Privacy Policy
CardPlug buys unused gift cards from people in Nigeria and Ghana and pays them in local currency. To do that we need some information about you. This page explains exactly what we collect, why, and what you can do about it.
1. Who we are
CardPlug is a gift card buy-back service operated by an independent developer. For the purposes of data protection law, we are the data controller for the information described on this page.
Contact for anything privacy related: 175409522@qq.com
2. What we collect
| Category | What it includes | Why we need it |
|---|---|---|
| Account details | Email address, password, full name, phone number | To create your account, sign you in, and contact you about a submission or a payout |
| Gift card submissions | Card type, face value, the card's country, the price you ask for, the payout currency, your notes, and a photo of the card | To evaluate the card and make you an offer |
| Redemption codes | The gift card code (the "card secret") you enter when you submit a card | To verify the card is valid and unused before we pay you |
| Support messages | The content of messages you send us in the in-app support chat | To answer your questions and resolve disputes |
| Reports and blocks | Reports you file about other users, and the list of users you block | To keep the service safe and enforce our terms |
| Points balance | The points balance on your account | To track rewards you have earned |
| Technical logs | IP address, time of request, browser or app version | To keep the service running, diagnose faults, and prevent abuse |
What we do not collect
- We do not collect your location.
- We do not access your contacts, calendar, photos other than the card image you choose to upload, or your camera roll.
- We do not use advertising identifiers, and the app contains no advertising or third-party analytics SDK.
- We do not collect health, biometric, or financial account data.
About gift card codes
A redemption code is the most sensitive piece of information in this service: whoever holds it can spend the card's balance. We store codes on our own servers so our team can verify a card before paying out. Access is restricted to authorised staff, codes are never shown to other users, and they are never included in the public parts of the app.
Please do not send a code to anyone else, and do not submit a card you have already shared with another buyer.
3. How we use your information
- To create and operate your account.
- To evaluate submitted gift cards and make you an offer.
- To pay you in your chosen currency, and to keep records of those payments.
- To provide support and respond to your messages.
- To detect and prevent fraud, stolen cards, and abuse of the service.
- To comply with legal obligations and to respond to lawful requests.
We do not sell your personal information, and we do not use it for advertising.
4. Who we share it with
- Payment and banking providers. To pay you, we share the details necessary to make the transfer (your name, and the account or mobile money number you give us).
- Hosting providers. Our servers and database are hosted by a cloud provider in the United States. Data is processed there on our behalf.
- Authorities. Where we are legally required to disclose information, or where disclosure is necessary to investigate fraud or protect someone's safety.
We do not share your information with advertisers or data brokers.
5. International transfers
Our servers are located in the United States, so the information you provide is transferred outside Nigeria and Ghana for processing. We rely on the hosting provider's contractual data protection commitments for these transfers.
6. How long we keep it
- Account and submission records — while your account is open. After you ask us to delete your account, we remove them within 30 days, except where we must keep records for tax, accounting, or fraud-prevention purposes.
- Card codes — retained with the submission record so we can respond to a dispute about that card. They are deleted along with the record.
- Server access logs — kept for a short period for security and troubleshooting, normally no more than 30 days.
- Support messages — kept while your account is open so we have context for future requests.
7. Your rights
You can ask us to:
- tell you what personal information we hold about you, and give you a copy;
- correct information that is wrong or incomplete;
- delete your account and the information associated with it;
- stop processing your information in certain circumstances.
To make a request, email 175409522@qq.com from the address you registered with. We respond within 30 days. We may ask you to confirm your identity before we act, so that we do not disclose your information to someone else.
If you are not satisfied with our response, you can complain to your local data protection authority — for example the Nigeria Data Protection Commission (NDPC) or the Data Protection Commission of Ghana.
8. Security
- All traffic between the app and our servers is encrypted with HTTPS.
- Passwords are stored as salted hashes. We never store or display your password in plain text.
- Card codes are visible only to authorised staff through an access-controlled admin tool.
- Our database is backed up daily.
No system is perfectly secure. If we ever become aware of a breach that affects your personal information, we will notify you and the relevant authority as required by law.
9. Children
CardPlug is for people aged 18 and over. We do not knowingly collect information from anyone under 18. If you believe a minor has created an account, contact us and we will remove it.
10. Changes to this policy
If we change how we handle personal information, we will update this page and change the date at the top. For significant changes we will also tell you in the app before the change takes effect.
11. Contact
Questions about this policy, or about your data: 175409522@qq.com