Who is responsible
VirtualCardOnline ("we") runs this website and the space behind it. We decide what personal data is collected and how it is used. Questions about this policy go to [email protected].
For a formal request about your data (a copy, a correction or deletion), write to that address from the email on your account, so we know the request comes from you. We answer as quickly as we can and within the time the law allows.
What we collect
When you open a space
Your name, your email address and a password. The password is stored only as a one-way hash; nobody at VirtualCardOnline can read it. When you pair an authenticator app, we keep the shared secret it uses, encrypted, and a set of one-time recovery codes.
When you order a card
The amount, the price we showed you, the payment method you chose, the address you paid to, the transaction ID you gave us and, if you sent one, a screenshot of the transfer. For hosted checkouts we also keep what the payment provider tells us about the payment: its reference, the amount received and its status.
When a card is issued
The card number, the expiry date and the security code, the name on the card and, if there is one, the billing address. These are encrypted before they are stored.
When you use the space
Each sign-in is recorded with its time, IP address and the browser and system it came from, so you and we can spot access that was not yours. Messages you send to support and our replies are kept with the conversation.
When you write to us from the website
Your name, email address, the subject and the message, with the IP address and browser the message came from.
Why we use it
- To run your account and the orders you place, and to issue the cards you pay for.
- To check that a payment really arrived and matches the order.
- To keep the account safe: the authenticator, the sign-in log and alerts about sign-ins from new devices.
- To answer your messages.
- To meet legal duties such as keeping financial records, and to prevent fraud and misuse.
The legal grounds for each purpose (contract, legal obligation, legitimate interest) are to be confirmed for the jurisdictions the site serves.
Card details
Card numbers, expiry dates and security codes are encrypted at rest. In your space they stay sealed until you enter a new code from your authenticator, and they seal themselves again after a short time. When someone on our team opens the sealed details of a card, for example to help you with a declined payment, that look is written to an internal audit trail.
Payment providers and blockchains
If you pay through a hosted checkout, you finish on the provider's own page and the provider processes your payment under its own privacy terms. If you pay by crypto transfer, remember that transfers on public blockchains can be seen by anyone; we only link a transaction ID to your order.
Cookies and storage in your browser
We use the cookies the site needs to work: one that keeps you signed in, plus one that guards forms against forged requests. A human check on some forms may set its own cookie. Your browser also keeps a few preferences locally, such as how the home page is shown and where you placed windows in your space. We do not use advertising or tracking cookies.
Who else sees your data
Only the service providers we need to run the site, each limited to what its job requires:
- the hosting company that runs our servers and database;
- the email service that delivers our messages;
- the payment providers you choose to pay through;
- the service that runs the human check on our forms;
- the partner that issues the cards, where the name on the card or other details are needed to issue it.
We do not sell personal data. We share it with authorities only where the law requires it.
How long we keep it
Account data stays while the account is open. Orders, payments and card records are kept for as long as financial record-keeping rules require after the last activity on them. Sign-in records are kept for twelve months. Support conversations are kept with the account. The exact periods are to be confirmed against the laws that apply.
Your rights
Depending on where you live, you can ask to see the information we hold about you, to correct it, to delete it or to receive a copy. Some records cannot be deleted while the law requires us to keep them; we will tell you which and why. Write to [email protected] from the address on your account. You may also complain to the data protection regulator in your country.
Security
Every account signs in with a password plus an authenticator code. Card details are encrypted, staff access is limited and logged, and connections to the site are encrypted. No system is perfect; if something goes wrong that affects you, we will tell you.
Children
The site is not meant for people under 18, and we do not deliberately open accounts for them.
Changes to this policy
If we change this policy, the date at the top changes too. Larger changes are announced by email before they take effect.