Privacy Policy

1. Who we are

SkinsFlow is operated by Skinsflow Limited, Office 2841, House of Francis, Ile du Port, Mahe, Seychelles ("we", "us"). We are the controller of the personal data described in this policy, which means we decide why and how it is processed.

For any privacy question or request, write to [email protected].

2. Who this policy covers

• Merchant users: people who register for a SkinsFlow account and members of a merchant's team;
• Owners, directors and representatives of businesses that apply to use SkinsFlow, whose details we receive during verification;
• Customers: people who pay a merchant through a SkinsFlow checkout; and
• Visitors to skinsflow.com and its subdomains.

When a customer pays a merchant, the merchant also processes that customer's data under its own privacy policy. This policy covers only what we do.

3. Data we process

Account data

Name, username, email address, password (stored only as a secure hash), two-factor authentication settings, team membership and role, account preferences, and records of sign-ins and important account actions.

Business, KYB and KYC data

For merchants: legal and trading name, registration and VAT numbers, registered address, country, website, support contact, description of the business, and company documents. For the individuals behind the business, including ultimate beneficial owners: full name, date of birth, nationality, residential address, identity document details and images, proof of address, selfie or liveness images where requested, and the results of sanctions, politically-exposed-person and adverse-media screening.

Steam and trade data

Steam ID, Steam trade link and token, public profile name and avatar, the contents and values of the inventory shown in the checkout, the items selected, trade offer identifiers and status, and trade protection and risk information related to a deposit.

Payment records

Deposits, market purchases, amounts and currencies, fees, balance movements, order identifiers and metadata supplied by the merchant, and webhook delivery records.

Technical data

IP address, browser and device information, the pages and API endpoints used, timestamps, error logs, and security signals such as rate-limit events and results of bot checks.

Cookies

We use strictly necessary cookies only. See our Cookie Policy.

Communications

Emails and other messages you send us, and our replies.

4. Purposes and legal bases

We do not sell personal data, and we do not use it for advertising. We do not make decisions with legal or similarly significant effects about you based solely on automated processing; verification decisions are reviewed by a person.

5. Who we share data with

We share personal data only as needed for the purposes above, with:

• Cloudflare, which provides the security check (Turnstile) on our sign-in and registration forms and protects our sites against abuse;
• Valve Corporation (Steam), through which trades are made; Steam receives the trade offers we create and processes your data under its own privacy policy;
• our payment network partner, which prices items and executes the Steam trades and market purchases for us;
• our hosting provider, which runs the servers and databases the Service lives on;
• our email provider, which delivers account and service emails;
• the merchant you are paying, if you are a customer: the merchant receives the deposit details, including your Steam ID, the items and values, and the trade status;
• professional advisers, such as lawyers and auditors, under confidentiality duties; and
• authorities, such as law enforcement, regulators and courts, where the law requires it or where it is necessary to prevent or report crime.

Our service providers act on our instructions and must protect the data. If our business is sold or reorganised, data may pass to the new owner under this policy.

6. International transfers

We are based in the Seychelles and our providers operate in several countries, including the European Union and the United States. Your data may therefore be processed outside the country where you live. Where data protection law requires it, we rely on adequacy decisions or on appropriate safeguards such as standard contractual clauses, and we choose providers that apply equivalent protection.

7. How long we keep data

• KYC, KYB and anti-money-laundering records, including verification documents and transaction monitoring records, for five (5) years after the business relationship ends, or longer if required by law or by an ongoing investigation.
• Payment records (deposits, purchases, ledger entries) for as long as required by accounting, tax and anti-money-laundering law, and at least five (5) years after the transaction.
• Account data for as long as the account is open, then for the periods above where it forms part of those records.
• Customer checkout data that is not part of a completed payment record (for example, an inventory shown for a checkout that was never used) for a short period, normally no longer than needed to complete or expire the checkout and keep it secure.
• Technical and security logs for up to twelve (12) months, unless needed longer to investigate an incident.
• Support communications for up to three (3) years after the last message.

When data is no longer needed, we delete or anonymise it.

8. Security

We protect data with encryption in transit (HTTPS everywhere), encryption of sensitive secrets at rest, hashed passwords and API secrets, two-factor authentication for staff, role-based access controls, and logging of access to verification documents. No system is perfectly secure; if a breach affects you, we will tell you and the relevant authorities where the law requires it.

9. Your rights

Depending on where you live, you may have the right to:

• access the personal data we hold about you and receive a copy;
• correct inaccurate or incomplete data;
• ask us to delete data, where we no longer need it and are not required to keep it;
• restrict or object to processing based on our legitimate interests;
• receive data you gave us in a portable format; and
• complain to a data protection authority.

To exercise a right, write to [email protected] from the email address linked to your account, or tell us your Steam ID if you used a checkout. We may need to verify your identity. We answer within one month, and we will explain if a legal obligation, such as anti-money-laundering record keeping, prevents us from deleting something.

10. Children

Merchant accounts are for adults only. The checkout is not directed at children, and we do not knowingly collect data from anyone below the minimum age required by Steam or by the law where they live. If you believe a child has used SkinsFlow, contact us and we will take appropriate steps.

11. Changes to this policy

We may update this policy. The "Last updated" date shows the current version. If a change is significant, we will tell merchants by email or in the dashboard before it takes effect.

12. Contact

Skinsflow Limited, Office 2841, House of Francis, Ile du Port, Mahe, Seychelles. Email: [email protected].

Questions about this document? Write to [email protected].

Other policies: Terms of Service · Cookie Policy · AML & KYC Policy · Acceptable Use Policy · Company details