Privacy Policy

1. Who We Are

GrindSell is a personal single-vendor marketplace for GTA Online accounts and boosting services. When we refer to "we", "us", or "our" in this policy, we mean the individual operating GrindSell at grindsell.com.

2. Data We Collect

We collect the following personal data when you use our service:

• Account registration: Your email address and a securely hashed password (we never store your password in plain text).
• Order information: Product purchased, amount paid, Stripe payment reference, order status, and timestamps.
• Boost service data: If you purchase a boost service, you provide your GTA/Xbox account email and password. This password is encrypted using AES-256-CBC before it is written to the database and is permanently deleted once your order is marked as completed.
• Messages: Chat messages you exchange with our team through the order chat system.
• Technical data: IP address (hashed, not stored in plain text), session identifiers, and browser cookies required for the site to function.

3. How We Use Your Data

We use your personal data exclusively for:

• Processing and fulfilling your orders.
• Communicating with you about your orders via the dashboard chat.
• Sending transactional emails (order confirmations, password resets, email verification). We do not send marketing emails.
• Maintaining account security and preventing fraud.
• Complying with applicable legal obligations.

4. GTA Account Credentials — Special Handling

Your GTA/Xbox account credentials are treated with the highest level of care:

• Passwords are encrypted using AES-256-CBC before storage.
• Only the GrindSell operator has access to the decryption key.
• Credentials are used solely to log into your account for the specific boost order you have placed — for no other purpose.
• Your password is permanently deleted (set to NULL in the database) as soon as your order is marked as completed.

5. Cookies

We use only technically necessary cookies. Specifically:

• Session cookie (PHPSESSID): Required for you to stay logged in and for form security (CSRF protection). Deleted when you close your browser or log out.
• Cookie consent cookie (gs_cookie_consent): Stores your acceptance of this cookie notice. Valid for 1 year.

We do not use analytics cookies, advertising cookies, or any third-party tracking cookies. Stripe may set its own cookies when you interact with the payment form — refer to Stripe's Privacy Policy for details.

6. Data Retention

• Account data: Retained for as long as your account is active. You may request deletion at any time (see Section 8).
• Order data: Retained for a minimum of 5 years to comply with accounting and legal obligations.
• GTA passwords: Deleted immediately upon order completion.
• Password reset tokens: Automatically expire after 1 hour and are invalidated after a single use.
• IP address hashes: Retained for up to 30 days for security purposes (rate limiting), then automatically deleted.

7. Data Sharing

We do not sell, rent, or share your personal data with third parties, except:

• Stripe, Inc.: Processes your payment. Your card details are handled entirely by Stripe and are never transmitted to or stored by GrindSell. See Stripe's Privacy Policy.
• Aruba S.p.A.: Provides the web hosting and email infrastructure for grindsell.com.
• Legal requirements: We may disclose data if required by law or in response to a valid legal request from a competent authority.

8. Your Rights (GDPR)

If you are located in the European Union or European Economic Area, you have the following rights regarding your personal data:

• Right of access: You can request a copy of all personal data we hold about you.
• Right to rectification: You can correct inaccurate data through your account settings.
• Right to erasure: You can request that we delete your account and associated personal data, subject to legal retention requirements.
• Right to restriction: You can ask us to restrict how we process your data in certain circumstances.
• Right to data portability: You can request a copy of your data in a structured, machine-readable format.
• Right to object: You can object to processing based on legitimate interests.

To exercise any of these rights, please contact us through the order chat in your dashboard. We will respond within 30 days.

9. Security

We implement the following technical measures to protect your data:

• All data in transit is encrypted via TLS/SSL (HTTPS).
• Passwords are hashed using bcrypt (PHP's PASSWORD_BCRYPT).
• GTA account passwords are encrypted with AES-256-CBC.
• All database queries use prepared statements to prevent SQL injection.
• CSRF tokens protect all forms.
• Session identifiers are regenerated after login.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be reflected by an updated "Last updated" date at the top of this page. We encourage you to review this policy periodically.

11. Contact

For any privacy-related questions, requests, or concerns, please use the order chat in your dashboard. We aim to respond to all privacy requests within 30 days.