1. Who is responsible
The data controller is Riftline, of 6 Kiryat Mada St, Har Hotzvim, Jerusalem, Israel. This is the business correspondence address used by Riftline. For privacy questions or requests, email support@riftline.eu.
2. Information this site uses
Website and security records
The Riftline website and API are hosted in Gravelines, France. When you use them, the hosting service may process your IP address, device and browser details, requested pages, timestamps and security events to deliver the service and protect it. The host controls its infrastructure and security logs under its operational retention policy.
Checkout and payment
When you start an order, Riftline processes the selected plan, price, payment method and order reference. For cryptocurrency payments, the system also processes the quoted asset and amount, receiving address, quote expiry, payment status and public transaction reference. For card payments, Stripe provides the hosted checkout and processes the payment details you submit there; Riftline receives payment status and relevant order information, not your full card number. The checkout stores an active order in local browser storage so you can resume it. It is removed when completed, cleared, or once it is more than 24 hours old or expired. Anyone with access to your device or browser profile may be able to see browser-stored information.
Customer account and Discord link
If you register, sign in, reset a password or use account tools, the account service processes your email address, password hash, licence information, account and session identifiers, and security events as needed for those features. Passwords are stored as hashes rather than readable passwords. If you link Discord, Discord and Riftline process the identifiers and profile details needed to authorize the link and, where configured, manage customer-role access.
Support messages
If you contact support, we use the information in your message and any order, transaction or account references you choose to provide to investigate and respond. Do not send wallet seed phrases, private keys, account passwords or authentication codes.
3. Analytics and your choice
The public site can count events such as page views, pricing clicks, checkout starts and completions, FAQ opens, and download or status actions. The analytics endpoint writes daily totals by event and page category and, in the reviewed code, keeps the most recent 90 UTC days. It does not write IP addresses, user-agent strings, order IDs, licence keys or unique visitor identifiers into that aggregate counter file. The web host may still keep separate technical access logs as described above.
Optional analytics is off unless you actively choose “Allow optional analytics” in the site notice. You can choose “Only necessary” or change your choice below. The site also respects the browser’s Do Not Track signal. Your choice is saved in local storage so it can be remembered on later visits. Checkout local storage is separate and is used to resume an order you started.
Cookies and device storage
The reviewed public website does not load advertising tags or third-party audience analytics. It uses session storage to avoid counting repeat page views for the same page during a tab session; optional analytics will not run until you opt in. It uses local storage for your analytics choice and for an active checkout order. The checkout order is used to resume an order you requested and is cleared on completion, manual restart or expiry. If the operator adds any other cookie, pixel, analytics service, or device-storage purpose, this notice and the choice mechanism must be updated before that technology is enabled.
4. Why information is used
- Orders and accounts: to take steps you request, provide the service you bought, manage your account and respond to support requests.
- Security and abuse prevention: to protect accounts, payment processing, the API and other users, and to operate a secure service.
- Legal and financial records: to meet tax, accounting and other legal duties and to establish or defend legal claims.
- Optional analytics: only after you choose “Allow analytics,” to understand how the site is used. You can change your choice at any time.
5. Who receives information
Information is shared with service providers only as needed to run Riftline: the website and API hosting service; the email delivery service; Stripe for hosted card payments; Discord when you choose Discord account linking or use Discord integration features; and api.qrserver.com when the checkout creates a QR code. The QR request contains the payment URI, including the receiving address and amount, and the provider may also receive technical request information. Cryptocurrency network data is public by design.
These providers may process information in the countries where their systems operate. Stripe and Discord publish their own privacy and transfer information. Where privacy law requires transfer safeguards, the applicable transfer terms for each provider govern. Riftline does not control public blockchain records.
6. How long information is kept
We keep information only for as long as it is needed for the purpose for which it was collected, subject to legal obligations and claims. Daily analytics totals are kept for up to 90 days. An active checkout order is normally kept in your browser until it is completed, cleared or expires, and is removed locally after 24 hours or expiry. Account and licence details are kept while needed to provide and secure the account and access. Order and payment records may be kept for the period required by tax and accounting rules or needed to resolve disputes and prevent fraud. Support messages are kept while a request is being handled and for a reasonable period afterward to maintain the support history and handle related issues. Technical logs are managed by the hosting provider under its operational retention policy. You can request deletion by contacting support; information that must be retained by law or for a legitimate claim may not be deleted immediately.
7. Your privacy rights
Depending on the law that applies, you may be able to request access to your personal information, ask for inaccurate information to be corrected, ask for deletion or restriction, object to some processing, request portability, or withdraw consent for consent-based processing. Rights are not absolute in every situation. To make a request, contact support@riftline.eu; we may ask for reasonable information to confirm identity and locate the relevant account or order. Withdrawing analytics consent stops future optional analytics but does not undo processing already carried out lawfully.
You may complain to the data-protection regulator in the country where you live, work or believe a breach occurred. For UK residents, the regulator is the Information Commissioner’s Office (ICO). EU residents can contact their national supervisory authority.
8. Security and incident response
Riftline uses access controls and technical measures intended to protect account, order and licence information, including password hashing and encrypted connections where supported. No internet transmission or storage system can be guaranteed perfectly secure. If a security incident affects personal information, Riftline will assess it and notify people or regulators where the law requires.
9. Children
Riftline is intended for all ages. If you are under the age at which you can make online purchases or provide consent under the law where you live, ask a parent or guardian to review the purchase and privacy information and help you use the service. We do not knowingly require children to provide more personal information than is needed to operate an account, verify a purchase and provide support. A parent or guardian may contact support@riftline.eu with a privacy request concerning a child’s information.
10. Changes
We may update this notice when the services, providers or data practices change. The current version and its effective date will be published on this page. Last updated: 16 October 2026.
Further information
The ICO explains what privacy information should be provided and gives guidance on storage and access technologies.