1. Who we are
Controller: Kingsless LLC, 7011 W Parmer Ln, Austin, TX 78729, United States. Admin: admin@eightyup.co. Privacy: privacy@eightyup.com. Phone: 512-593-2352. We process personal information to run a gift-card marketplace, take Square payments to our 80UP location, verify remaining balances, stop fraud, and restore locked accounts.
2. Why we use it
We use personal information to: create and secure accounts; post, list, pull, and sell cards; run Square checkout; pay sellers their ask net of our 8% fee on the card’s remaining balance; check remaining with issuers; operate the captcha bridge; show last-four and deal tiers; localize “near you”; fight fraud, abuse, and stolen cards; do customer support and admin override; keep logs; comply with law; and improve the product. We do not sell your personal information for money. We do not sell gift-card numbers as a marketing list.
3. Legal bases (if they apply)
If a privacy law asks for a “legal basis,” we rely on: contract (to run the account and a sale); legitimate interests (security, fraud, product); consent (optional GPS, optional authenticator, optional marketing); and legal obligation (tax, process, subpoena). Texas law, federal law, and — if you are a California resident — the CPRA also apply as written in Section 10.
4. Balance checks, captcha, issuers
When you post, we send or type the number and PIN to brand checker pages and APIs (examples: SVS checkBalance, Home Depot, Starbucks, Main Event, Golden Corral, and others on the board). Those third parties see the secrets and your request metadata. Their privacy policies govern their side.
Our server may open a real browser, fill fields, click I’m-not-a-robot, load tiles, or call a captcha-solving vendor (for example CapSolver or 2Captcha) if an API key is configured. That vendor may see a captcha image or site-key, not necessarily your whole account. You authorize this as part of posting. We try not to keep captcha screenshots longer than needed to finish the check.
If we cannot read remaining from your screenshot, or the file has no capture time, or that time is older than two hours, we will reject the post. You may open the store page again and upload a new original screenshot. We store the screenshot with the listing long enough to review fraud and to complete a sale.
7. Retention
Account profile: while the account is open and a reasonable period after. Listings and sale records: as long as needed for disputes, tax, and fraud (often years). Gift-card secrets: as long as needed to deliver and to defend a chargeback, then we may delete or tokenize. Password vault: while the account exists. Logs: typically days to months unless an investigation is open. Practice seed cards are ours, not yours.
8. What we collect
You give us: first name, last name, email, password, postal address, optional authenticator secret/status, listings (brand, remaining, ask, card number, PIN), store-checker screenshots used to lock remaining (including capture metadata such as EXIF DateTimeOriginal), support messages, and any ID we reasonably request after a lockout or dispute.
We create or observe: account ids, listing ids, last-four of a card (shown on the public board), check ids, verify outcomes (empty, mismatch, blocked, captcha, remaining), timestamps, IP address, user-agent, coarse location (GPS if you allow it, otherwise IP), nearby-store flavor, cookies and local/session storage (including pending verify payloads), live-board polls, and server logs.
Payments: Square collects the buyer’s payment-card data. We receive tokens, last-four of the payment card if Square sends them, amounts, status, and location ids. We do not want your full payment PAN on our disks.
Gift-card secrets: number and PIN are stored to complete a sale. They are not printed on the public board. After a sale they are shown to the buyer. We may retain them as needed for disputes, chargebacks, fraud, tax, and law.
Admin vault: sign-in passwords for email accounts are sealed at rest (AES-GCM or similar) and opened only on the admin desk for admin@eightyup.co so we can verify a human and restore access when money or a card is involved. That is deliberate. You were told in the Terms.
9. Security
We use HTTPS, sealed password vaults, session cookies, optional TOTP, and access control so only admin@eightyup.co opens the admin desk. No method is perfect. Gift-card numbers are high-value secrets; a seller who screenshots a PIN in Slack is outside our control. You will use a unique password. You will enable authenticator if you hold large remaining. Report incidents to admin@eightyup.co.
10. Your rights (US / CPRA / other)
Subject to law, you may ask to know, access, correct, or delete personal information, or to obtain a copy. Email privacy@eightyup.com from the address on the account. We will verify you. We will not fulfill a request that lets a thief empty a sold card or that we must keep for tax, fraud, or a sale already in flight.
California: we do not “sell” or “share” personal information as CPRA uses those words for cross-context behavioral advertising. If that ever changes we will post a Do Not Sell/Share link. You may limit use of sensitive personal information (password, precise geolocation, gift-card number and PIN) to what is necessary to provide the Service — which is already how we use it. You may use an authorized agent. We will not discriminate against you for exercising CPRA rights.
Virginia, Colorado, Texas (if and when TDPSA applies to us), and similar states: you may appeal a denied request by writing “appeal” to privacy@eightyup.com. Nevada: we do not sell covered information as Nevada defines it.
EEA/UK visitors: the Service is aimed at the United States. If you still use it, we transfer data to the US on contract necessity and your consent. You may have GDPR rights of access, rectification, erasure, restriction, objection, and portability, and a complaint to a supervisory authority.
11. Children
The Service is not for children under 18, and not for children under 13. We do not knowingly collect from children. If we learn we did, we will delete it. Parents: write privacy@eightyup.com.
12. Location
Optional GPS is used to pick a city and nearby store flavor. If you refuse, we may use IP. We cache that locally for hours so we are not locating you every paint. We do not track you from store to store in the background. Disable location in the browser anytime.
13. Automated decisions
Balance parsers, captcha detection, deal-tier math, and fraud holds may run without a human in the loop. They can block a post, fail-open to attestation, or freeze an account. Request a human review at admin@eightyup.co if money is stuck.
14. International
Servers and staff may be in the United States. Issuers and Square may be elsewhere. Do not use the Service if your country forbids transferring gift-card data to the US.
15. Do Not Track
There is no consistent DNT standard. We do not respond to DNT signals at this time. We still do not run third-party ads.
16. Changes
We may update this Policy. The date at the top will move. Material changes may be emailed. Continued use is acceptance where the law allows.
17. Contact & complaints
Privacy questions, requests, and CPRA authorized-agent letters: privacy@eightyup.com. Operational and fraud: admin@eightyup.co. Mail: Kingsless LLC, 7011 W Parmer Ln, Austin, TX 78729. Phone: 512-593-2352. If we cannot resolve a privacy complaint, California residents may contact the California Attorney General; others may contact their state AG. This Policy does not create extra contractual damages beyond the Terms.
End of Privacy Policy