1. Scope and responsibility
This policy describes personal information processed through G2U.gg. “G2U”, “we”, “us” and “our” refer to our online store, which directly sells digital goods and provides services to customers. G2U is responsible for the store activities described here. Third-party payment providers, including NOWPayments where used, process payment information under their own privacy information for activities they control.
For privacy questions or requests, use G2U Support and identify your message as a privacy request. You can open the support page without signing in. See Contact & Support for the information to include.
2. Information we collect
- Account information: email address, display name, account identifier, password hash, account status and an avatar if you upload one. Verification and password-recovery flows, when enabled, also process verification codes or tokens, their validity and delivery state, and security identifiers.
- Purchases: order number, email, optional contact handle, comments, game, product, quantity, selected options, price, currency, discounts and rewards, order history, payment references and fulfilment status.
- Delivery details: information entered in a listing’s order fields, such as game identifiers, character names, server or region. If an account-access service expressly requires credentials, details you provide become part of the order record; avoid providing them unless necessary, and never reuse your G2U password.
- Communications: order-chat and support messages, conversation and read status, support feedback, and images or video you attach to an order chat. Product reviews and ratings you submit are also processed.
- Technical and security information: session identifiers, IP addresses used for connection handling and abuse controls, authentication attempts and rate-limit records, and browser requests to the site and its resources.
- Preferences and activity: language, display currency, saved items, price-alert choices, recently viewed games and notification settings. Some information stays in your browser, as explained in our Cookie Policy.
Do not send payment-card details, wallet private keys, recovery phrases, identity documents or unrelated sensitive information in order fields or chat. A public blockchain transaction can reveal addresses and transaction history independently of G2U.
3. Why information is used and legal grounds
Information needed to create or manage an account, process an order, arrange delivery and answer an order-related request is used to provide the service you request and perform the relevant contract, or take steps before that contract.
Session management, access checks, fraud prevention, abuse limits and handling disputes support our interests in operating a reliable service and protecting users and transactions. Where applicable law requires an interests assessment, those interests must be balanced against your rights. Information may also need to be processed to meet applicable legal obligations or establish, exercise or defend legal claims.
Where a particular use requires consent, consent must be obtained for that use. Accepting the Terms of Service is not blanket consent to personal-data processing or optional browser storage. We do not describe the site as having a general optional-cookie consent mechanism.
Required order and account fields are needed for the corresponding feature. You can browse without registering, but withholding information necessary to fulfil a purchase may prevent that purchase or its delivery.
5. Sessions and security
The application stores a random session identifier in a browser cookie and keeps session data on the server. Account passwords are stored as salted password hashes. Access checks, form protections and rate limits are used in the application. These measures do not make every message, upload or account-access detail end-to-end encrypted, and no internet service can promise absolute security.
Keep your login and private order-access link confidential. A person with access to a guest session or private order link may be able to view the associated order. Sign out on shared devices and contact support if you suspect unauthorised access.
6. Retention
Different records serve different purposes. The first-party session cookie has a 30-day lifetime when set; server-session validity is refreshed during use, and expired sessions are cleaned up periodically. Verification codes and recovery tokens have limited validity, but expiry of a code is not the same as deletion of every related record.
Order, account, message, payment and support records are not automatically erased merely because an order is completed or an account becomes inactive. Retention and deletion must take account of service delivery, unresolved requests, fraud prevention, legal claims and any applicable record-keeping duties. There is no single fixed retention period promised for all of these records. Ask support about a particular category or make an erasure request.
Browser storage has different lifetimes, described in the Cookie Policy. Clearing browser storage does not delete records already held by G2U, a payment provider or a public blockchain.
7. Your choices, rights and deletion requests
You can change your display name and upload or remove an avatar in your account. Account deletion and wider personal-data requests are handled through G2U Support; there is no self-service account-erasure feature.
Depending on the law that applies, you may have rights to obtain information and access to your data, correct inaccurate information, request erasure, restrict or object to processing, obtain a portable copy, withdraw consent for processing based on consent, and complain to a competent data-protection authority. These rights are subject to the conditions and exceptions in that law.
Describe your request and the relevant account email or order number. We may need proportionate information to verify your identity and authority before disclosing or deleting data. Do not send your password or private keys as proof. Where information must be retained, the reason and the applicable limits should be explained rather than promising unconditional deletion. Withdrawing consent does not undo lawful processing already carried out.
8. International processing and children
Users and service providers may be in different countries. Processing outside your country depends on the provider and deployment used for the relevant service. Applicable restrictions on international transfers and requirements for safeguards must be respected. You can ask support for information about the destinations, recipients and safeguards relevant to your data.
Only provide information if you can lawfully use the service and enter the relevant transaction, with a parent or guardian where legally required. If you believe a child has provided information without the required authority, contact support so the matter can be reviewed.
9. Updates and contact
Changes to the way the site handles information may require an updated policy. The date shown on this page identifies this version. Where applicable law requires additional notice or a choice, a policy update alone does not replace it. Privacy requests can be sent through Contact & Support.