Privacy Policy
> last updated 06.10.2026 · operator: DEK KEY OÜ, Registry code 17506258
data controller
The data controller is DEK KEY OÜ ("OXIDE"), Registry code 17506258, Kivilinna tn 15-92, Narva, Ida-Viru maakond, Estonia. Contact: support@oxide.tech.
what we collect
| data | source | purpose |
|---|---|---|
| Steam ID, display name | Steam OpenID | Account creation & auth |
| Callsign (username) and tag photo | Onboarding form | Your public profile on the marketplace |
| Email address (optional) | Account settings (Dashboard → Account), if you add one | Receipts, order and refund alerts, support. Sign-in is via Steam and does not ask for an email; without one, order and refund updates show in Dashboard → Orders and Wallet |
| Trade URL | Onboarding form (optional) or account settings | Skin delivery via Steam |
| Discord handle (optional) | Account settings, if you add one | Support escalation |
| IP address and the country it resolves to, user agent | Automatic | Refusing new sign-ups from sanctioned countries; security & fraud prevention |
| Card details (not stored) | You, at card top-up | Forwarded to our payment processor for top-ups; the full card number is not stored |
| Billing address (name, street, city, postcode, country) | You, at card top-up | Forwarded to our payment processor to process the card payment; the country is checked for sanctions and fraud screening. Saved only in your browser to prefill the form next time (see the Cookie Policy), not on our servers |
| Legal name, residential address | Identity verification (KYC) | Verify sellers before payout; legal & anti-fraud compliance |
| Identity document image (e.g. passport) | Identity verification (KYC) | Verify identity before releasing a withdrawal |
| Payout details (bank card / account) | Withdrawal request | Pay out seller earnings |
| Contact-form messages (name, email, message) | Contact form | Answer your support enquiry |
| Order history | Platform activity | Service delivery & disputes |
how we use your data
- ▸Process purchases and deliver items
- ▸Send transactional emails (receipts, trade updates)
- ▸Prevent fraud and meet legal record-keeping obligations
data sharing
- ▸Skin marketplaces we buy items on for you — to execute trades (Steam ID + trade URL)
- ▸Payment processor — to process card payments (card details forwarded at checkout)
- ▸A messaging service used for internal alerts — we send operational notifications (e.g. a new signup, order, top-up or payout) to our own staff channel on a messaging service; these messages can include your email address and transaction details
- ▸An AI assistant provider — item names are sent to generate the automated market-analysis text shown on product pages; no personal data is included
- ▸Hosting and database providers — run the website, the database and file storage, so they process the data described above on our behalf (see "where your data is processed")
- ▸An email delivery provider — receives your email address and the message, to send you account, top-up and order emails
- ▸Law enforcement — when required by law
We never sell, rent, or share your data for advertising purposes.
legal bases (GDPR)
- ▸Contract — to deliver the purchases and services you request
- ▸Legal obligation — record-keeping, KYC and anti-fraud compliance
- ▸Legitimate interest — fraud prevention and platform security
- ▸Consent — where separately requested
where your data is processed
OXIDE's application functions execute in the United States (US East, Washington DC), and our database and file storage are hosted in the US. Personal data is therefore processed in the US. Our payment processor operates under the EU-US Data Privacy Framework, and where we transfer personal data from the EEA/UK we rely on that framework or on Standard Contractual Clauses. The internal-alert notifications above are an additional transfer to the messaging service's infrastructure.
data retention
Account data is retained while your account is active. Order records are kept for 7 years for legal record-keeping compliance. You can request deletion at any time — we will erase all non-legally-required data within 30 days.
your rights
- ▸Access — request a copy of your data
- ▸Rectification — correct inaccurate information
- ▸Erasure — delete your account and data
- ▸Portability — export your data in machine-readable format
- ▸Objection — opt out of non-essential processing
- ▸Restriction — ask us to pause processing while a query is resolved
> you also have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or your local supervisory authority
Email support@oxide.tech to exercise any right. We respond within 30 days.
cookies
See our Cookie Policy for details on what cookies we use and how to manage them.
changes
We post material changes on this page and update the “last updated” date at least 14 days before they take effect; where we hold your email address we will also notify you.