Privacy policy

Effective Date: 11 November 2026
Last Updated: 11 November 2026

This Privacy Policy explains how Card4play collects, uses, shares and protects your personal information when you visit https://www.card4play.com (the "Site") or use our Services, and describes your rights regarding that information.

By using the Site, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree, please do not use the Site.

1. Who Is Responsible for Your Data

1.1 Data controller. The Site is owned and operated by Nebula Digital Limited, a company incorporated in Hong Kong (Company No. 79523237), registered office at Room 13, Flat A, 7/F, House of Corona, 50 Hung To Road, Kwun Tong, Hong Kong ("Nebula", "Card4play", "we", "us" or "our"). Nebula decides how and why your personal information is processed and is responsible for it under this Policy, for all markets in which the Site is offered.

1.2 Middle East payment and supply partner. BUTEO – FZCO, a free zone company registered in Dubai Silicon Oasis, United Arab Emirates (Licence No. 34820), Building A1, Dubai Digital Park, Dubai Silicon Oasis, Dubai, UAE ("Buteo"), is Nebula's payment and supply partner for the Middle East. Buteo processes payments for orders paid through our Middle East local payment channels, MyFatoorah and Ziina. For this purpose, Buteo receives and processes the order and payment information needed to process, reconcile and refund those payments, on Nebula's behalf and under Nebula's instructions, and is bound to protect it in line with this Policy. Buteo does not use your information for its own marketing or for any other purpose.

2. Information We Collect

We collect information necessary to provide our core Services (required), and optional information that improves your experience. If we introduce new features that require new categories of information, we will ask for your consent where the law requires it.

2.1 Information You Provide Directly

  • Account information: name, email address, phone number, username, password.

  • Order and payment information: billing details, transaction history, redemption codes, and top-up account or game IDs. Payment card details are entered directly with our PCI-DSS compliant payment service providers; neither Nebula nor Buteo stores full card numbers.

  • Identity verification (KYC) information: government-issued ID, passport or other documents, where required for anti-fraud or regulatory compliance.

  • Communications: messages you send through customer support, live chat, WhatsApp, surveys or feedback forms.

2.2 Information Collected Automatically

  • Device and usage data: IP address, browser type, operating system, device identifiers, pages visited, click patterns, referring URLs and timestamps.

  • Location data: approximate location inferred from your IP address.

  • Cookies and similar technologies: see Section 6.

2.3 Non-Personal Information

We may collect aggregated or de-identified data (for example, general usage statistics) that does not identify you. If such data is combined with personal information, we treat the combined data as personal information under this Policy.

3. How We Use Your Information

We use your information to:

  • process and deliver your orders, including verifying payment and preventing fraud;

  • create and manage your account and Wallet;

  • provide customer support and respond to enquiries;

  • detect, investigate and prevent fraudulent transactions, security incidents and abuse of the Site;

  • comply with legal, regulatory, tax and KYC / anti-money-laundering obligations;

  • improve and personalise the Site and our Services, including analytics on usage patterns;

  • send transactional communications (order confirmations, security alerts) and, if you have opted in, marketing communications, which you can opt out of at any time;

  • enforce our Terms & Conditions and protect the rights, property and safety of Card4play, our users and the public.

We do not sell or rent your personal information, and we do not use it for advertising without your consent.

4. How We Share Your Information

We may share your information with:

  • Buteo, our Middle East payment and supply partner, only for orders paid through MyFatoorah or Ziina, to process, reconcile and refund those payments as described in Section 1.2;

  • Payment service providers and financial institutions, to process transactions, verify payments and handle refunds and chargebacks. Some providers (for example, Tebex Limited, UK) may act as reseller or merchant of record for your payment and process your data under their own privacy policies;

  • Service providers that perform functions on our behalf (for example, hosting, customer support tools, fraud prevention and analytics), under contracts that require them to protect your information and use it only for the purposes we specify;

  • Product suppliers and third-party platforms (including, for Products sourced from Middle East suppliers, through Buteo), only as needed to fulfil a direct top-up you requested (for example, passing on the game account ID you provided);

  • Legal and regulatory authorities, where required by law, legal process or a governmental request, or where necessary to protect our rights, prevent fraud or keep our users safe;

  • Successors, in connection with a merger, acquisition, restructuring or sale of assets, on condition that they honour this Privacy Policy.

We do not share your personal information with third parties for their own marketing without your express consent.

5. Data Retention

We keep personal information only as long as needed for the purposes in this Policy, including legal, accounting, tax and regulatory requirements (for example, transaction records kept for anti-money-laundering purposes). When information is no longer needed, we delete or anonymise it. Residual copies may remain in backup systems for a limited period until routine deletion.

6. Cookies and Similar Technologies

We use cookies and similar technologies to:

  • keep you logged in and remember your preferences;

  • analyse site traffic and usage patterns;

  • measure the effectiveness of our marketing and promotions;

  • support fraud detection and security.

You can control cookies through your browser settings, including disabling them, but some features of the Site may then not work. Where the law requires it, we ask for your consent before setting non-essential cookies.

7. Data Security

We use industry-standard technical and organisational measures to protect your information, including:

  • encryption of data in transit (TLS/SSL) and, where applicable, at rest;

  • access controls that limit who at Nebula and Buteo can access personal information, on a need-to-know basis;

  • regular security reviews and monitoring for suspicious activity.

No method of transmission or storage is 100% secure. If we become aware of a security incident affecting your personal information, we will notify you and the relevant authorities as required by law, and take reasonable steps to limit the harm. Please keep your password confidential and tell us promptly at support@card4play.com if you suspect unauthorised access to your account.

8. International Data Transfers

Nebula is based in Hong Kong. Your information may be processed or stored in Hong Kong, in the United Arab Emirates (by Buteo, for MyFatoorah and Ziina payments), and in other countries where our payment and service providers operate. When we transfer personal information across borders, we take reasonable steps to make sure it receives a level of protection consistent with this Policy and applicable law, including the Hong Kong Personal Data (Privacy) Ordinance (Cap. 486) and, where applicable, the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021).

9. Your Rights

Depending on where you live, you may have the right to:

  • access the personal information we hold about you;

  • correct inaccurate or incomplete information;

  • request deletion of your personal information, subject to legal retention requirements;

  • withdraw consent where processing is based on consent (this does not affect processing before withdrawal);

  • object to or restrict certain processing, including marketing;

  • data portability, where applicable.

To exercise these rights, contact us at support@card4play.com. Requests are handled by Nebula, including requests about payment data held by Buteo. We will respond within a reasonable time, generally within 15 days, after verifying your identity. We may decline requests that are manifestly unfounded, excessive or prohibited by law.

10. Children's Privacy

Card4play does not knowingly collect personal information from children under 13 (or the relevant minimum age in your jurisdiction) without verifiable parental or guardian consent. If you are a parent or guardian and believe your child has given us personal information without your consent, contact us at support@card4play.com and we will delete it.

11. Third-Party Links

The Site may contain links to third-party websites or platforms (for example, the platforms where our Products are redeemed). This Policy does not apply to those sites, and we are not responsible for their privacy practices. Please review their privacy policies.

12. Changes to This Privacy Policy

We may update this Policy from time to time. We will post the updated Policy on this page with a new "Last Updated" date, and for material changes we will give additional notice (for example, by email or a prominent notice on the Site) before they take effect.

13. Contact Us

For questions, requests or complaints about this Policy or our data practices:

Data controller
Nebula Digital Limited (Company No. 79523237, Hong Kong)
Room 13, Flat A, 7/F, House of Corona, 50 Hung To Road, Kwun Tong, Hong Kong
Email: support@card4play.com

Middle East payment and supply partner (MyFatoorah and Ziina payments)
BUTEO – FZCO (Licence No. 34820, Dubai Silicon Oasis, UAE)
Building A1, Dubai Digital Park, Dubai Silicon Oasis, Dubai, United Arab Emirates