Privacy Policy

This notice explains the personal information ReloadableVCC ("we") processes when you use reloadablevcc.com: the categories, the purposes, the recipients and your options.

Controller and contact

ReloadableVCC acts as data controller for everything described below. Privacy questions and requests go to [email protected].

Information we hold

Account basics

Name, email address, a hashed (non-reversible) form of your password, your sign-up date and the confirmation status of your email.

Sign-in security

Your two-step sign-in secret and backup codes, both encrypted, plus a record of every sign-in attempt (when it happened, from which IP, and the browser, system and kind of device involved). That record is used to protect the account and to warn you when an unfamiliar device appears.

Requests and payments

For each card request or reload: amounts, fees, payment method and status. With hosted checkout, the confirmation passed to us by the payment provider (its payment ID, the sum and currency received, and the time). With manual transfers, the transaction ID you enter and any screenshot you choose to upload. With refunds, your stated reason and the payout destination and network.

Card records

For cards issued to you: card number, security code, expiry, cardholder name, billing address and balance. Numbers, security codes and expiry dates are held in encrypted form and displayed to you only once a current authenticator code has been entered.

Correspondence

Messages you send via tickets or the contact page, and the replies we write.

Server logs

Our web server notes the IP, page, moment and browser of each visit; these entries help us block abuse and track down bugs.

Purposes

• Operating your workspace and supplying the cards and reloads you ask for, which our contract with you requires.
• Verifying payments, preventing fraud and misuse and securing accounts, as a legitimate interest and, in places, a legal requirement.
• Service messages, for instance confirmation links, updates on requests and cards, refund outcomes and security warnings. These belong to the service and continue while your account exists.
• Answering your messages.
• Complying with accounting, tax and regulatory law and with lawful demands from public bodies.

Selling personal information is not something we do, nor do we use it for advertising on behalf of third parties.

Recipients

• Issuing partners, as required to issue, reload, manage, freeze or close cards and to process refunds.
• Payment providers (PayerURL, for example) when you choose hosted checkout. They get your name, email address, the request reference and the amount in order to take the payment; information you type on their pages falls under their own policies.
• Hosting and email vendors running our site, database and mail delivery, contractually bound to safeguard the data.
• Bot-detection services, such as Cloudflare Turnstile, verifying that real people use our registration, login, password and contact forms.
• Chat apps you decide to reach us through, governed by their own policies.
• Public authorities, courts and similar bodies when the law demands it, or when disclosure is needed to defend our rights, our customers or others, fraud reports included.
• A purchaser or successor organisation in a sale or restructuring, bound by equivalent protections.

A note on blockchains

Crypto transfers are permanently recorded on public ledgers. Wallet addresses and amounts written there are visible to anyone, are beyond our control and cannot be edited or erased by us.

Retention

• Account, request, reload, card and refund records: throughout the life of your account, then for the period accounting, tax and fraud-prevention law requires (generally five to seven years, by jurisdiction).
• Sign-in log: 180 days.
• Payment screenshots and other uploads: until the related request and any dispute are resolved, then removed.
• Payment provider notifications: 180 days in our payment log, for troubleshooting.
• Contact-page messages from non-customers: a maximum of 24 months.

Security measures

Protections include HTTPS, encryption of card data and sign-in secrets at rest, compulsory two-step sign-in for customers and staff, rate limiting, access control, private storage for uploaded files and a record of staff actions. No setup removes all risk, yet we keep working to reduce it, and we will notify you and the competent authority of a breach whenever the law says we must.

Your rights

Subject to the law where you live, you can request access to your information, its correction or erasure, a restriction of or objection to certain processing, a copy in a portable format, and the withdrawal of any consent you gave. Legal obligations sometimes require us to retain records despite an erasure request. Send requests to [email protected] using the address linked to your account. Complaints may also be lodged with your national data-protection regulator.

Cookies

Only essential cookies are set: one session cookie to keep you logged in, one security cookie guarding forms and, while bot detection is enabled, whatever that service needs. Payment providers' pages place cookies of their own. Advertising cookies and cross-site trackers are not used.

International transfers

Some suppliers handle data in other countries. When rules demand it, such transfers are covered by approved safeguards, standard contractual clauses being one example.

Minors

Customers must be 18 or older, and information about younger people is never knowingly collected.

Revisions

Revised versions of this notice are published here with a new "last updated" date, and material revisions are flagged by email or inside your workspace.