OVERVIEW
INFORMATION WE COLLECT
Account Information
When you register, we collect your email address, display name, and password (stored securely via Supabase Auth). We do not store plain-text passwords.
Order Information
When you place an order, we collect your full name, phone number, WhatsApp number, email address, and Steam Friend Code, along with the items purchased and the amounts paid. For game top-ups we also collect the game account details needed to credit it: your Player ID, User ID, Zone ID or Server ID, or for some games your game account email. This is required to process and deliver your order.
Subscription Details
When you buy Adobe Creative Cloud, we collect the email address the Adobe licence will be set up on. It is used only to set up your Adobe licence and is shared only with Adobe for that purpose. Other subscriptions collect no extra details.
Bank Transfer Receipts
If you pay by bank transfer, you send us your payment receipt on WhatsApp or Discord. It may show your name, bank and account details. We use it only to confirm your payment, and we keep it with your order for our accounting records.
Profile Details
You may optionally add your date of birth and WhatsApp number to your profile, which qualifies you for loyalty bonus coins. Your date of birth is used to check you are old enough to use the programme and for birthday offers; your WhatsApp number is used to reach you about orders. Both are optional and can be changed or cleared from your account at any time.
Steam Profile Details
When you add a Steam Friend Code, we verify it against Steam and save the matching public Steam username and avatar so we can send your gift to the correct account. We never ask for and never store your Steam password or Steam Guard codes.
Support Conversations
If you contact us on WhatsApp or Discord, those messages are stored on that platform under its own privacy policy. We use them only to identify your order and resolve your issue.
Usage Data
We may collect anonymised data about how you interact with the site — pages visited, search queries, and session duration — to improve platform performance.
Device & Technical Data
IP address, browser type, device type, and referring URLs may be logged for security and fraud prevention purposes.
HOW WE USE YOUR INFORMATION
- ▸To process your orders and deliver Steam game gifts, top-ups, gift cards and subscriptions.
- ▸To confirm bank transfer payments against the receipts you send us.
- ▸To send or accept a Steam friend request, which Steam requires before a gift can be delivered.
- ▸To communicate order confirmations, updates, and support responses by email, WhatsApp, or Discord.
- ▸To verify your identity and prevent fraudulent transactions.
- ▸To improve our platform, fix issues, and optimise the user experience.
- ▸To comply with legal obligations under Sri Lankan law.
- ▸To send occasional service announcements (not marketing emails without your consent).
THIRD-PARTY SERVICES
We use trusted third-party services to operate VaultX.lk. Each has its own privacy policy governing how they handle data:
Supabase
User authentication, database, and file storage.
Koko (Merchant Services Ltd)
Buy-now-pay-later payment processing.
Adobe
Setting up Adobe Creative Cloud licences on the email you give us.
Valve / Steam
Game catalogue data, pricing, Steam Friend Code verification, and gift delivery.
Discord
Optional sign-in, community server membership, and support conversations.
Optional sign-in with your Google account.
WhatsApp / Meta
Support and order-update conversations on WhatsApp.
Meta Pixel
Measuring our Facebook and Instagram ads (product views, cart and purchase events).
Cloudflare
CDN, DDoS protection, and email routing.
Vercel
Website hosting and edge functions.
COOKIES
We use essential cookies required for authentication sessions and cart state.
We also use the Meta Pixel to measure how well our Facebook and Instagram ads work. It records events such as page visits, viewing a product, adding to cart, starting checkout and completing a purchase, including the items and order value, and Meta may set its own cookies to do this. It does not receive your name, phone number, Steam details or payment details from us.
Your browser settings allow you to control or disable cookies. Disabling essential cookies may affect login functionality and cart persistence.
DATA STORAGE & SECURITY
Your data is stored on Supabase infrastructure, which is hosted in secure data centres. All data in transit is encrypted using TLS. Passwords are hashed and never stored in plain text.
We retain your account data for as long as your account is active. Order data is retained for a minimum of 3 years for accounting and dispute resolution purposes under Sri Lankan commercial law.
YOUR RIGHTS
- ✓Request access to the personal data we hold about you.
- ✓Request correction of inaccurate or incomplete data.
- ✓Delete your account yourself at any time from Account → Security. See “Deleting your account” below for exactly what happens.
- ✓Withdraw consent for optional data processing at any time.
- ✓Lodge a complaint with relevant data protection authorities in Sri Lanka.
To exercise any of these rights, contact us at support@vaultx.lk.
DELETING YOUR ACCOUNT
You can delete your account yourself at any time from Account → Security. You do not need to email us and you do not need a reason.
When you confirm deletion:
- ✓You are signed out immediately and locked out of your account.
- ✓Nothing is erased straight away. Your account is held for 90 days.
- ✓Signing back in during those 90 days restores your account exactly as it was, including your order history and loyalty points.
- ✓After 90 days your personal data is permanently erased automatically. This cannot be undone or reversed by us.
The data erased after 90 days includes your name, email address, phone number, date of birth and saved Steam account details.
What we keep, and why. Sri Lankan accounting and tax law requires us to retain records of completed sales. We therefore keep the transaction record of each order — the items, amounts, dates, payment reference and status — after your personal details have been stripped from it. Those retained records no longer identify you.