Jamba Store
Favorites

Privacy policy

Version of 10.09.2026

This Policy describes what data the Jamba Store service collects (the storefront site jambastore.top, the order delivery platform jambastore.net, and the shop’s Telegram app and Telegram bot; all of them parts of a single Service run by one operator; hereinafter the “Service”), what it is used for, and what rights the user has. By using the Service you agree to this Policy. The data operator is named in the “Details” section below; the terms of service are set by the Public Offer.

1. What data we collect

  • Telegram profile data when signing in through Telegram: the id, the name, the username, the interface language, and a link to the profile photo.
  • Email address — for sending the receipt and order information.
  • Data needed to fulfil orders: the Steam account login, the PSN account region, the in-game identifier (ID/UID, zone, server) for mobile game top-ups, the Telegram username for Telegram Stars and Telegram Premium, and any other details you provide at checkout. For goods and services fulfilled by signing in to an account (the “with sign-in” method, PS Plus and EA Play subscriptions) you additionally give the login, password and backup codes of the PSN account: they are used solely to fulfil your order, are stored encrypted in the order conversation and are never included in email notifications; we recommend changing the account password once the order is complete. For goods delivered as a code (Steam game activation keys, gift codes) no access to your account is needed — an email address is enough, and the link to the order delivery page and the order information are sent there; the code itself is shown on the delivery page and in the “Orders” section.
  • Order history, the cart, favourites, reviews, support conversations in the order chat and by email (including attached images), bonus points and participation in the affiliate program.
  • Technical request data recorded when an order is placed and paid for: the date and time, the IP address, device and browser details, the browser language, and the source of the request (the site or the Telegram app). This data is stored with the order and is used to confirm the fact and circumstances of the purchase, to prevent fraud and to resolve payment disputes.
  • Technical operating data of the Service: cookies and browser local storage data, plus the application error log (the error text, the page address, the browser type) — for authorisation, for features to work and for diagnosing failures.
  • Referral source tags: advertising campaign tags, ad click identifiers and the partner code — stored in cookies for up to 30 days and recorded with the order, along with analytics counter identifiers. They are used to measure advertising performance, to credit partner rewards and to report conversions (section 3).
  • Technical identifiers the Service assigns to your browser: a device cookie tag lasting up to 400 days, a tag in the browser’s local storage and a technical fingerprint derived from it. They are stored with the order and used to prevent fraud and abuse, including checking orders against an internal list of bad-faith payers (by email address, IP address and device tags); if the check triggers, fulfilment of the order can be paused for manual review.
  • Traffic analytics data (Yandex Metrica, Google Analytics), including server-side reporting of paid orders (the order number and amount) to the Service’s own counters for conversion tracking.

2. What the data is used for

  • Placing and fulfilling orders, sending receipts and order status notifications (in Telegram and by email).
  • Running your personal account: order history, favourites, bonus points, the affiliate program.
  • User support and handling of complaints (in the order chat and by email).
  • Confirming the fact and circumstances of an order being placed and paid for, preventing fraud and resolving payment disputes, including when a payment is disputed through a bank (a chargeback).
  • Notifications about discounts and promotions — only on the topics you have enabled in your profile; you can unsubscribe at any time.
  • Analytics and improving how the Service works.
  • Meeting the requirements of the law.

2.1. The legal basis for processing

We process data on the following grounds: your consent (given when you use the Service and place an order); performance of the contract you are a party to (the Public Offer); compliance with duties the law places on us (including tax and reporting duties); and our legitimate interest — keeping the Service secure, preventing fraud and defending our rights in disputes, where this does not override your rights and freedoms. A single purpose may rest on several grounds at once.

3. Who the data is shared with

  • Payment services — as far as is needed to take and verify the payment: the amount, contents and number of the order, the email address for the receipt, and the identifier of the digital item’s recipient: the Steam login for a balance top-up (the login is also checked through the payment service for eligibility before the order is created), the Telegram username and id when ordering Telegram Stars or Telegram Premium, and the in-game identifier for game top-ups.
  • Services and suppliers engaged to fulfil orders (issuing codes, topping up balances and game accounts, crediting Telegram Stars/Premium) — only the data of the particular order: the denomination and the recipient’s identifier (login, in-game ID, Telegram username).
  • Telegram — to deliver notifications through the bot; the email provider — to send messages (receipts, order notifications, support replies) and to receive incoming enquiries.
  • The payment provider, the bank and the authorised bodies — evidence that the order was fulfilled (technical checkout data, conversations, statuses) when a payment is disputed or checked.
  • Advertising and analytics platforms (Yandex Metrica, Google Analytics, Google Ads) — the fact and the amount of a paid order, tied to an ad click or counter identifier, for conversion tracking; the buyer’s name, email address and IP address are not shared. If your visit was brought in by an affiliate program participant who advertises with Google Ads, the fact of payment, the amount and the order number, together with the ad click identifier, are reported to the conversion tracking of their advertising account; the buyer’s contact details are never part of that report.
  • The partner whose link you arrived through — so that their reward can be calculated transparently, their dashboard shows details of your paid orders: the contents, the reward amount, the date, the referral source and your email address. The partner receives none of your payment details, passwords or conversations.
  • State bodies — solely in the cases the law expressly provides for.

Some of the services engaged (payment and email providers, digital goods suppliers, hosting) may be located outside your country of residence. Cross-border transfers are made only to the minimum extent needed to conclude and perform the contract you are a party to, and otherwise with your consent. We do not sell personal data.

4. Payment data

Payment takes place on the secure pages of the payment providers. Bank card details are processed by the payment provider and never reach us: we neither receive nor store full card data.

5. Cookies and local storage

The Service uses cookies and the browser’s local storage for authorisation, for the cart, to remember the region you chose and — if you wish — your Steam login on your own device, and for analytics. You can switch them off or clear them in your browser settings, though some features of the Service may then stop working.

6. Storage and protection

  • Data travels over a secure connection (TLS) and is stored on servers with restricted access.
  • Only the people who need it to run the Service have access to the data.
  • Data is kept for as long as you use the Service. After that, order and payment data (including technical checkout data) is kept for the periods the law sets for accounting and tax reporting, and for as long as is needed to defend our rights in possible disputes and claims; once those periods run out the data is deleted or anonymised.

7. Your rights

  • To find out what data about you is stored and to receive a copy of it.
  • To demand that inaccurate data be corrected, or that data be deleted where the law does not require it to be kept.
  • To withdraw your consent to data processing — which may make using the Service impossible.
  • To opt out of marketing notifications — with the switches in your profile or on request.

Send requests to the contacts in the “Details” section; we answer within 10 working days. In the cases the law provides for, that period can be extended by no more than 5 working days, with notice of the reasons.

8. Data of affiliate program participants

When a partner account is registered and used we process: the email address and the password (stored only as a cryptographic hash and not recoverable); the Telegram username given for contact; the two-factor authentication secret and the backup codes (stored encrypted and as hashes respectively); payout details — a USDT TRC20 wallet address, or the recipient’s surname, first name, patronymic, phone number and bank for an SBP transfer (stored encrypted and shown abbreviated in the interface); records of accruals, balance and payouts made; technical tags of the partner’s browsers — to spot their own purchases, which earn no reward; and support conversations in the dashboard chat.

For account security an access event log is kept: the kind of event (sign-in, password change, change of payout details, withdrawal request, account closure), the outcome, the date and time, the IP address and browser details; passwords, confirmation codes and full payout details are never written to the log. The partner is emailed about sign-ins and significant actions, with the IP address and the device named.

When an account is closed (at the partner’s request or with the button in the “Security” section) the conversations and their attachments are deleted, the payout details and device tags are anonymised, and access to the account ends. Records of accruals and payouts made (amounts, dates) are kept, anonymised with respect to payment details, for the periods the law sets for accounting and tax reporting and for defending rights in possible disputes.

9. The age of users

The Service is intended for people aged 18 and over. We do not knowingly collect children’s data.

10. Changes to the Policy

We may update the Policy by publishing a new version on this page with its date. Continuing to use the Service after publication means you accept the updated version.

Payout details

Email: support@jambastore.top