Privacy Policy

EvelopKeys ("we", "us", "our") is a digital software licence retailer operating at evelopkeys.com. We sell genuine Microsoft software licence keys to customers worldwide. Our registered contact email is info@evelopkeys.com.

This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our website or purchase from us.

When you place an order, we collect:

• Email address — to deliver your licence key and send order confirmation
• Name — to personalise your order and support communications
• Payment data — processed entirely by Stripe; we never see or store your card details
• IP address and browser data — collected automatically for security and fraud prevention
• Order history — stored to support future queries and guarantee claims

We do not collect more data than necessary to process and support your order.

We use your personal data to:

• Deliver your licence key to your email address
• Send order confirmations and support communications
• Process refund or replacement requests under our guarantee
• Prevent fraud and abuse of our platform
• Comply with legal obligations

We do not sell, rent, or share your personal data with third parties for marketing purposes. Ever.

Under the UK GDPR and EU GDPR, we process your data on the following legal bases:

• Contract performance — processing your order and delivering your product
• Legitimate interests — fraud prevention, platform security, and improving our service
• Legal obligation — complying with applicable tax and consumer protection laws

Where we rely on legitimate interests, we have assessed that our interests do not override your rights.

We retain your order data for 7 years to comply with UK tax and accounting requirements. After this period, your data is securely deleted.

Email addresses used for marketing (if you have opted in) are retained until you unsubscribe or request deletion.

We use a limited number of trusted third-party services:

• Stripe — payment processing. Stripe handles all card data under their own PCI-DSS compliant infrastructure. See stripe.com/privacy.
• Supabase — database and authentication infrastructure
• Vercel / hosting provider — website hosting

All third-party providers are bound by data processing agreements and may only use your data as instructed by us.

We use essential cookies required for the website to function (session management, cart state, security). We do not use advertising or tracking cookies without your explicit consent. See our Cookie Policy for full details.

Under UK and EU data protection law, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data ("right to be forgotten")
• Restrict or object to processing
• Data portability
• Withdraw consent at any time

To exercise any of these rights, email us at info@evelopkeys.com. We will respond within 30 days.

All data is transmitted using 256-bit SSL/TLS encryption. We store data in secure, access-controlled environments. Payment data is never stored on our servers — it is handled exclusively by Stripe.

In the unlikely event of a data breach that affects your rights, we will notify you and the relevant supervisory authority within 72 hours as required by law.

We may update this Privacy Policy from time to time. Material changes will be communicated by updating the date at the top of this page. We encourage you to review this policy periodically. Continued use of our website after changes constitutes acceptance of the updated policy.