Privacy Policy

1. Who We Are

BLOOP DIGITAL LTD is a company registered in England and Wales (company number 16554788). Our registered office is Suite A, 82 James Carter Road, Mildenhall, England, IP28 7DE. For anything about your data, email privacy@bloop.gg.

This policy covers the bloop.gg website, the emails we send about your orders, and the in-game deliveries we make in Roblox.

2. What We Collect

• Your Roblox account: its user ID, username, display name and profile picture. These are public on Roblox. We get them when you sign in, when you place an order for an account, and when you join our private server.
• Your sign-in check: to confirm an account is yours, we name a game for you to favourite and read your public Roblox favourites. We never ask for your Roblox password, and we never see it.
• Your orders: what you bought, the prices, what you paid, the order number, any refunds, and how the delivery went (when you joined our server, which trades we sent, and whether they were accepted).
• Your email address and checkout details: Shopify tells us about each payment, and we keep its notice with your order. It includes the email address you enter at checkout and Shopify’s record of the checkout, such as the IP address and browser it was made from.
• Your payment: Shopify runs our checkout. Your card or wallet details go to Shopify and the payment method you choose, never to us, though Shopify’s notice can name the card’s brand and a few of its digits (never the full number). We are told whether a payment went through, was refunded, or was disputed.
• Our private server: if you send a friend request to our server’s account to get in, or join the server without an order to collect, we see your Roblox user ID and record what we did (accepted, declined, or removed you).
• Your connection: your IP address, which we use to limit how often one connection can make requests. Our server log records it only for a request that failed, was too slow, or was turned away by those limits.
• Anything you send us when you contact us.

3. How We Use It

The law asks us to name the reason (the lawful basis) for each use. They are:

• To take your order, deliver your items, refund you when we can’t, and email you about it (your claim link, an item back in stock, a refund). This is needed to carry out our contract with you.
• To sign you in and show you your orders. Signing in is optional, and this is also part of our contract with you.
• To keep records of sales, payments and refunds. UK tax and company law requires us to.
• To keep the shop secure and fair: limiting requests, investigating failed requests, refusing orders linked to fraud or a chargeback, and keeping our private server for buyers. These are our legitimate interests in running a safe shop, and they don’t override your rights.
• To ask you once, after your order has been delivered, to leave a review. This is our legitimate interest in hearing how we did. It is the only email we send that isn’t about your order, and we send it once.

We don’t sell your data, we don’t show you advertising, and we don’t build a profile of you.

4. Cookies and Storage

We only use what the shop needs to work, so we don’t ask for cookie consent. There are no analytics, advertising or tracking cookies on bloop.gg.

• bloop_session: keeps you signed in, for up to 30 days or until you sign out.
• bloop_sign_in: ties a sign-in check to your browser while you complete it, for up to 30 minutes.
• In your browser’s storage, on your device only: your cart, the links to orders placed from this browser, and whether you were signed in, so the page shows the right button. Clearing this site’s data in your browser removes them.
• Cloudflare, which protects the site, may set a cookie of its own when it needs to check that a visitor isn’t a bot.

5. Who We Share It With

We share data only with the companies that help us run the shop, and only what each one needs:

• Shopify, which runs our checkout and takes payments. Its own privacy policy covers the checkout.
• Hetzner, which hosts our servers and database.
• Cloudflare, which carries traffic to the site, protects it from attacks, and stores encrypted copies of our backups.
• Our email provider, which sends the emails about your orders.
• Roblox, where delivery happens: our bots trade with your account inside the game. Roblox’s own privacy policy covers your Roblox account.
• Trustpilot, only if you choose to follow our review link.

We may also share data when the law requires it, with our professional advisers, or with anyone who takes over the business, who would then keep to this policy.

6. Data Outside the UK

Our providers may handle data outside the UK, including in the EU, the United States and Canada. When data leaves the UK, it goes only to a country the UK recognises as protecting it properly, or under contract terms approved by UK law (the International Data Transfer Agreement or Addendum).

7. How Long We Keep It

• Orders, payments, refunds and deliveries, with the email address and Roblox account they name, and the emails we sent about them: six years after the order, because UK tax law requires us to keep these records.
• Your sign-in account (Roblox user ID, username, display name and picture): until you ask us to delete it.
• Sign-in sessions: 30 days, or until you sign out. Sign-in checks are deleted shortly after they finish.
• Records of who we removed from or refused into our private server, or blocked from ordering: six years, like our order records.
• Server logs: overwritten automatically once each log reaches its size limit.
• Backups of our database: 35 days.

8. Your Rights

Under UK data protection law you can ask us to:

• give you a copy of the data we hold about you;
• correct anything that’s wrong;
• delete your data;
• limit how we use it, or stop using it for a reason based on our legitimate interests;
• give you the data you gave us in a format you can take elsewhere.

Email privacy@bloop.gg with your request and your order number or Roblox username. It’s free, and we’ll reply within one month. We may ask you to confirm the request comes from you, for example from the email address on the order. Some data we must keep even if you ask us to delete it, such as sales records the law requires; we’ll tell you if that applies.

If you’re unhappy with how we handle your data, please tell us first so we can put it right. You can also complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.

9. Children

Our Terms of Service only allow orders from people aged 13 or over, and anyone under 18 needs a parent’s or guardian’s permission. A parent may buy for a child’s Roblox account: we then use that account’s public Roblox details only to deliver the order.

We don’t knowingly collect anything else from children under 13. If you think a child under 13 has given us their data, contact us and we’ll delete it, apart from any record the law requires us to keep.

10. Keeping It Safe

Everything between your browser and bloop.gg is encrypted. We store sign-in tokens only in a scrambled (hashed) form, the copies of our backups kept away from our servers are encrypted, and only our staff can reach our systems: our admin pages need a password and a one-time code, and our servers accept only our own keys, over a private network. Your order page’s link contains a random key, so keep it to yourself: anyone with the link can see that order.

11. Changes to This Policy

We’ll update this policy when what we do with your data changes. The date at the top always shows the last update, and if a change affects an order you’ve placed, we’ll tell you by email.

12. Contacting Us

Email privacy@bloop.gg, or write to us at our registered office: BLOOP DIGITAL LTD, Suite A, 82 James Carter Road, Mildenhall, England, IP28 7DE.