In short
- We collect what we need to run your account, deliver your orders and keep them secure.
- Polar handles card payments. We never see your card details.
- No advertising cookies, no third-party tracking, and we never sell your data.
- You can ask for a copy of your data, correct it or delete it at any time.
This summary is for convenience. The full text below is what applies.
1. Who is responsible for your data
Lebilix LLC operates ALAYA DIDS and is responsible (the “controller”) for the personal data described in this policy. For any privacy question or request, email support@alayadids.com.
2. The data we collect
| Category | What it includes |
|---|---|
| Account | Name, email address, password (stored only as a one-way hash), optional phone number and country, and your settings (currency, theme, email preferences, two-step verification). |
| Orders | Products, options and quantities, prices and discounts, the name and email on the order, any delivery details you enter (such as a game Player ID or phone number), the delivered codes, and the order history. |
| Payments | From Polar we receive only the payment status, a payment reference and a method label (for example “Card”). We never receive your full card number, security code or bank one-time passcodes. |
| Security | IP address, browser and device description (user agent), and the times of sign-ins, sign-in attempts and account changes. This also covers active sessions, devices you have marked as trusted, and hashed one-time sign-in codes. |
| Messages | What you send through the contact form (name, email, topic, order number, message) and the IP address it was sent from. We also keep copies of the emails we send you, so we can deliver and resend them. |
| Newsletter | Your email address, when and where you subscribed, and the IP address used. Only if you subscribe. |
3. Why we use it
| Purpose | Legal basis |
|---|---|
| Creating your account, processing and delivering orders, sending order emails and receipts, and customer support | Performing our contract with you |
| Keeping accounts and payments secure: sign-in checks, two-step verification, alerts, rate limits and fraud prevention. Each checkout gets an automatic risk score from the order amount, the email domain, your order history and the number of recent orders from the same email or IP address. A high score asks you to confirm a code by email or holds the order for a person to review; you can always contact us about a decision. | Our legitimate interest in a safe store, and yours |
| Keeping order and transaction records | Legal obligations (accounting and tax) |
| Sending the newsletter and promotional emails | Your consent, which you can withdraw at any time |
4. Who we share it with
We don't sell your personal data or share it for advertising. We share only what each service needs:
- Polar (polar.sh), our payment provider and merchant of record. It receives your order total, your email and the payment details you enter on its page, and handles them under its own privacy policy.
- Product suppliers: the Player ID, phone number or account details you enter for a top-up or activation, so that it can be delivered.
- Email delivery and hosting providers, which send our emails and run our servers for us and act only on our instructions.
- Have I Been Pwned: when you choose a password, we check it against known data breaches. Only the first 5 characters of a one-way hash of the password are sent. Your password itself never leaves our servers.
- Authorities, when the law requires it, or to protect customers against fraud.
Some of these providers may process data outside your country. Where that happens, we rely on the safeguards the law requires, such as standard contractual clauses.
5. Cookies and storage on your device
We use only what the store needs to work. There are no advertising cookies and no third-party analytics or tracking scripts, so we don't ask for cookie consent.
| Name | Type | Purpose and duration |
|---|---|---|
mts_session | Cookie (HTTP-only) | Keeps you signed in. Ends when you close the browser, or after 30 days if you chose “Remember me”. |
mts_device | Cookie (HTTP-only) | Remembers a device that passed sign-in, so you aren't asked for a code or alerted again. 90 days. |
mts_csrf | Cookie (HTTP-only) | Security token that stops other websites from sending requests in your name (CSRF protection). 7 days. |
mts_checkout | Cookie (HTTP-only) | Links a checkout to the browser that started it, so delivered codes are only shown to you. 30 days. |
mts.deviceId | Local storage | A random id for this browser. With your time zone, language and screen size it lets us recognise your signed-in browser and sign out a session that is used from another device. Never shared or used for advertising. |
mts.cart.v1, mts.wishlist.v1 | Local storage | Your cart and wishlist on this device, until you clear them. |
mts.preferences.v1, mts.theme | Local storage | Display currency, recent searches and light or dark theme, until you clear them. |
Local storage never contains passwords, sign-in tokens or payment details. Polar's payment page sets its own cookies under its own policy.
If you install the store as an app, a service worker keeps copies of public pages, product images and the site's code on your device so they open offline. It never stores your account, orders, codes or payment pages.
6. How long we keep it
- Account data: while your account is open. When you ask us to delete it, we delete it within 30 days.
- Orders and transaction records: as long as accounting and tax law requires. This can be several years, even after you close your account.
- Security records (sessions, sign-in history): as long as needed to protect your account and investigate misuse. Sign-in codes expire after 10 minutes, password reset links after 60 minutes and email verification links after 24 hours.
- Support messages: as long as needed to resolve your request and handle any follow-up.
- Newsletter: until you unsubscribe.
7. How we protect it
- Passwords are stored only as salted one-way hashes, and passwords found in known data breaches are rejected.
- Delivered codes are encrypted in our database, and emails show only part of each code.
- Sign-in uses an HTTP-only cookie that page scripts can't read. Optional two-step verification adds an emailed code.
- Repeated failed sign-ins lock the account temporarily, and requests are rate-limited.
- Card payments happen on Polar's page. Card details never reach our servers.
8. Your rights
Depending on where you live, you can ask us to:
- give you a copy of your data, including in a portable format;
- correct it (you can change most of it yourself on your profile page);
- delete it, apart from records we must keep by law;
- restrict or object to how we use it; and
- stop sending you promotional emails, at any time.
Email support@alayadids.com from the address on your account. We reply within 24 hours and complete requests within 30 days. You can also complain to the data protection authority where you live.
9. Children
The store is not aimed at children under 16, and we don't knowingly collect their data without a parent or guardian. If you think a child has given us personal data, contact us and we will delete it.
10. Changes to this policy
We update this policy when our services or the law change, and the date at the top shows the latest version. We tell account holders about important changes by email.