Privacy Policy

Brief Summary

We collect the minimum amount of data necessary to operate the Store: account identity, Minecraft username, and order data. We do not sell your data to third parties. Passwords are stored in hashed form and can never be read by us.

1. Data We Collect

Data You Provide

• Account identity: first name, last name, email address.
• Game data: Minecraft username (required, for product delivery).
• Contact: phone number and country code (for order confirmation).
• Order data: products purchased, amount, payment method, order status.
• Third-party account data: if you log in with Google or Discord, we receive the account ID and email address from that provider. We do not receive your password.

Data Recorded Automatically

• IP address and device information (user agent) at login, for account security.
• Technical records of system failures for repair purposes.

What we do not store: card numbers, PINs, passwords in readable form, and OTP codes after use.

2. How We Use Data

• To process and verify your order.
• To deliver digital products to the correct Minecraft username.
• To send transactional emails: email verification, password reset, OTP, and order status notifications.
• To maintain account security and prevent abuse.
• To comply with applicable accounting and legal obligations.

We do not send promotional emails without your consent.

3. Legal Basis for Processing

We process data on the basis of: (a) performance of the sale-and-purchase agreement you accept at checkout, (b) our legitimate interest in maintaining the security of the service, and (c) applicable legal obligations.

4. Sharing Data with Third Parties

Your data is shared only to the extent necessary:

• Email provider to send transactional emails (verification, OTP, password reset, order notifications).
• OAuth account providers (Google, Discord) when you choose to log in through them.
• Law enforcement where required by applicable regulations.

We do not sell, rent, or trade your personal data.

5. Data Retention Period

• Account data is retained for as long as the account remains active.
• Order and payment records are retained for accounting purposes in accordance with applicable regulations.
• If an account is deleted, personal data is deleted or anonymized, except for records we are required to retain by law.

6. Your Rights

• Access and update your data directly from the Profile page.
• Delete your account together with its personal data through account settings or by contacting us.
• Request a copy of the personal data we store.
• Withdraw consent for processing that is based on consent.

For the requests above, contact support@keztravia.web.id from your account email. We process requests within a maximum of 14 business days.

7. Data Security

• Passwords are stored using the bcrypt hashing algorithm, never in plain text.
• Login sessions are stored server-side and you can revoke them at any time from the Profile page.
• All data traffic uses HTTPS/TLS.
• Access to data is restricted to operators who require it.

8. Cookies

We use cookies necessary to operate login sessions and store the shopping cart. We do not use advertising cookies or third-party trackers for profiling.

9. Minors

The Store is not intended for children under 13 years of age. If you are below the age of majority applicable in your region, use the Store only with the permission and supervision of a parent or guardian.

10. Changes to the Policy

Changes to this policy will be published on this page together with its update date. We will notify you of material changes via the registered account email.

11. Contact

Questions or requests regarding personal data: support@keztravia.web.id.