Privacy policy

01Scope and controller

tangogc operates the gift card buyback service on this website. For the purposes of applicable data protection law, tangogc is the controller of the personal data described in this policy.

This policy covers what happens when you request a quote, submit a card for verification, receive a payout, or talk to an agent on WhatsApp, Telegram or email. It does not cover third-party sites we link to.

02What we collect

• Contact details — the name, email address, phone number or messaging handle you give us so we can reply.
• Payout details — the bank account, wallet address or mobile money number that funds are sent to.
• Trade details — card brand, currency, face value, the rate quoted to you, and settlement status.
• Card and verification data — the card number and PIN, or a photo of a physical card, plus the verification screenshots our agents record.
• Technical data — IP address, device and browser type, pages viewed, and the language you select.
• Conversation records — the messages exchanged with our agents before, during and after a trade.

We do not ask for your card's expiry date or CVV, and we never ask for the password to any account.

03Why we use it

• Verify that a card is valid and unused, and calculate the payout you are owed.
• Send your money and keep the accounting records the law requires.
• Detect stolen cards, duplicate submissions, fraud and money laundering.
• Answer your questions and keep a record of what was agreed.
• Improve the service using aggregated figures that do not identify you.

Where the law requires a legal basis, we rely on performing our contract with you, complying with legal obligations, our legitimate interest in preventing fraud, and — for optional messages — your consent.

04Protecting card codes

A card code is the most sensitive thing we handle: whoever holds it can spend the balance. It is treated separately from the rest of your account data.

• Stored encrypted. Only the risk and verification team can decrypt it.
• Hidden in full from agent dashboards once verification is complete.
• Masked permanently 7 days after the trade settles, and deleted with the trade record at the end of the retention period.
• Never sold, and never passed to a brand or issuer unless you ask us to or a lawful order requires it.

05Who we share with

We share personal data only with parties that help us run the trade, and only the parts they need:

• Payment providers and banks — to move your payout.
• Verification and risk vendors — under written contract, solely to check cards and screen for fraud.
• Hosting and messaging providers — that run the site and deliver our support messages.
• Authorities — where a lawful request or court order requires disclosure.

We do not sell personal data, and we do not share it with advertisers.

06International transfers

We serve sellers in several regions, so your data may be processed in a country other than your own. Where we transfer data internationally, we rely on recognised safeguards such as standard contractual clauses, and we keep verification data within the region where the trade is handled wherever we can.

07How long we keep it

• Trade records — 5 years after settlement, for accounting and anti-fraud obligations.
• Card codes — masked 7 days after the trade completes, deleted at the end of the retention window.
• Support conversations — 24 months from the last message.
• Marketing preferences — until you withdraw consent.

When a retention period ends, records are deleted or irreversibly anonymised.

08Your rights

Depending on where you live — the EU or UK GDPR, California's CCPA/CPRA, India's DPDP Act, Nigeria's NDPA or Ghana's Data Protection Act — you may have the right to:

• Ask what data we hold about you, and receive a copy.
• Correct anything inaccurate.
• Ask us to delete data we no longer need.
• Object to, or ask us to restrict, certain processing.
• Withdraw consent for optional messages at any time.
• Complain to your local data protection authority.

To exercise any of these, contact an agent or use the details in section 12. We reply within 30 days. We may ask you to prove you control the account or the card before acting, so that nobody else can read or erase your data.

09Cookies and storage

We do not run advertising or cross-site tracking cookies. The site stores your language choice in your browser's local storage so that pages open in the language you picked; clearing site data removes it. Standard server logs record requests for security and troubleshooting.

10Age requirement

The service is for people aged 18 or over. We do not knowingly collect data from minors. If we learn that a minor has submitted data, we will delete it.

11Changes to this policy

We may update this policy as the service or the law changes. Material changes are announced on this page with a new effective date, and where the change affects an active trade we will tell you directly.

12Contact us

Questions about this policy, or a request to access or delete your data: reach an agent on WhatsApp or Telegram, or use the contact page. Include the card brand and approximate trade date so we can find your record quickly.

Go to the contact page