Privacy Policy

1. Information we collect

• Account data — email address, display name and, if you sign in with Google, the basic profile information that provider returns.
• Order data — products ordered, amounts, currency, status, delivery targets you enter (for example a Steam invite link, Telegram username or player ID) and the resulting codes or receipts.
• Balance and payment data — top-up invoices, crypto transaction references and balance movements. We never see or store card numbers.
• Support data — tickets, messages and any files you attach.
• Epin data — codes you check or redeem, the batch and product they belong to, their value and their delivery result.
• Guest claim data — when you redeem an epin without an account we store the claim link token, the delivery details you entered, an optional e-mail address and, if you request a refund, the payout method and USDT (BEP20) address you provide.
• Technical data — IP address, browser type and timestamps, used for security, fraud prevention and debugging. For redemptions made without an account, the IP address is also used to rate-limit code guessing.

2. How we use it

We use your data only to operate the service: authenticating you, fulfilling and delivering orders, processing balance top-ups and refunds, answering support requests, preventing fraud and abuse, and meeting legal obligations. Epin and guest-claim data is used to prove a code was validly redeemed, to deliver the product it unlocks and to pay out a refund when delivery is not possible. Aggregated, non-personal figures (revenue, cost and margin) are used for our own internal profit reporting. We do not sell your personal data and we do not use it for third-party advertising.

3. Legal bases

Where the GDPR applies, we process data to perform our contract with you (account, orders, delivery), for our legitimate interests (security, fraud prevention, service improvement), and to comply with legal obligations (accounting and anti-fraud records).

4. Sharing

Data is shared only with the providers required to run the service: our hosting and database provider, our upstream digital-goods suppliers (limited to the details needed to fulfil the specific order), and payment/crypto processors. Each acts under contract and may not use your data for their own purposes. Delivery details you enter (Steam invite link, Telegram username, player ID) are forwarded to the supplier that fulfils that specific order. We may disclose data if legally compelled.

5. Retention

Account and order records are kept for as long as your account exists and, afterwards, for the period required for accounting, dispute resolution and fraud prevention. Support tickets are retained while relevant to your account. Epin redemption logs and guest claims are kept for at least 24 months as proof of delivery and for anti-fraud purposes, even when no account was involved. You can request deletion at any time; we will remove everything we are not legally required to keep.

6. Security

Access to your data is restricted by row-level database security, so your orders, tickets and balance are only visible to you and authorised staff. Traffic is encrypted in transit. Passwords are stored hashed by our authentication provider — we never see them, and you can enable two-factor authentication (TOTP) from your settings. A guest claim link is a secret: anyone holding it can see that delivery, so treat it like a receipt and do not share it.

7. Your rights

You may request access, correction, export or deletion of your data, and object to or restrict certain processing. Contact us at support@bulkepin.com or open a support ticket from your panel. If you redeemed as a guest, include your claim link so we can identify the record. We respond within 30 days.

8. Cookies

We use strictly necessary cookies and local storage to keep you signed in and to cache catalog data so the panel loads quickly. Guest claim links you create are also stored in your browser's local storage so you can find them again. We do not use advertising or cross-site tracking cookies.

9. Children

The service is not directed at anyone under 16. If you believe a minor has created an account, contact us and we will remove it.

10. Changes

We may update this policy as the service evolves. Material changes will be announced in the panel, and the "last updated" date above will always reflect the current version.