Privacy Policy

DEK KEY OÜ (Registry Code 17506258), Kivilinna tn 15-92, Narva, Ida-Viru maakond, Estonia ("Rift", "we") is the data controller. To reach us about your data, use our contact form or email support@rift.army.

• ▸Contract — creating your account, running your wallet, buying and delivering items, paying out seller proceeds, answering contact-form messages
• ▸Legal obligation — identity verification before payouts, anti-money-laundering checks, keeping accounting records
• ▸Legitimate interest — fraud prevention and security, including the internal alerts described in section 4

We do not send marketing email, run a newsletter, or use analytics or advertising trackers.

• ▸Skin marketplaces we buy items on for you — the market that fulfils your purchase receives your Steam trade URL (which contains your Steam account number and trade token) and the item you bought, so the seller can send it to you.
• ▸The marketplace that holds items listed by Rift users — only for those items: the seller's Steam trade URL when the item is deposited into custody, and the buyer's Steam trade URL when it is delivered. Item names are also sent to it to look up recent sale prices, with no personal data.
• ▸Our payment provider (PCI-DSS compliant) — your card details, billing address, email address, IP address and the amount, to authorise wallet top-ups.
• ▸A messaging service used for internal alerts — our team receives internal alerts in a private channel on a messaging service. They contain your email address (or account id) when you sign up or sign in; your email, the amount and the last 4 digits of your card on a top-up attempt; your email and amount on a payout request; your email and Steam trade URL if a purchase fails; and the name, email and text of contact-form messages.
• ▸An AI assistant provider — generates the market analysis on item pages. It receives the item name and price data only, never your personal data.
• ▸Hosting and database providers — host the website, the database and file storage (see section 5). Identity documents are kept in a private file store.
• ▸An email delivery provider — it sends our emails to you (a welcome email, top-up receipts, and order confirmations, delivery and refund notices), so it receives your email address and the message.
• ▸Authorities — when required by law.

We never sell or rent your data or share it for advertising.

Account data is kept while your account is active. You can delete your account from your account settings. Order and payment records are kept for 7 years for accounting law. Identity-verification data (name, identity document, address, payout details) is kept while your account exists and afterwards for as long as anti-money-laundering law requires. Contact-form messages stay in our support queue until we delete them.

Our website runs in the US East region (Washington, D.C.), and our database is hosted in US East (N. Virginia). Your data is therefore stored and processed in the United States. These transfers rely on the EU-US Data Privacy Framework or on Standard Contractual Clauses offered by these providers.

• ▸Access and portability — download a copy of your data from your account settings, or ask us for it
• ▸Rectification — correct your details in account settings, or ask us
• ▸Erasure — delete your account in account settings; we keep only what the law requires
• ▸Restriction and objection — ask us to limit or stop processing based on legitimate interest

To exercise a right, use our contact form or email support@rift.army. We answer within 30 days. You can also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or your local supervisory authority.

See our Cookie Policy for the cookies and browser storage we use.

We will announce material changes on the site at least 14 days before they take effect and update the date at the top of this page.