Privacy notice

This notice explains how NikoBuy collects, uses, stores, and shares personal data when you use nikobuy.net. NikoBuy is the trading name of the independent operator of this store. We sell digital game services with tracked delivery. We are not affiliated with the game publishers whose titles appear on the site.

Privacy questions and data requests go through the Support page. Include your account email and, if relevant, your order ID.

Who this applies to

It covers visitors, registered customers, and anyone who sends a support message. The store is intended for people who can legally buy digital services. Do not create an account or send game-login details if you are under 18.

Data we collect

Account. Username, email address, password (stored as a one-way hash, not in plain text), country, display currency, email-verification status, and a session cookie so you stay signed in.

Orders. Game and service selected, quantity or package, platform, region, optional notes, quoted price, payment status, order ID, timestamps, and campaign or source tags from the checkout URL if present (for example utm_source).

Support and order chat. Email, topic, message text, and messages exchanged about an order after purchase.

Game-account details for delivery. When fulfilment needs account access, we collect login details (typically username or email and password) through a private channel after payment — not through public checkout, notes, or the public support form. Recovery codes, 2FA secrets, and remote-control access to your device are not requested.

Payment confirmation. We receive from the payment gateway that a payment succeeded or failed, the amount, currency, and order reference. We do not collect full card numbers, CVV, or bank passwords.

Technical data. IP address and basic request metadata may be processed by our hosting, database, email, and security systems. The browser may also store a checkout draft locally on your device.

What we never ask on public forms

Do not enter game passwords, recovery codes, card numbers, CVV, or government ID into checkout notes, registration, or the public support form. Send game login details only through the private channel we open after the order is paid.

How we use data

• Create and secure your account, including email confirmation.
• Take payment, create the order, and deliver the purchased game service.
• Message you about that order, payment, and fulfilment.
• Answer support requests and handle refunds, the account guarantee, and disputes.
• Prevent abuse, fraud, and duplicate or invalid orders.
• Keep accounting and legal records.
• Understand how the site is used (analytics) so we can fix and improve it.

We do not send marketing or promotional emails. Emails are limited to account verification, payment and order updates, and replies to messages you sent us.

Game login details

Login details are used only to fulfil the confirmed order (and, if you claim it, to check a guarantee request). They are stored with restricted access. We keep them for up to 30 days after delivery, then delete them, unless a longer hold is required for an open dispute, chargeback, or legal obligation. You can ask us to confirm deletion.

Fulfilment partners who complete an order may receive the minimum details needed for that job, including game login details when the delivery method requires them. They are instructed to use the data only for that order and not to keep copies after work is finished.

Third-party sharing

Yes — we share personal data with third parties when it is needed to run the store, take payment, deliver an order, send transactional email, measure site use, or comply with the law. We do not sell personal data. The third parties are:

• Payment. Waffo Pancake (merchant of record) and/or PayGate.to as a fallback, plus the licensed payment method you choose on their checkout. They process payment under their own terms and privacy notices. We send them the amount, currency, email, and order reference so checkout and payment confirmation can work. Card and bank details are entered on the payment provider’s page, not on nikobuy.net.
• Hosting and database. Our hosting and database provider stores accounts, orders, support messages, and related records.
• Email delivery. Transactional email (verification, payment received, support replies) is sent through our email provider.
• Analytics. Google Analytics and Google Tag Manager measure site use.
• Internal operations alerts. New orders, payments, and support messages may be forwarded to our operations inbox or operations chat so staff can act on them. Those alerts can include your email and order summary.
• Fulfilment partners. As described above, only what is required to deliver a specific paid order.

We do not sell personal data. We may disclose information if required by law, to protect the store or other customers, or in connection with a transfer of the business, provided the recipient is bound to protect the data.

Some of these providers are outside your country. Where that happens, we rely on their published safeguards and on the fact that the transfer is necessary to provide the service you requested (account, payment, or delivery).

Cookies and similar storage

nikobuy_session — necessary signed-in session, HTTP-only, about 30 days.

nikobuy_currency and nikobuy_locale — remember display currency and language. These are preference cookies, not advertising cookies.

Google Analytics and Google Tag Manager may set their own cookies to measure traffic. You can block analytics cookies in your browser; the store will still work for browsing, checkout, and account use.

The browser may keep a local checkout draft so a half-finished order is not lost if you refresh the page. That draft stays on your device.

How long we keep data

• Account data: while the account is open, then as long as we must keep records.
• Orders, payment confirmation, and invoices: typically at least 5 years for accounting and dispute handling, or longer if the law requires.
• Support and order-chat messages: while useful for the order and then with the order record.
• Game login details: up to 30 days after delivery, unless a dispute is open.
• Email-verification tokens: until used or expired (24 hours).

Your choices

You can access, correct, or ask us to delete personal data by contacting Support from the email on your account. We may need to keep order and payment records even if you close the account. We may refuse a deletion request that would prevent us from handling a payment dispute, fraud check, or legal duty.

You can close a session by signing out. You can ask us to confirm when game login details for an order have been deleted.

Depending on where you live, you may also have the right to complain to a data protection authority.

Security

We use HTTPS, hashed account passwords, restricted operator access, and a private channel for game login details. No method of transmission or storage is perfectly secure. If we become aware of a breach that affects your personal data, we will take steps required by applicable law, including notifying you when that is required.

Related policies

Purchases are also covered by the Terms, Refunds, and Guarantee pages.

Changes

We may update this notice when the store, providers, or legal requirements change. The date at the top is the latest version. Continued use of the site after an update means you have read the revised notice.