Privacy Policy

Last updated: 11 October 2026

This policy explains what personal data CardV collects, why, and how long it is kept. It covers cardv.net, the Merchant Portal, the Merchant API, the CardV redemption pages and the CardV plugins, including CardV Gift Cards for WooCommerce. "CardV", "we" and "us" mean the operator of cardv.net.

CardV is a business-to-business service. Most of the data we handle is about the businesses we supply and the people who work for them.

#1. Data we collect

Merchant applicants and accounts

Business details: company name, registration details, country, website and sales channels.
Contact and team details: names, business e-mail addresses, roles, and two-factor settings for each team member.
Account activity: sign-ins, IP addresses, API keys issued (never their secrets in readable form), orders, balance movements and support messages.

API and plugin requests

Each request carries your API key ID, a signature, the requesting IP address and the software version (for example, the WooCommerce plugin, WordPress and WooCommerce versions).
Order requests contain products, amounts, quantities, expected prices and your own order reference.

Redemption pages

When someone opens a CardV redemption link, we record the IP address, the approximate country and network derived from it, the browser and device information, and when the link was opened and used. We use this to deliver the code only to the right person and to detect fraud.

Website visitors

cardv.net does not use advertising trackers. Our hosting and security providers log IP addresses and request details to keep the site running and to block attacks.

#2. What the WooCommerce plugin sends to CardV

CardV Gift Cards for WooCommerce is designed so that your customers' personal data stays in your store.

Sent: your API key ID and signed requests; the products, amounts and quantities in a paid order; the expected price; an order reference built from a short hash of your site address and the WooCommerce order number; your store's currency code (only if it is not USD, to read the exchange rate); and the plugin, WordPress and WooCommerce version numbers.
Not sent: your customers' names, e-mail addresses, postal addresses, phone numbers, IP addresses or payment details.
Received: catalog and price data, your balance, order status and the gift card codes, which the plugin stores encrypted in your database.
Images: while you browse the CardV catalog in your admin, product images load from CardV image hosts (*.cardv.net), so those hosts see the browser's IP address. Imported images are copied once into your Media Library.

As a store owner, you are responsible for the data you collect from your own customers, and for describing your use of CardV in your store's privacy policy.

#3. Why we use data

To review applications and run your account (performing our contract with you).
To deliver orders, keep balances correct and provide support (contract).
To prevent fraud, abuse and attacks, and to keep CardV secure (our legitimate interest in a safe service).
To meet legal, tax, accounting and anti-money-laundering duties (legal obligation).
To tell you about changes to the service, these policies or your account (contract and legitimate interest). We do not send marketing to merchants who ask us not to.

We do not sell personal data, and we do not use it for advertising.

Suppliers and brands: the order details needed to issue the product. No customer data from your store is sent.
Payment providers: the data needed to process your top-ups.
Infrastructure providers: hosting, content delivery and security (including Cloudflare), e-mail delivery and encrypted backups.
Authorities: where the law requires it, or to report suspected fraud or crime.

Some of these providers are outside your country. Where data is transferred internationally, we rely on the safeguards the applicable law provides, such as standard contractual clauses.

#5. Security

Passwords are hashed, two-factor authentication is available to every team, API signing secrets are stored encrypted, and gift card codes are encrypted at rest and shown only to permitted roles. Access to production systems is restricted and logged. Backups are encrypted.

#6. How long we keep data

Account, order and balance records: for as long as the account is open, then for the period required by tax and accounting law, typically up to seven years.
Security and access logs: up to 12 months, unless needed for an investigation.
Redemption page records: up to 24 months, for fraud prevention.
Applications that are not approved: up to 12 months.

#7. Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict its use, and to complain to a data protection authority. To use these rights, write to [email protected]. We may need to verify your identity, and some records must be kept for legal reasons.

#8. Children

CardV is a service for businesses and is not directed at children.

#9. Changes

We may update this policy. The date at the top shows the latest version. Material changes are announced to account holders by e-mail or in the Portal.

#10. Contact

Privacy questions and requests: [email protected]. See also our Terms of Service.