Privacy Policy

GiftSello is a marketplace where you sell gift cards to us for wallet balance, and where verified cards are sold on to buyers. To do that we have to handle some personal data, and some of it is sensitive — gift card codes, payout addresses, identity documents. This page explains in plain terms what we collect, why, and what happens to it.

1. What we collect

Account. Your name, e-mail address, password (stored as a hash — we cannot read it), country, and if you sign in with Google or Apple, the identifier they give us. Optional: phone number and two-factor authentication secrets.

Gift cards you sell. The brand, country, face value, the code and PIN, and anything else the card needs for verification (serial number, voucher number, a photo of the card if the brand requires one). Codes and PINs are encrypted at rest the moment you submit them; staff see them only inside the verification tool, and they are never displayed publicly. We also keep a one-way fingerprint of every submitted code so the same card cannot be submitted twice.

Verification outcome. Whether the card was approved or rejected, the verified balance, the reason for any rejection, and who verified it.

Payout details. The crypto address you withdraw to.

Identity documents (KYC). Only when you request a withdrawal: your country, the document type and a photo of a government-issued ID. We do not ask for ID to sell cards or to withdraw to crypto.

Purchases. When you buy a verified card: the order, the delivery e-mail, the payment reference from the crypto payment processor or the wallet debit, and the code we delivered to you.

Wallet. A full ledger of credits, holds, purchases, withdrawals and reversals.

Device and fraud signals. IP address, approximate location derived from it, browser and device information, cookies, sign-in history, and risk signals such as how many accounts share a device or payout destination. These are what let us pay honest sellers quickly and refuse stolen cards.

Support. Tickets, live-chat transcripts, e-mails and any attachments you send us.

2. Why we use it

• To run the service: estimate your card, verify it, credit your wallet within the 24-hour guarantee, pay withdrawals, and deliver purchased codes.
• To stop fraud: checking that a card is genuine and unused, that it has not been submitted before, and that an account is not being used to launder stolen cards. This protects buyers of verified cards and protects you from reversals.
• To meet legal duties: anti-money-laundering checks before payouts, sanctions screening, responding to lawful requests, and keeping the records tax and AML rules require.
• To keep your account secure: sign-in alerts, device management, two-factor authentication.
• To answer you: support tickets and chat, order and sale notifications by e-mail.

We do not sell personal data and we do not use it for third-party advertising.

3. Who we share it with

Verification desk. Cards are checked by a real person — the site team or a central verification desk that serves the marketplace. They see the card details needed to verify it, not your payout details or ID.

Crypto payment processor. Purchases paid with crypto go through Payavex. They receive the order amount and reference, and the transaction details needed to confirm payment. They never receive card codes.

E-mail provider. Your e-mail address and the content of transactional messages (sale updates, withdrawal confirmations, delivered codes).

Identity checks. Your ID document is reviewed by our own team through an audited viewer. If an automated document check or sanctions screening service is used, it receives only what is needed for that check.

Payout partners. The wallet address needed to send your crypto withdrawal.

Gift card brands. We may confirm a card's balance with the issuing brand. We do not send them your identity.

Authorities. Where the law requires it, or when a card turns out to be stolen or fraudulently obtained, we may share account, IP and transaction records with payment partners and law enforcement.

4. How long we keep it

Account and wallet records: while your account is open and for the period AML and tax rules require afterwards (typically 5 years). Gift card codes you sold: encrypted until the card is sold on or redeemed, then kept only as long as a buyer claim is possible; the one-way fingerprint is kept permanently so the code cannot be resold. ID documents: deleted 90 days after your account closes unless a legal hold applies. Support conversations: 2 years. Fraud records may be kept longer to protect other users.

5. Security

All traffic is encrypted with TLS. Gift card codes and PINs are encrypted at rest with AES-256 and decrypted only inside the verification and delivery tools. Passwords are hashed. ID documents sit in a private folder outside the web root. Access to sensitive data is role-restricted and logged. You can add two-factor authentication and see every signed-in device from Profile & security.

6. Cookies

We use a session cookie to keep you signed in and a CSRF token to protect forms. A preference cookie remembers your display currency and country. We do not run third-party advertising cookies. If analytics is enabled it is anonymised and does not identify you.

7. Your rights

Depending on where you live you can ask to see the data we hold about you, correct it, delete it, receive a copy, or object to certain uses. Deletion is subject to the retention periods above — we cannot erase records that AML rules require us to keep. To make a request, write to support@giftsello.com from the e-mail address on your account. We answer within 30 days.

8. International processing, children, changes

We serve a global audience and your data may be processed in a country other than your own, with the same protections. The service is for adults only; accounts belonging to anyone under 18 are closed when identified. If this policy changes in a way that matters to you, we e-mail you before the change takes effect.

Identity verification, compliance and grievance records

What we keep for compliance. To meet anti-money-laundering and fraud-prevention duties we process your identity document, the country and name on it, your device and network identifiers, your wallet addresses, transaction history, balance checks of the cards you sold and the outcome of every review. Identification and transaction records are kept for five (5) years after the account closes or the last transaction, whichever is later, and may be kept longer where a law, an investigation or a dispute requires it.

Sharing for compliance. We share records with payment partners, card issuers and verification providers to check a transaction, and with regulators, courts and law enforcement where the law requires or permits it. We do not sell personal data.

Grievances. When you register a grievance, the ticket, your messages and the Grievance Officer's answers are stored with the transaction they concern and are shared with our central support team, which answers grievances for all our gift card sites. Grievance records are kept for five (5) years.

Automated decisions. Fraud and sanctions screening is partly automated (device, address, velocity and list checks). A freeze or refusal that results from it can be contested through a grievance and is then reviewed by a person.

Your requests. You may ask for a copy of your data, a correction, or deletion of what we are not required to keep, at support@giftsello.com or through a grievance (category "My personal data"). We answer within 30 days.

9. Contact

Privacy questions: support@giftsello.com.