed cards are kept only as long as the card program or the law requires.

How we protect it

The site runs only over HTTPS. Card details and authenticator secrets are encrypted with a key that is kept apart from the database. Staff accounts sit behind their own sign-in with mandatory two-factor authentication, and actions taken in the admin area are written to an audit log. No system is perfectly secure, but if we ever learned of a breach affecting your data, we would tell you and the relevant authority as the law requires.

Your choices and rights

Depending on where you live, you can ask us to show you the personal data we hold about you, to correct it, to delete it, to limit or object to some uses, or to give you a copy in a common format. If you are unhappy with our answer, your local data protection regulator can take a complaint. Send requests to support@buyvcc.net from the email address on your account so we can confirm it is really you. Some data cannot be deleted while we are legally required to keep it; if that applies, we will say which records and for how long.

Children

The service is only for adults. We do not knowingly collect data from anyone under 18, and we close accounts that we find belong to a minor.

Changes

When this policy changes, the "last updated" date at the top of the page changes too. If a change affects how we use data you have already given us, we will let you know by email or in your dashboard before it applies.