Privacy notice

We process account name, email, encrypted authentication secrets, language and server preferences; listings, bids, inventory declarations, follows, ratings and private trade messages; billing name/address, payment references, review records and invoices; and browser push subscription details when you enable notifications. Security logs can contain IP addresses and request metadata.

Account and trade records are processed to provide the requested service and perform the user agreement. Billing and invoice records support payment reconciliation and legal obligations. Security and abuse-prevention records support the provider’s legitimate interests where applicable. Optional push delivery uses your browser permission and explicit device subscription; you can disable it at any time.

For processing subject to Turkish law, the bases are KVKK article 5/2(c) for a contract, 5/2(ç) for legal duties, 5/2(e) for establishing or protecting rights and 5/2(f) for proportionate security interests. Optional promotional communications require a separate choice and may be withdrawn. Reading this privacy notice is not blanket consent.

Public listings show item details and the seller’s display identity. Premium public profiles can show inventory and completed trades. Private messages and contact data are restricted to trade participants and authorized dispute reviewers. Payment records are available to their owner and authorized administrators. Hosting, Whop and notification providers process the data needed for their services. Albion’s image server receives requests for external item images.

If you allow analytics, Google Analytics 4 measures page categories, language/device information and the subscription journey using a pseudonymous browser identifier. Verified payments and subscription events may be linked to that identifier while your consent remains valid. Google receives technical connection data, including the browser IP address; these data are not anonymous. We do not send account names, email addresses, chat text, card details or raw payment references as analytics parameters. Advertising consent and Google signals remain disabled. Cookie preferences, analytics cookies and consent last up to 180 days. Event payloads held by this app are cleared after 90 days; minimal duplicate-prevention records remain. Use Cookie preferences to reject or withdraw consent at any time. Google processing may involve other countries; see its linked privacy information and the provider’s transfer disclosures below.

International transfers must meet the applicable legal conditions; browser permission or acceptance of these terms is not by itself an international-transfer safeguard. The provider’s published processing locations and safeguards, when configured, appear below. Ask the privacy contact for information about the recipients and applicable transfer mechanism.

Retention is limited by purpose and the category-specific policy below. Analytics identifiers and payloads have automatic expiry and cleanup. Inactive accounts, completed trades, legal holds and external backups require an operator review; they are not automatically erased merely because a session or cookie expires. A preservation exception must identify the records, reason and next review date. It does not justify keeping the entire account indefinitely.

Account records are used while the account is active. The operator reviews accounts after 24 months without verified activity, checking sign-in and account actions, Premium entitlements, open trades and disputes. Before closing an eligible inactive account, the operator sends at least 30 days’ notice to its registered email address. Returning to the service stops inactivity closure. This is a manual review procedure, not an automatic inactivity-deletion feature. Deletion requests can be made at any time without waiting for this review.

The review period for completed or cancelled player trades, bids, private trade messages and contact details is 24 months after closure. The operator then removes unnecessary personal content or irreversibly anonymises it, unless an active dispute, security investigation or identified legal duty requires specific evidence. Such exceptions are reviewed at least every three months and removed when their purpose ends. Replacing a display name alone does not anonymise contact details or messages. Public listings and profiles should not contain identity documents, payment credentials or other unnecessary personal information.

Payment, invoice and accepted-contract records are separated from the active account and restricted to payment administration, legal duties and claims. The applicable statutory period is assessed for each record; where Turkish commercial recordkeeping rules apply, some records may need to be kept for 10 years, while applicable tax periods can differ. This is not a blanket 10-year period for chats, advertising data or all account information. On expiry of the applicable period and any documented legal hold, the operator deletes or anonymises the personal data. Whop retains its own records under its policy.

Cookie choices and Google Analytics browser cookies last at most 180 days. Storage lifetimes for the optional Whop provider follow the Whop policy. The scheduled analytics cleanup clears expired client identifiers, removes event payloads and account links after 90 days, and deletes rejected or revoked consent records after a further 180 days without updates. Minimal event duplicate-prevention markers remain to prevent replay and contain no event payload or account link. Application/security logs and backups are reviewed at least every three months for necessity and configured expiry; host and vendor retention settings are managed separately. If a backup is restored, completed erasure requests must be reapplied before the restored data is used. Ask the privacy contact for the applicable host or vendor retention details.

Where applicable, you may request access to your personal data, correction, erasure (the right to be forgotten), restriction, objection to processing based on legitimate interests, and portability of data you provided that we process by automated means on consent or contract grounds. A portability request can ask for a structured, commonly used machine-readable file such as JSON or CSV, or transmission to another controller where technically feasible. Rights are subject to legal exceptions, including necessary transaction records and the rights of other people.

Send privacy requests from your registered email address to kvkk@albionmoney.com, or write to Tuğrul Yıldırım at the postal address above. State your account reference and the right you want to exercise; do not send passwords, payment card details or identity documents unless a proportionate ownership check is specifically needed. If you cannot use your account email, contact info@albionmoney.com for an alternative verification route. GDPR requests receive a response without undue delay and normally within one calendar month. A permitted extension of up to two further months is explained within the first month. KVKK requests are answered within 30 days. If a request is refused, we explain the reason and available complaint routes. You may complain to the competent EU/EEA supervisory authority, including where you live or work, or to the Turkish Personal Data Protection Authority where applicable.

Where GDPR applies, account registration, sign-in, player trades and Premium activation rely on performance of a contract (article 6(1)(b)); required accounting records rely on legal obligations (6(1)(c)); proportionate service security and dispute handling rely on legitimate interests (6(1)(f)). Optional Google Analytics and Whop advertising measurement rely on separate consent (6(1)(a)). The registration checkbox records acceptance of the terms and acknowledgement of this notice, together with the version and time; it is not blanket consent to personal-data processing. Refusing optional cookies does not prevent registration or purchase. Withdraw optional consent at any time through Cookie preferences; this does not affect earlier lawful processing.

The Albion Money Android app uses the same account and albionmoney.com services described in this notice. Sign-in tokens are kept in the device’s secure storage. If you enable device notifications, Firebase Cloud Messaging (Google) receives a device token to deliver them; disabling notifications or signing out deactivates that token. The app does not request location, camera, contacts or broad storage permissions, shows no advertising and does not use the advertising ID. Files are shared or selected only through system dialogs you open. You can delete your account in the app under My Account → Security or by following the Account deletion page.

Premium payments and access

Albion Money does not store card details. We process purchase and membership identifiers, the purchase email and payment/access states to activate Premium, prevent fraud and retain required transaction records. Whop processes payment information under its privacy policy.

Whop Pixel and advertising measurement

Whop Pixel is loaded only after separate permission for advertising measurement. Whop receives public page visits, a browser identifier, device fingerprint and technical connection data, including IP address. We do not send names, emails, account IDs, messages or payment references. Automatic form, link and embedded content tracking is disabled. Whop may process these data in other countries under its privacy policy. Withdraw permission in Cookie preferences at any time.