Privacy policy

This policy explains what personal data ZVoucher collects, why we collect it, and how we protect it. It covers your account, your trades and the coupon codes you submit.

1. Data we collect

• Account: email, display name, password (hashed with bcrypt).
• Payout: the wallet or payout address you provide for a trade. No identity documents are collected.
• Transactions: trades, messages, audit logs.

2. Sensitive data

Coupon codes are encrypted at rest (AES-256-GCM) and never shown in plain text, except to the authorized buyer and support for verification. They never appear in logs.

3. Legal basis & retention

Transaction data is retained only as long as needed to operate the service and resolve disputes, then deleted at the end of the legal retention periods (GDPR).

4. Your rights

Access, rectification, erasure, portability. Contact: data protection officer.

5. Security

• Hashed passwords, signed sessions (httpOnly JWT), optional 2FA.
• Encrypted secrets, audit logs, role separation.