Privacy Policy
Last updated: 9 October 2026
Who is responsible for your data
Cart Digital Ltd is the data controller for the personal data this site collects. CartLobbies is a trading name of Cart Digital Ltd, a company registered in England and Wales (company number 17492959). Registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. Questions about your data go to support@cartlobbies.com.
When you sign in with Discord
Signing in asks Discord to share your Discord user ID, username, display name, avatar and email address. We store those, and we store the email only if Discord has verified it. We use them to know who you are when you come back and to send you your order emails.
Signing in also adds your Discord account to our Discord server, which is where your orders are delivered. You can leave the server at any time. Discord gives us a temporary access token during sign-in; we use it to read the details above and to add you to the server, and we do not keep it.
When you place an order
We keep the order: the services you bought, your answers to each service's questions, the amounts charged, the payment method you chose, and the email address you chose for your order emails (your Discord email or another one you typed).
When you pay
PayPal payments are made on PayPal's own page. PayPal collects your PayPal or card details under its own privacy policy; we never see them. On that page you enter the amount, your Discord username and your order number, which PayPal passes to us with the payment.
When you send proof of payment, we keep the payment details you type, the screenshot you upload, and the IP address and browser your proof was sent from. Our staff see these in a private Discord channel and on our site, to check your payment.
Your order ticket
When your payment is confirmed, we open a private channel for your order in our Discord server. You, our staff and our bot can see it. It starts with your order's items, your answers, the total and the payment method, and our staff deliver your order there.
When staff close your ticket, we save a copy of its messages, pictures and files as part of your order record, and you can read it on your order page. That copy includes anything you posted in the ticket, which is why logins go in the vault, never in the ticket.
Your game login (the vault)
If staff need your game login to deliver an order, they ask in your ticket, and you enter it on your order page: the platform, your login and password, and any backup codes or notes you choose to add.
It is encrypted before it is stored, with a key kept separately from our database, and it can be decrypted only for your order. Our staff decrypt it only while they work on your order, and every time they do is recorded with who and when. It is never put in a message, an email or a ticket log.
You can replace or delete it from your order page until your order is complete. It is deleted automatically 24 hours after your order is complete; we keep only a record that a login was given, not the login.
Emails we send you
We email you a receipt when your payment is confirmed and an update when your order is delivered, closed or refunded, to the address you chose at checkout. We send no marketing emails.
If you apply to work with us
Applying on our Work for Us page uses your Discord sign-in and the details you give us: your name, email, how to contact you, country, hours per week, the games and services you play, and any link or notes you add. We use them only to decide on your application and to email you about it.
If you become a booster, we also keep your booster ID, the booster name you choose, the orders we give you, your pay for each, and the crypto coin and wallet address you give us for payouts. Payout records, including your legal name and country on each payout statement, are kept for 6 years as accounting records. A declined application is deleted 12 months after we decide it.
Why we use your data
- To deliver your orders (our contract with you): your account, orders, answers, ticket, order emails and, when needed, your game login.
- To check payments and prevent fraud (our legitimate interests): payment proof, IP address and browser, and the order record, which we also use to answer disputes and chargebacks.
- To meet our legal duties: a UK company must keep records of its sales.
Who we share it with
We do not sell your data or share it for advertising. These providers handle it for us, only to run the site:
- Vercel: hosts the site and keeps standard request logs (IP address, page and time) to keep it running and secure.
- Neon: our database, which holds your account and orders.
- Cloudflare: stores payment screenshots and saved ticket logs.
- Discord: sign-in, our server and your order ticket.
- PayPal: online payments.
- Resend: sends your order emails.
Some of these providers process data outside the UK, including in the United States. Where they do, they protect it with safeguards approved under UK data protection law, such as standard contractual clauses.
How long we keep it
We keep order and payment records, including saved ticket logs and payment proof, for 6 years after the order, because a UK company must keep records of its sales and we may need them for disputes. A game login in the vault is deleted 24 hours after your order is complete. To stop abuse, we count how often some things are done (placing orders, sending payment proof, signing in and checking staff IDs) for each account or, before sign-in, each IP address. Those counts are deleted within two days. We keep your account until you ask us to delete it.
Cookies
Signing in sets a cookie that keeps you signed in for up to 30 days without a visit. It is listed, with the short-lived cookies used during sign-in, on our Cookie Policy. We use no advertising or analytics trackers and we do not build a profile of you. We measure how quickly pages load with Vercel Speed Insights, which records the page address and load times, not who you are, and sets no cookies.
Your rights
You can ask us for a copy of the data we hold about you, to correct it, to delete it, or to stop using it in some ways. Email support@cartlobbies.com. If you have placed an order, we keep its order and payment records for the time above, and delete the rest of your account.
If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk.
Children
You must be 18 or over to order, or have a parent or guardian's permission if you are under 18. Discord does not allow accounts under 13, so neither do we.
Changes
We update this policy when what the site does changes, and the date above shows when it last did.