Privacy notice

Here is how TopUpVCC (“we”, “us”) treats personal data in the app at topupvcc.com: what we collect, what we do with it, who else gets it, how long it stays and what you can ask us to do.

Who handles your data

TopUpVCC decides how your personal data is used and answers for it. Send privacy questions to [email protected].

What we collect

Account

Name and email, your password (we keep only a one-way hash of it), your sign-up date, and a flag showing whether you confirmed your email.

Sign-ins

The secret behind your authenticator and your recovery codes, both encrypted, plus a sign-in log: when, from which IP address, on which browser and system, and on what kind of device. The log protects the account and lets us warn you about a new device.

Top-ups and payments

The card balance and fees you chose and the payment option you used. For checkout payments, what the provider reports back: payment ID, amount, currency and time. For wallet transfers, the TXID you enter and any screenshot you add. For money-back requests: the reason you write and where you want the payout sent.

Cards

Each card's number, CVV, expiry, holder name, billing address and balance. The number, CVV and expiry are kept encrypted and appear only once you type a fresh authenticator code.

Messages

Anything you write in a help ticket or the contact form on the support page, and our replies.

Server logs

Standard request logs (IP address, page, time and browser), kept for security and troubleshooting.

What we use it for

• Running your account and issuing your cards. This is needed to perform our contract with you.
• Checking payments and keeping accounts safe. Stopping fraud and abuse is a legitimate interest of ours and, at times, something the law obliges us to do.
• Service emails. Address confirmation, receipts, card and money-back news and security alerts. They belong to the service, so they stay on as long as you have an account.
• Answering you when you ask for help.
• Meeting legal duties in tax, accounting and regulation, and responding to lawful requests from authorities.

We don’t sell personal data, and we don’t hand it to anyone for their advertising.

Who else receives it

• Card issuers receive just enough to create, operate, pause or close your cards and to handle money-back payouts.
• Payment providers receive your name, email, the top-up reference and the amount for checkout payments, so they can collect the payment. What you type on their page is covered by their own privacy policy.
• Hosting and email services run the servers for our app and database and deliver our emails, and their contracts oblige them to protect the data.
• Bot protection, such as Cloudflare Turnstile, checks that a person rather than a script is using the sign-up, sign-in, reset and contact forms.
• Telegram, only if you choose to reach support there. Telegram’s own policy covers those chats.
• Authorities and courts, where the law demands it, or where we must defend our rights or shield customers and the public, such as by reporting fraud.
• A new owner, if the business is sold or reorganized, with the same level of protection.

Public blockchains

Every crypto payment is written to a public ledger. The wallet addresses and amounts in it are visible to the world, and we can’t edit or erase those records.

How long it stays

• Account, top-up, card and money-back records: for the life of your account, then as long as bookkeeping, tax and fraud-prevention rules demand. In most countries that means five to seven years.
• Sign-in log: 180 days.
• Payment screenshots: until the top-up and any dispute about it are closed, then deleted.
• Support-page messages from people with no account: two years at most.

How we protect it

HTTPS on every page; card details and sign-in secrets stored encrypted; an authenticator required of every customer and staff member; rate limits; tight access rules; a private store for uploads; and a record of everything staff do. No system is flawless; should a breach affect you, we will let you know, and inform the authorities when the law calls for it.

Your choices and rights

Your local law may give you the right to a copy of your data, to correct it, to have it deleted, restrict or object to certain uses, receive it in a portable format, or take back consent you gave us. The law makes us keep certain records even when you ask for deletion. Want to exercise one? Email [email protected] from your account's address. A complaint to your data-protection regulator is always open to you as well.

Cookies

We use only what the app needs: one cookie for your signed-in session, one that protects forms against forged requests, and, when bot protection runs, the cookies that check requires. Payment provider pages set their own. We use no advertising or cross-site tracking cookies.

Data outside your country

Some of the companies we work with handle data outside your country. Where the law asks for it, standard contractual clauses or similar safeguards cover those transfers.

Children

The app is for adults. We don’t knowingly collect data from anyone under 18.

Updates to this notice

Each new version appears here with its date. Significant changes are also announced by email or in your Inbox.