Privacy Policy

Last updated: 8 September 2026

1. Controller

The controller responsible for data processing on AivonStore is UAB Aivon, a company registered in Lithuania under company code 307619983, registered office Pelesos g. 17-14, Vilnius LT-02114, Lithuania. Contact: support@aivonstore.com.

As we are established in Lithuania, the competent supervisory authority is the Lithuanian State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, L. Sapiegos g. 17, Vilnius).

2. General information on data processing

We process personal data only where necessary to provide a functional store and our services, on the following legal bases: performance of a contract (account, orders, inventory), consent (analytics cookies), legal obligation (accounting, anti-money-laundering), and legitimate interest (security and fraud prevention). Data is deleted or anonymized as soon as the purpose no longer applies and no statutory retention period requires storage.

3. Provision of the website and log files

When you visit AivonStore, our server temporarily records technical data transmitted by your browser: IP address, date and time, requested page, browser type and operating system. This data is required to deliver the website, ensure stability, and investigate abuse, and is deleted on a rolling basis. It is not merged with other data about you.

4. Cookies and consent

AivonStore uses two kinds of cookies:

• Essential cookies - a session cookie that keeps you signed in and a CSRF token that protects forms. These are technically required and set without consent.
• Analytics cookies - set by Google Analytics (see section 5), which loads with the page. We use it solely to measure how the site is used in aggregate - never to identify you individually.

The sign-in and registration pages additionally load the hCaptcha anti-abuse service, which may set its own cookies on those pages (see section 10).

You can delete or block cookies in your browser at any time, and Google's opt-out add-on (section 5) stops Analytics collection entirely.

5. Google Analytics

We load Google Analytics (via Google's gtag.js), a web analysis service of Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). We use it solely to measure site traffic in aggregate - pages visited, session duration, approximate region, device type - and not to identify any visitor individually: we do not link analytics data to accounts, orders or names. IP addresses are processed in shortened/anonymized form. Google may transfer this information to servers in the United States; transfers are based on the EU-US Data Privacy Framework and standard contractual clauses.

Legal basis: our legitimate interest in understanding aggregate usage of the store. Analytics data is retained for a maximum of 14 months. You can prevent collection at any time by blocking cookies in your browser or with Google's browser opt-out add-on (tools.google.com/dlpage/gaoptout).

6. Registration and user account

When you register we process your username, e-mail address and a cryptographic hash of your password (we never store the password itself). This data is required to operate your account. It is retained while your account exists and deleted upon account deletion, except where statutory retention periods apply to transaction records.

In your account settings you may optionally provide further profile data: a profile picture you upload, your country, and your Steam trade URL (used to deliver purchased bundles to your Steam account). Providing this data is voluntary; you can change or remove it at any time in your account settings. Uploaded profile pictures are re-encoded on our servers and stored without their original metadata.

To issue order invoices we additionally process billing details (name or company, address, city, postal code, phone number, country), collected in your account settings or during your first checkout. They appear on the invoices in your purchase history and are retained with the related transaction records for the statutory periods.

7. Steam sign-in

If you sign in through Steam, Steam confirms your identity to us via the OpenID procedure and we receive your public 64-bit SteamID and, where configured, your public persona name and avatar image. We never receive your Steam password. Responsibility for the processing carried out by Steam lies with Valve Corporation; see the Steam privacy policy.

8. Identity verification (KYC)

Selling to us. When we buy skins from a user (including under the upcoming sell-to-us programme), the sale requires identity verification, so for every selling user we process identity data: full name, date of birth, residential address, a government-issued photo ID, proof of address, confirmation of ownership of the payout method, and the linked SteamID. For business counterparties we additionally process company registration details and information on beneficial owners.

Buyers. Buying does not normally require verification. Where a card payment or account activity triggers our fraud or anti-money-laundering checks, we may ask the buyer to verify their identity before the transaction is released, and process the same categories of data for that purpose.

Legal basis: compliance with our legal obligations under anti-money-laundering and payment-services law, and our legitimate interest in preventing fraud and chargeback abuse. Identity documents are stored encrypted, are accessible only to staff handling compliance, and are retained for the statutory period (generally five years after the end of the business relationship), after which they are deleted. Verification may be carried out with the help of a specialist identity verification provider acting as our processor.

9. Purchases and payment data

When you buy we record your orders, deliveries and payment statuses. This is necessary to perform the contract and to meet accounting and anti-money-laundering obligations; such records are retained for the statutory periods.

Card payments are handled by PCI-DSS-compliant payment service providers - currently Stripe Payments Europe, Ltd. (see the Stripe privacy policy); the payment itself takes place with the provider and we receive only the data needed to match it to your order (transaction identifier, amount, currency and payment status). We never receive or store full card numbers.

Bank transfers necessarily show us the paying account holder's name, account number (IBAN) and the payment reference; this data appears on our bank statements and is retained with the accounting records for the statutory periods.

10. Support, live chat and hCaptcha

If you contact us by e-mail or via live chat, we process the data you provide (name, e-mail address, content of the message, transaction numbers) solely to handle your request. Support correspondence is deleted once the matter is closed, unless it belongs to a transaction record subject to retention.

The chat on our contact page is provided by tawk.to (tawk.to Inc., 187 East Warm Springs Rd, Las Vegas, NV 89119, USA), acting as our processor. The widget loads only when you start the chat; nothing is loaded from tawk.to before that. Once started, it processes technical data (IP address, browser information) and sets functional cookies to keep your chat session together. The chat is answered by an automated assistant; conversations it cannot resolve are forwarded to our support team together with the e-mail address you submit in the chat, and are handled like support correspondence above. Legal basis: our legitimate interest in offering direct support. See the tawk.to privacy policy.

To protect sign-in and registration against automated abuse we use hCaptcha, a service of Intuition Machines, Inc., 350 Alabama St, San Francisco, CA 94110, USA. When you complete the captcha, hCaptcha processes technical data (IP address, browser information, interaction behaviour) to distinguish humans from bots, and may set its own cookies on those pages. Legal basis: our legitimate interest in preventing spam and abuse. See the hCaptcha privacy policy.

11. Social media presences

We maintain a profile on Instagram to inform about news and offers. When you visit that profile, the platform processes your data under its own responsibility; see the Meta Platforms (Instagram) privacy policy. Our website itself does not embed social-media trackers; the link in the footer is a plain link.

12. Your rights

You have the right to access the personal data we hold about you, and to rectification, erasure, restriction of processing, data portability, and to object to processing based on legitimate interest. Where processing is based on consent, you may withdraw it at any time with effect for the future. To exercise any right, contact support@aivonstore.com. If you are in the EEA, you also have the right to lodge a complaint with a data protection supervisory authority.

13. Changes to this policy

We will update this policy whenever our processing changes, and indicate the date of the latest revision at the top of this page.