Privacy policy

What we collect

We collect what the service needs to work, and stop there. We do not buy data about you, and we do not run advertising trackers.

• Account: your email address, your country, the currency that follows from it, and a cryptographic hash of your password — never the password itself. If you sign in with Google we store the account identifier Google gives us and the verified email address, not your Google password.
• Orders: the link or username you ask us to deliver to, the service and quantity, and the amounts charged.
• Payments: the amount, currency, method and status, and — for mobile money — the phone number you are paying from. Card details are entered on the payment provider’s own page and never reach us.
• Technical: ordinary server logs, and the two cookies described below.

Why we use it

To create and secure your account, to place and track your orders, to take payments and issue refunds, to answer you when you contact support, and to keep the records that accounting and anti-fraud obligations require.

We do not sell your data, and we do not use it to profile you for advertising.

Who we share it with

Only where the service cannot be delivered otherwise.

• Suppliers who fulfil orders receive the target you supplied and the quantity — that is what delivery consists of. They do not receive your email address or payment details.
• Payment providers receive what they need to collect the payment, including your phone number for a mobile money request.
• Our hosting and database providers process data on our behalf under contract.

Cookies

Vyrall sets two cookies, and neither is used for advertising or analytics.

• A session cookie that keeps you signed in. It is httpOnly, so no script on the page can read it, and it is scoped to the sign-in endpoints.
• A language cookie that remembers whether you read the site in English or French, so the page arrives in the right language before any script runs.

Where your data is held

Our database and servers are hosted in Europe. Where a supplier or payment provider operates elsewhere, the data described above reaches them in the course of delivering your order or collecting your payment.

How long we keep it

Your account and its order and wallet history are kept while your account exists. Payment and wallet records are kept for as long as accounting and anti-fraud obligations require, which can outlast the account itself.

Your rights

You can ask us for a copy of your data, for a correction, or for deletion of your account. Some records — payments in particular — we may have to keep even after an account is closed, and where that applies we will say so rather than silently keeping them.