Data transparency
Privacy & Cookies
This policy explains which personal data LeupShop collects, why we need it, who receives it, how long we keep it and what your rights are. It also lists every cookie and browser storage item the shop uses.
Last updated: September 27, 2026
1. Who we are and what this policy covers
LeupShop (leupshop.com, "we", "us") is responsible for the personal data described here. It applies when you visit the shop, create an account, place an order, use a subscription or contact our support.
It does not cover the services you use through our plans, such as YouTube, Spotify or Netflix. Those providers handle your data under their own privacy policies.
2. Data we collect
- Account: email address, full name, preferred language, sign-up date and whether your email is verified. Your password is stored only as a one-way hash, so nobody at LeupShop can read it.
- Profile: phone number and country, if you add them on the Profile page.
- Orders: products and plans, prices, discount or coupon, total, payment method, currency and exchange rate, payment reference and status history.
- Details you give for a product: the email address to invite or upgrade and, for some upgrades, that account's password. Passwords are encrypted before they are stored and are never shown back to you.
- Payments: we never receive card numbers. We see what the payment provider or bank notification contains: amount, currency, time, transfer note and, depending on the method, the sender's name or PayPal/Wise account.
- Subscriptions: start and end dates, status, the slot or profile assigned to you, and a history of events such as activation, renewal, expiry and cancellation.
- Support: the messages you send us by email, WhatsApp, Facebook or Telegram, with the name or username of that account, and notes our staff add to handle your requests.
- Security and technical data: your IP address and browser details, used for rate limits and the anti-bot check; a log each time you view a subscription's login details or request a Netflix code.
We do not ask for identity documents and do not collect sensitive data such as health or political opinions.
3. How we use your data and why
- To provide the service (performance of our contract with you): creating and managing your account, sending verification and password-reset emails, processing orders, matching payments, delivering and renewing subscriptions, and answering support requests.
- To keep the service safe (our legitimate interest): blocking bots and brute-force attempts, preventing a slot from being sold twice, detecting fraud and chargeback abuse, and logging who views login details.
- To meet legal obligations: keeping accounting and tax records and answering lawful requests from authorities.
- With your consent: analytics, described in section 7. You can withdraw consent at any time.
We do not sell your data, do not build advertising profiles and do not send marketing emails. The emails we send concern your account and orders.
5. How we protect your data
- Your browser never talks directly to the system that stores your data. Only the shop's server can, with a secret key.
- Your session is kept in httpOnly, Secure cookies that page scripts cannot read. The access token lasts 15 minutes, a sign-in lasts at most 90 days, and changing your password ends every session.
- Account passwords are hashed. Passwords you give us for a product and the login details of subscriptions are encrypted at rest.
- Login details can be viewed only while a subscription is active. Each view is logged and the response is never cached.
- Only staff who need the data for their work can access it.
No system is perfectly secure. If a breach is likely to put you at risk, we inform you and the competent authority as the law requires.
7. Analytics
Analytics stays off until you accept it in the cookie banner. If you accept:
- Google Analytics measures where visitors come from and how the shop performs as a store. Advertising personalisation is off, and data is kept for 14 months.
- PostHog (EU Cloud, Frankfurt) measures the steps of the purchase funnel and how features are used. Session recording, autocapture, surveys and feature flags are off.
- Vercel Web Analytics and Speed Insights measure page views and Core Web Vitals without cookies.
- What is sent: cleaned public page paths, product and plan IDs, market, language, currency, payment type, funnel step, and pseudonymous user and order IDs.
- What is never sent: email addresses, names, phone numbers, passwords, payment references, bank details, access tokens or search terms.
8. How long we keep data
- Account and profile: while your account is open. After a deletion request they are deleted or anonymised, except for the records below.
- Orders and payments: for as long as accounting and tax law requires.
- Subscription details and passwords you gave us: while the subscription is active and for as long afterwards as we need them to handle renewals, warranty claims and disputes.
- Email links: verification and password-reset links expire after 3 days.
- Unpaid orders: are cancelled after 24 hours and stay in your order history.
- Netflix codes: are shown once and never stored; only the request is logged.
- Security logs: for as long as needed to investigate abuse.
- Analytics: Google Analytics 14 months; PostHog and Vercel according to their project settings.
9. Your rights
- Access: ask for a copy of the personal data we hold about you.
- Correction: update your name, phone number and country on the Profile page. To change your email, contact us.
- Deletion: request it on the Security page. We review each request so that records the law requires us to keep are kept, and tell you what is kept and why.
- Objection and restriction: object to processing based on our legitimate interest, or ask us to limit it.
- Portability: receive the data you gave us in a machine-readable format.
- Withdrawing consent: change your Analytics choice at any time with Cookie settings in the footer.
- Complaint: contact the data protection authority where you live.
We answer within one month. To protect your account, we may ask you to write from the email on your account or otherwise confirm who you are.
10. International transfers
Our team and our providers work in several countries, including Vietnam, the European Union and the United States. When your data leaves your country, for example the European Economic Area, we rely on the safeguards the law provides, such as the European Commission's standard contractual clauses used by our providers.
11. Children
LeupShop is not intended for children under 16, and we do not knowingly collect their data. If you believe a child has given us personal data, contact us and we will delete it.
12. Changes to this policy
We update this policy when our services, providers or legal requirements change. The date at the top shows the latest version. If a change affects data we already hold, we tell you by email or on the shop before it applies, and if it needs your consent, we ask again.
13. Contact
For privacy questions or to exercise your rights, contact us through one of the channels below. Please write from the email on your account and include your order number where relevant. Never send us your password or a verification code.