Privacy Policy

Last updated: October 19, 2026

UTop.us sells digital goods: game cards, gift cards, prepaid cards, top-up codes, license keys and vouchers. We built the store to work with as little personal data as possible. This policy explains what we collect, why, who we share it with, how long we keep it, and how you control it.

The short version

  • We collect only what we need to sell and deliver your order, keep the service secure, and meet our legal obligations.
  • You don't need an email address. You can shop with an anonymous account or as a guest.
  • We never sell, rent or trade your data, and we don't run advertising, ad targeting or cross-site tracking.
  • We send no marketing email. Every email we send relates to your account or an order.
  • You're in control. You can see your data, correct it and delete your account yourself from your account settings.

Who we are

UTop.us is the controller of the personal data described in this policy. You can reach us about privacy through our support page.

Ways to use UTop.us

How much data we hold depends on how you shop:

  • Anonymous account: a random 16-character ID that we generate for you. We don't ask for an email address.
  • Registered account: your email address, or your verified Google email if you sign in with Google.
  • Guest checkout: no account. We keep the email you enter for the order so we can send your codes and confirmations.

Your anonymous ID is the only way into an anonymous account. Store it somewhere safe: we can't recover it for you, and anyone who has it can sign in. You can add an email to an anonymous account at any time. If you later register with the same email you used as a guest, we add your earlier guest orders to the new account.

What we collect

Information you give us

  • Account details: your email address or anonymous ID, plus your preferred language.
  • Orders: order number, items, any details a product needs (for example a game account ID), currency, prices, discounts, status, and the payment method you chose.
  • Support messages: what you send through our support system, and our replies.
  • Reviews: your rating, your text, and the order the review relates to.
  • Live chat: what you type, if you choose to start a chat.

Information created when you use the service

  • Purchased codes: stored encrypted and shown only to the order owner once payment is confirmed.
  • Balances: wallet, gift card and reward point balances, with a record of every transaction.
  • Payment status: what the payment provider reports back to us, such as a transaction reference and whether the payment succeeded. We never receive or store card numbers, bank login details or crypto wallet private keys.
  • Emails we send you: a record of each transactional email and whether it was delivered.
  • Customer group: used to apply automatic discounts.

Information collected automatically

  • IP address. Used for security, rate limiting, fraud prevention and choosing your currency.
  • Approximate location (country or city), worked out from your IP address. We never collect GPS or precise device location.
  • Browser and device details, such as browser type, operating system and language. We use them to show pages correctly and to secure your session.
  • Activity on our site: pages you view, searches and your cart contents. This powers the shopping experience and the live activity counters. Search records store your IP address only in hashed form.
  • Error reports. When something breaks, a technical report goes to our own error-tracking system. Cookies, sign-in data, IP addresses and email addresses are removed before the report is stored.

How we use information, and why we are allowed to

  • Creating your account, taking payment, and delivering your codes, balances and gift cards. Legal basis: performing our contract with you.
  • Transactional emails (sign-in codes and links, order and payment updates, code delivery, refunds, support replies, review requests after a completed order). Legal basis: performing our contract with you; legitimate interest for review requests.
  • Customer support. Legal basis: performing our contract with you.
  • Preventing fraud, abuse, bots and account takeover, and keeping the service secure. Legal basis: legitimate interest.
  • Fixing errors and improving reliability and performance. Legal basis: legitimate interest.
  • Accounting, tax and other legal record-keeping. Legal basis: legal obligation.
  • Optional cookies and live chat. Legal basis: your consent, which you can withdraw at any time.

Automated security checks

To protect customers and the store, we automatically limit repeated attempts and screen for abuse. For example, we may ask for a human verification check, temporarily block an IP address after many failed attempts, or hold an unusual payment for manual review. These checks never decide anything about you beyond access to and use of the service. If you think a check has blocked you by mistake, contact support and a person will review it.

Who we share data with

We share data only when it's needed to run the service or when the law requires it. Each recipient gets only what it needs.

  • Payment providers (crypto gateways, card and bank gateways, UPI and other regional processors) receive the order reference and amount, and whatever else they need to process and confirm your payment. They handle your payment details under their own privacy policies.
  • Our voucher supplier receives the order and product details needed to issue your code. It doesn't receive your email address.
  • Email delivery providers send our transactional emails.
  • Cloudflare delivers and protects the site. It runs our human verification widget (Turnstile) and provides cookie-free, aggregated traffic statistics that don't identify individual visitors.
  • IP check services (ip-api.com, with vpnapi.io as a backup) receive an IP address to detect VPN, proxy and hosting traffic for security. We don't send them any other data.
  • Cloud storage (Cloudflare R2) hosts site images and media. It holds no customer data.
  • Exchange rate providers supply currency rates. We send them no personal data.
  • Google, only if you choose to sign in with Google.
  • Our live chat provider, only if you start a chat. It receives what you type.
  • Authorities, only when a valid legal request requires us to disclose specific data.

We don't sell, rent or trade personal data, and we don't allow third-party advertising trackers.

Cookies and local storage

We use a small number of cookies, grouped as follows:

  • Essential (always on): sign-in and session cookies, the guest cart cookie, security tokens, short-lived order access cookies that let a guest open their order and payment pages, and the cookie that remembers your cookie choices. The site can't work without them.
  • Functional (optional): features you can choose to enable, such as live chat.
  • Analytics (optional): used to understand how the site is used.

You can change your choices at any time through Cookie Settings. We use no advertising or cross-site tracking cookies. Cloudflare's traffic statistics work without cookies.

How we protect data

  • All traffic is encrypted with HTTPS.
  • Purchased codes, gift card codes and stored credentials are encrypted at rest.
  • Each order carries an integrity check, verified again before any code is delivered, so an altered order can't be fulfilled.
  • Signing in starts a new session and ends your previous ones. You can see and end active sessions from your account.
  • Sign-in and other sensitive actions are rate limited, and sensitive forms use human verification.
  • Security and financial events are recorded in separate audit logs.

No system is perfectly secure. If you think someone else has used your account, sign in, end your active sessions and contact support.

How long we keep data

We keep data only as long as we need it:

  • Account: until you delete it.
  • Cart: short-lived; cleared after inactivity or when you delete your account.
  • Live visitor counters: a few minutes.
  • Sign-in codes and links: minutes to one day, then deleted.
  • Sign-in sessions: until they expire or you sign out.
  • Search history: removed automatically after a limited period.
  • IP check results: about a week.
  • Technical logs: generally around 30 days.
  • Security audit records: up to one year.
  • Orders, payments, wallet, gift card and reward records: as long as tax, accounting and fraud-prevention law requires, even after account deletion, with your personal details removed.

Your rights

Depending on where you live, you may have the right to:

  • access the personal data we hold about you
  • correct inaccurate data
  • delete your data
  • object to or restrict some processing, including processing based on legitimate interest
  • receive your data in a portable format
  • withdraw consent for optional cookies or live chat at any time
  • complain to your local data protection authority

You can do most of this yourself from your account. For anything else, contact us through support. We may need to confirm the account is yours before acting on a request.

Deleting your account

You can delete your account yourself from your account settings, without contacting support. Deletion has to wait while an order is still being paid, processed or reviewed. You can cancel an unpaid order first where the page offers that option.

When you delete your account:

  • Your profile, sign-in data, sessions, linked Google sign-in and cart are removed.
  • Past orders are kept for legal reasons, with your personal details removed so they no longer identify you.
  • Wallet and reward transaction records are kept for audit reasons, without your personal details.
  • Any unused wallet balance, reward points or store credit is lost, unless the law says otherwise. We ask you to confirm this first.
  • Deletion is permanent and can't be undone.

Children

UTop.us is not for anyone under 18, or under the age of majority where you live. We don't knowingly collect data from minors. If you think a minor has given us data, contact support and we will remove it.

International transfers

Some of our providers, such as payment gateways, email delivery and Cloudflare, may process data outside your country. When that happens, we rely on the legal safeguards those providers offer, such as standard contractual clauses, and we limit what we share to what the service needs.

Changes to this policy

We may update this policy. The current version is always on this page, and the date at the top shows the last change. If a change significantly affects how we handle your data, we will tell you clearly on the site before it takes effect.

Contact

For privacy questions or requests, contact us through our support page.