This notice explains what personal data TOXO collects, why, and the rights you have under India’s Digital Personal Data Protection Act, 2023 (DPDP Act).

1. Data we collect

Account data (email address, username); order data (game User ID and Server ID, products purchased, amounts, payment references, order status); support messages you send us; and basic technical data (device, pages visited) needed to operate and secure the store.

2. Why we collect it (purpose)

To create your account, fulfil top-up orders, verify players, process payments, prevent fraud, provide support, and meet legal obligations. We collect data only for these stated purposes.

3. Your consent

By creating an account or placing an order, you consent to this collection. You may withdraw consent at any time by contacting us — withdrawal applies going forward and may mean we can no longer fulfil orders for you.

4. What we never collect

We do not ask for or store your game login password, UPI PIN, card numbers or bank credentials. Payments are handled entirely by our payment gateways; we keep only the transaction reference. Supplier credentials are held server-side and never exposed to the browser.

5. Sharing

We share order details (game IDs, items) with top-up suppliers to deliver your purchase, and payment details with payment gateways to process charges. We do not sell your personal data.

6. Cookies

We use only essential storage: sign-in session cookies and on-device preferences (theme, consent choice, cached store data). We run no advertising trackers. You can decline non-essential storage in the cookie banner; the store keeps working.

7. Retention

Order records are kept as required for accounts, tax and dispute resolution, then deleted or anonymised. Support messages are retained for up to 24 months.

8. Your rights

Under the DPDP Act you may request access to your data, correction of inaccuracies, erasure (e.g. deleting your account and personal data), and nomination of another person in case of death or incapacity. Write to [SUPPORT EMAIL — replace with your support inbox] with your registered email address; we respond within 30 days.

9. Children

TOXO is intended for users aged 13 and above. Users below 18 should use the store with a parent or guardian’s involvement, and payments should be made by the account holder’s family payment method.

10. Security & breaches

We apply reasonable safeguards (encrypted transport, access-controlled storage). In the unlikely event of a personal-data breach we will notify affected users and the Data Protection Board as required by law.

11. Grievances

Data-protection grievances: [GRIEVANCE OFFICER NAME — replace with a real name], [GRIEVANCE OFFICER EMAIL — replace with a real inbox]. Unresolved grievances may be taken to the Data Protection Board of India.