Privacy Policy

• Account data — name, email, profile photo and locale (e.g. from Google sign-in).
• Order data — products purchased, amounts, recipient phone numbers, and timestamps.
• Payment data — payment status, amount, currency and transaction references, and, where our payment processor provides them, your card brand, card-issuing country and 3-D Secure result. Full card numbers and security codes are handled only by our payment processor; we never receive or store them.
• Balance data — top-ups, debits, and running balance.
• Technical and fraud-signal data — IP address, device and browser information, approximate location derived from IP, and log data needed to operate and secure the Service.

• To fulfil your orders and deliver top-ups.
• To take payments and issue refunds.
• To maintain your account, balance, order history, and rewards.
• To send transactional messages (receipts, delivery confirmations, security notices).
• To prevent fraud and money laundering and to comply with legal obligations (see section 3).

To protect you, us and the card schemes, and to meet our obligations under EU and Estonian anti-money laundering (AML) and counter-terrorist-financing law, we use personal data to:

• screen transactions for fraud using signals such as IP address, device data, order velocity, card country and 3-D Secure results — both ourselves and through our payment processor;
• together with our payment processor, screen payments against international sanctions lists and refuse transactions involving sanctioned countries or persons;
• apply limits to balance top-ups and spending, and request additional verification where a transaction appears high-risk;
• keep records of these checks and, where required by law, report suspicious activity to the Estonian Financial Intelligence Unit (Rahapesu Andmebüroo) — in which case we may be legally prohibited from informing you.

Fraud screening may result in a payment being declined or an account being suspended automatically. You may ask for such a decision to be reviewed by a person by contacting us.

We process your data to perform our contract with you (fulfilling orders and taking payment), to comply with legal obligations (accounting, tax, AML and sanctions law), and on the basis of our legitimate interests (preventing fraud and chargebacks, securing and improving the Service). Where we rely on consent — e.g. optional cookies or marketing — you can withdraw it at any time.

We share the minimum necessary data with the service providers that run the Service. Each has its own privacy policy, which you can read here:

• Paytrust — card payment processing, 3-D Secure and payment fraud screening.
• Visa — card scheme — authorisation, 3-D Secure (Visa Secure) and disputes.
• Mastercard — card scheme — authorisation, 3-D Secure (Identity Check) and disputes.
• Reloadly — top-up fulfilment (recipient phone number and amount).
• Supabase — database, authentication and hosting of account data.
• Vercel — website hosting and delivery.
• Resend — transactional email delivery.
• Google — optional “Continue with Google” sign-in.

We may also disclose data to your card issuer during a dispute, and to authorities where the law requires. We do not sell your personal data.

Some processors may handle data outside the EEA. Where they do, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses or an adequacy decision (including the EU–US Data Privacy Framework).

When a retention period ends, we delete the data or anonymise it so it can no longer identify you. If you delete your account, data we are legally required to keep is retained only for the remaining period and only for that purpose.

Subject to applicable law, you can access, correct, export, or delete your data, object to or restrict certain processing, and withdraw consent. You can delete your account from Settings, or contact us to exercise any right; we reply within one month. You also have the right to complain to your local data-protection authority — in Estonia, the Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee).

We use encryption in transit (TLS), access controls, and row-level security so each user can only see their own data. Card payments are processed by a PCI DSS-certified payment provider on its secure hosted page and are authenticated with 3-D Secure (Visa Secure, Mastercard Identity Check); we never receive or store full card details.

If a security incident affects personal data, we follow this procedure:

• We contain the incident, assess its scope and the risk to affected people, and record it in our internal breach register — whether or not it must be reported.
• Where the breach is likely to result in a risk to your rights and freedoms, we notify the Estonian Data Protection Inspectorate without undue delay and, where feasible, within 72 hours of becoming aware of it, as required by GDPR Article 33.
• Where the breach is likely to result in a high risk to you, we also inform you directly and without undue delay (GDPR Article 34), explaining what happened, the likely consequences, what we have done, and what you can do to protect yourself.
• Where payment card data could be involved, we also notify our payment processor and the card schemes in line with their rules.

We use essential cookies to run the Service and, only with your consent, optional ones. See our Cookies Policy for the full list and how to change your choice.

For privacy requests email support@topupolive.com, or write to Hytrenda OÜ, Pärnu mnt 106-21, Kesklinna linnaosa, 11312 Tallinn, Harju maakond, Estonia.