Privacy notice
Every piece of personal data LegitVCC handles, set out as a ledger: what it is, why we hold it, who else touches it and when it goes.
A plain-English draft, currently being reviewed by a qualified lawyer, so the wording may still change. The rules it describes are the ones we work to today. If a line reads unclear, ask us before you order.
The controller
The operator of LegitVCC decides how the personal data on this page is used. Legal name and address: [to be completed after legal review]. Questions go to [email protected].
The ledger
| Entry | What it contains | Why we hold it |
|---|---|---|
| Your account | Name, email address, and a one-way hash of your password (never the password itself) | To run your account (our agreement with you) |
| Your second key | The authenticator secret, encrypted; recovery codes, hashed | To protect the account, which you and we both want |
| Your sign-ins | Date, time, IP address, browser and device type | To show you your own history, warn you about new devices and stop abuse |
| Your orders | Card amount, fees, payment route, transaction ID, and a transfer screenshot if you upload one | To carry out the order and keep proper records |
| Checkout reports | Status, amount, currency and reference sent by the payment provider | To confirm a hosted-checkout payment |
| Your cards | Number, expiry and security code, encrypted; a log entry every time they are shown | To issue the card and let only you see it |
| Your messages | Tickets, contact-form messages (with the IP address and browser they were sent from), emails, and our replies | To answer you, and to deal with abuse of the contact form |
Three things that never happen
- No advertising cookies and no cross-site tracking.
- No selling of personal data, to anyone.
- No requests for documents or details the service doesn’t need.
Who else handles it
- A payment provider, only if you choose the hosted checkout: it receives the order reference, the amount and the name and email the payment needs, and works under its own privacy terms.
- An email provider, which delivers our account and order letters.
- Cloudflare Turnstile, which checks that a person, not a script, is filling in certain forms. It may see technical data such as your IP address.
- A hosting provider, which keeps the service’s data on our behalf.
- Public authorities, where the law requires us to share something.
Cookies, in one sentence
We set only what the service can’t work without: a cookie that keeps you signed in and one that carries a form-protection token, plus whatever the Turnstile check sets for itself.
How long each entry stays
- Sign-ins: 180 days, then deleted.
- Orders, payments and cards: for the life of your account, and afterwards for as long as law, accounting or a dispute requires.
- Messages: for the life of your account, unless you ask us to delete them and nothing obliges us to keep them.
What you can ask of us
Depending on the law that covers you, you can ask for a copy of what we hold about you, ask us to correct it or erase it, object to or restrict a particular use, or ask for it in a portable form. Write to [email protected]; we may first need to confirm the request comes from you. If you think we have handled it badly, you can also raise it with the privacy authority that covers you.
Locks and logs
Two-step sign-in is mandatory for every customer. Card details are stored encrypted. Our staff reach the system only through their own two-step sign-in, and sensitive actions leave a line in an audit log.
When this page changes
If a change matters, we tell you by email or in the app before it applies. The date on this page marks the latest edit.