Privacy Policy

01Information We Collect

Account information you provide directly: your name, email address, and password. Passwords are stored only as salted hashes, never in plain text.

Order information: the products you purchase, the amount paid, and the delivery status of each key or code. We retain this to support refunds, replacements, and warranty claims.

Technical information collected automatically: IP address, browser and device type, and pages visited. This is used for fraud prevention, security, and understanding how the store is used.

02Payment Data

We do not store your full card number, CVV, or bank credentials. Payments are processed by a third-party payment provider that handles card data directly under its own security standards.

We receive only a transaction reference, the last four digits of the instrument used, and the authorisation result, which we retain for order reconciliation and dispute handling.

03How We Use Your Information

To deliver purchased products, process payments, and provide customer support.

To detect and prevent fraud, key resale abuse, and unauthorised account access.

To send transactional messages such as order confirmations and delivery notices. These are not marketing emails and cannot be opted out of while an order is active.

To send promotional email only where you have opted in. You can withdraw consent at any time from your account settings or the unsubscribe link in any such message.

04Sharing and Disclosure

We do not sell your personal data.

We share data with service providers who process it on our behalf, such as payment processors, email delivery services, and hosting and analytics providers, and only to the extent needed to perform those services.

We may disclose information where required by law, court order, or valid request from a public authority, or where necessary to establish, exercise, or defend legal claims.

05Cookies

We use strictly necessary cookies to keep you signed in and to maintain your cart between visits. These cannot be disabled without breaking core functionality.

We use analytics cookies to understand aggregate usage patterns. These are optional and are set only with your consent where required by law.

06Data Retention

Order and transaction records are retained for as long as required by applicable tax and accounting law.

Account data is retained while your account remains open. If you close your account, we delete or anonymise your personal data except where we are legally required to keep it.

07Your Rights

Depending on where you live, you may have the right to access the personal data we hold about you, correct inaccurate data, request deletion, object to or restrict certain processing, and receive your data in a portable format.

To exercise any of these rights, contact us using the details below. We will respond within the period required by applicable law.

08Security

Data is transmitted over encrypted connections and access to production systems is restricted to personnel who need it. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

09Children

Puffkey is not directed at children under 13, and we do not knowingly collect their personal data. If you believe a child has provided us information, contact us and we will delete it.

10Changes to This Policy

We may update this policy from time to time. Material changes will be announced on this page with a revised effective date, and where required, we will seek your consent again.