Privacy Policy

1. Information We Collect

We collect information necessary to provide our exchange services and comply with federal financial regulations.

Information you provide directly:

• Email address (required for all trades)
• First name (optional, for account holders)
• Gift card details (card number, PIN, face value, brand)
• Cryptocurrency wallet address
• For trades over $200: a photo of your gift card
• For trades over $500/day: a government-issued photo ID
• Password (hashed using bcrypt — we never store your plain-text password)

Information collected automatically:

• IP address (required for compliance and fraud prevention)
• Browser type and operating system
• Transaction timestamps and order identifiers
• Session cookies (for account authentication)

2. How We Use Your Information

• To process your transactions — verifying gift card balances, dispatching cryptocurrency payouts, and delivering gift card codes
• To comply with federal law — obligations, sanctions screening, SAR filing, and record-keeping required under Part 1022
• To communicate with you — order confirmations, payout notifications, and support responses
• To prevent fraud — detecting and blocking fraudulent submissions
• To maintain account functionality — authentication, saved wallets, order history

We do not sell your personal information to third parties. We do not use your data for advertising or marketing to third parties.

3. Who We Share Your Information With

We share your information only when necessary and only with the following categories of recipients:

• Government authorities: (SAR filings), (sanctions compliance), and law enforcement when required by valid legal process
• Payment processors: NOWPayments (cryptocurrency disbursement) — your wallet address is shared to facilitate your payout
• Identity verification: Stripe Identity (for government ID verification on high-value trades) — governed by Stripe's privacy policy
• Email delivery: Zoho Mail SMTP (for transactional emails) — your email address is shared to deliver order notifications
• Infrastructure: Vultr (hosting provider) — processes data on our behalf under a data processing agreement

We do not share your information with data brokers, advertisers, or social media platforms.

4. Data Retention

We retain transaction records, including identity documents submitted for KYC, for five years from the date of the transaction. This is the minimum retention period required by § 1022.430 ( record-keeping requirements for money services businesses).

Gift card numbers and PINs are purged from our systems within 24 hours of order completion. We do not retain full card credentials beyond the verification window.

Account data (email, password hash, transaction history) is retained as long as your account is active. You may request deletion of your account — see Section 7.

5. Security

We use industry-standard security measures to protect your information:

• TLS 1.3 / AES-256-GCM encryption for all data in transit
• AES-256 encryption for sensitive data at rest
• bcrypt password hashing (cost factor 12)
• enterprise-grade certified infrastructure (Vultr)
• Role-based access control and multi-factor authentication for all administrative access

No system is 100% secure. In the event of a data breach, we will notify affected users within 72 hours and report to applicable authorities as required by law.

6. Cookies and Tracking

We use a minimal set of cookies necessary for the Platform to function:

• Session cookie (cv_session): Required to maintain your login state. Expires in 30 days. This is a strictly necessary cookie and cannot be disabled if you use an account.

We do not use advertising cookies, tracking pixels, or third-party analytics tools that share your data with external parties. We do not use Google Analytics.

7. Your Rights

You have the following rights regarding your personal information:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate data
• Deletion: Request deletion of your account and associated data (subject to our mandatory 5-year retention obligation — transaction records cannot be deleted)
• Portability: Request your transaction history in a machine-readable format

To exercise any of these rights, email support@giftcardsforcrypto.com. We will respond within 30 days. Identity verification may be required before processing requests.

Note: We cannot delete transaction records within the 5-year retention window, even upon request. This is a federal regulatory requirement, not a discretionary policy.

8. Children's Privacy

Our Platform is not directed at individuals under 18 years of age. We do not knowingly collect personal information from anyone under 18. If we become aware that a minor has submitted information, we will delete it promptly. Contact us at support@giftcardsforcrypto.com if you believe a minor has used the Platform.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated by email to registered users and posted on this page with an updated effective date. Continued use of the Platform after any update constitutes acceptance of the revised policy.

10. Contact

GiftCards for Crypto LLC — Privacy Inquiries
Tallahassee, FL 32301
Email: support@giftcardsforcrypto.com
Response time: Within 2 business hours Monday–Friday, within 30 days for formal privacy requests.