Privacy policy

We only keep what an order or an account needs to work.

• Account: your name, email address, optional phone number, the country you signed up from (read from your connection), and whether two-step verification is on. Passwords are stored only as a one-way hash.
• Sign in with Google: if you use it, Google sends us your name, email address and profile picture. We do not receive your Google password and we do not read anything else from your Google account.
• Orders: what you bought, the price, the payment method, and the codes we delivered to you.
• Details for your order: what checkout asks for an item — a player ID, a server, or the email and password of your own game account when we add something to it, and any one-time code we ask you for. Passwords, backup codes and one-time codes are encrypted and seen only by the team member completing your order, and every time they are opened is recorded. We remove all of it a few days after your order is delivered (a one-time code 10 minutes after you send it).
• Payment proof: the transaction ID and the sender number or reference you enter when you pay by mobile wallet, bank transfer or crypto, plus any screenshot you upload.
• Stock alerts: if you ask to be emailed when something is back, we keep the product and your email address. Without an account we email you once to confirm first, and nothing more is sent unless you confirm; an unconfirmed request is deleted after 7 days. The link in that email stops the alert at any time.
• Saved payment details: only if you tick “Remember this number for next time” when you pay, we keep that payment method and the number you paid from, encrypted, so we can fill it in for you next time. It is not shown to our team. You can remove it in your account settings at any time, and it is deleted with your account.
• Reseller applications: business name, applicant name, contact details, national ID or passport number, business type, trade licence and address. We ask for these because wholesale accounts carry a credit line.
• Technical: the IP address and device of each sign-in (used to decide when a sign-in needs a second factor), error reports, and the cookies described below.

• To deliver what you bought and show it to you again later in your account.
• To match a payment to an order and to investigate a disputed or failed one.
• To send order emails — confirmation, payment received, delivery, refunds.
• To keep your account secure and to spot fraud or abuse.
• To verify wholesale partners before extending credit.

We do not sell your data, and we do not send marketing email you did not ask for.

We set a session cookie when you sign in, a cookie that remembers your cart, and a short-lived one that carries a “buy now” intent through checkout. Ticking “keep me signed in” or “trust this device” sets a longer-lived cookie so you are not asked again on that device. There are no advertising or cross-site tracking cookies.

Your data lives with the services that run the store:

• Supabase (Singapore) hosts the database; Vercel runs the site.
• Cloudflare R2 stores product images and uploaded payment screenshots.
• ZeptoMail sends our email; Google handles sign-in if you choose it.
• Sentry receives error reports, which may include your account ID.

Inside GifoMart, only team members whose role requires it can see orders, payments or applications, and every look at a delivered code is logged. We share data with a payment provider only to confirm a transaction, and with authorities only when the law requires it.

Order, payment and refund records are kept for as long as we are required to keep accounting records. Orders that are never paid expire automatically. Reseller application documents are kept while the account exists.

• You can edit your name, phone and password in your account at any time.
• You can remove saved payment details in your account settings at any time.
• You can ask us to delete your account. We will remove it, keeping only the order records we must retain.
• You can ask for a copy of the data we hold about you.
• Unlinking Google from your account removes the link, not your orders.

Questions about this policy or your data: support@gifomart.com. Our terms of service are at gifomart.com/terms.