Privacy Policy

1. Information we collect

Information you provide:

Automatically collected: device information (IP, browser, OS, device identifiers); usage records (pages visited, draw records, spending records, sign-in times); cookies and similar technologies (session persistence, preference memory).

• Registration: email, password (stored hashed), nickname — account creation and sign-in
• Identity verification: name, ID/passport/home-return-permit number, document photos — KYC, age verification, AML
• Delivery: recipient name, phone, address — card shipping
• Payment: top-up amount, time, channel (full card numbers are never stored) — order records and reconciliation

2. How we use information

We process your information only for:

• Providing draws, market and shipping services — registration, delivery, payment data (contract performance)
• Identity and age verification — KYC data (legal obligation: AML, minor protection)
• Anti-money-laundering monitoring — top-up/spending records, device data (Hong Kong AML ordinance)
• Responsible-spending management — top-up/spending amounts (Consumer Council gacha guidance)
• Support and after-sales — order and communication records (contract performance)
• Platform security and fraud prevention — device, usage and sign-in data (legitimate interest)
• Service improvement and analytics — anonymised usage records (legitimate interest)

3. Storage and protection

Retention periods:

Security measures: passwords stored hashed, never in plain text; KYC images encrypted with authorised-only access; no full card numbers stored; SSL/TLS encrypted transport; periodic security audits and vulnerability reviews.

• Account data: lifetime of the account + 90 days after deletion (dispute handling)
• Transaction records: retained per tax and audit requirements (at least 7 years)
• KYC documents: stored encrypted after approval, deleted upon account deletion
• Unconsumed-top-up refunds: payment data deleted 90 days after refund completion

4. Sharing

We never sell your personal information. We may share necessary data with: shipping carriers (recipient name, phone, address — delivery); payment providers (information required to complete transactions); and other cases required by law. We do not share your personal information with offline partner stores — buyback transactions are handled by you in person.

5. Your rights

You have the following rights over your personal data:

• Access and edit: view and edit your information (email, nickname, addresses) under account settings; verified KYC data cannot be self-edited — contact support to change
• Data export: request a copy of your personal data (registration, spending and draw records, etc.)
• Account deletion: request deletion at any time. Data is removed 90 days after deletion (transaction records retained as legally required); unconsumed coins/points are forfeited — handle them first; shipped cards are unaffected
• Withdraw consent: withdraw consent to cookies and marketing pushes at any time; withdrawal does not affect prior lawful processing

6. Minors

The platform is for users aged 18+ only; we do not knowingly collect information from minors. If a minor is found registered, the account is deleted immediately and any unconsumed balance refunded. Safeguards: 18+ confirmation at registration; second confirmation at first top-up; top-up limits and cooling-off periods. Parents who discover minor use can contact support and we will assist.

7. Cookies

We use cookies to keep you signed in, remember language preferences and collect visit statistics. You can manage or disable cookies in your browser settings, though some features may be affected.

8. Policy updates

We may update this policy from time to time. Material changes are announced on the site; continued use after an update constitutes acceptance.

9. Contact us

For privacy questions, reach us via okkard.com or the Discord community (join via the site’s “Community” page).