Privacy Policy

We collect only what is needed to quote, verify, and pay an order:

• Email address, to identify your orders and send one-time verification codes.
• Gift card details: brand, region, face value, and the card code or PIN you submit.
• Card photos, for physical cards: a photo of the back of the card. Location and camera data are removed before it is stored.
• Payout destination: the wallet address, PayPal email, or, for bank transfers, the IBAN and account holder name.
• Order messages: anything you send us on an order's tracking page, including photos.
• Basic technical data, such as a session cookie that keeps your quote and order linked to your browser, and standard server logs.

We do not ask for your address or identity documents. We only ask for a name when you choose a bank transfer, because the bank needs the account holder's name.

• To calculate quotes, create orders, and lock your rate.
• To verify cards and prevent fraud, including detecting stolen or already-used cards.
• To send your payout and let you track the order.
• To email you about your order: confirmation, requests for information, messages from our team, and payout or rejection notices.
• To reply when you contact support.

Card codes, PINs, card photos, order messages and their photos, and bank details (IBAN and account holder name) are encrypted (AES-GCM) before they are stored. They are never written to your browser storage or to our logs, and are only seen by our review team — in the admin tool and in the team's private order notifications. After submission, the site only shows a masked suffix of each code and of the IBAN.

We will never ask for a card code by email. If someone does, it is not us.

We do not sell your data. We share it only with service providers we use to run KartaCash, and only as needed:

• hosting and network infrastructure (Cloudflare);
• database, file storage and email sign-in (Supabase);
• order emails (Resend), which receives your email address and the order summary — never card codes, photos, or payout addresses;
• our team's private order notifications (Telegram), which include the submitted card codes so we can verify them quickly — never your email address or payout details;
• the payout network or provider you choose (for example the blockchain for crypto payouts, or PayPal);
• authorities, when the law requires it.

Blockchain transfers are public by nature: the destination address and amount of a crypto payout are visible on the blockchain.

Order records are kept for as long as needed to complete the order, handle disputes, and meet legal and anti-fraud obligations. You can ask us to delete data that we are not required to keep.

You can ask for a copy of the data linked to your email, ask us to correct it, or ask us to delete it, by writing to support@kartacash.com from that email address.

This site is operated by KartaCash. Privacy questions can be sent to support@kartacash.com.