Privacy Policy
Arcanum · Legal · Last updated 2026-09-29
Operated by TRAFFIXORA OÜ · registry code 17543319 · Maakri tn 19/1, 10145 Tallinn, Estonia
data controller
TRAFFIXORA OÜ (registry code 17543319), Maakri tn 19/1, 10145 Tallinn, Estonia ("ARCANUM") is the data controller. Contact: privacy@arcanum.boutique.
what we collect
| data | source | purpose |
|---|---|---|
| Steam ID, display name | Steam OpenID | Account creation & auth |
| Email address | Email sign-in / onboarding | Sign-in codes, receipts, support |
| Trade URL | Onboarding form | Skin delivery via Steam |
| Discord handle | Optional input | Support escalation |
| IP address, connection country, user agent | Automatic | Security, fraud prevention & sanctions checks |
| Payment reference (card handled by provider) | Payment provider | Wallet top-ups (once card payments are live) |
| Legal name, ID document, address | Seller verification (KYC) | Identity checks before seller payouts |
| Bank details (holder, IBAN, BIC, bank country) | Seller verification (KYC) | Seller payouts by bank transfer |
| Order history | Platform activity | Service delivery & disputes |
how we use your data
- ▸Process purchases and deliver items
- ▸Send transactional emails (receipts, trade updates)
- ▸Prevent fraud and meet our legal record-keeping and anti-money-laundering obligations
- ▸Refuse access to the site, sign-up and sign-in from Russia, Belarus, Iran, North Korea, Syria, Cuba, based on the country of your connection, and refuse new accounts for email addresses registered there (sanctions compliance)
- ▸Improve the platform (anonymous analytics only)
data sharing
- ▸TM Market (market.dota2.net) — the supplier that fulfils catalogue purchases. Receives your Steam trade URL (which contains your Steam account number and trade token) and the item you bought, so the seller can send it to you.
- ▸DMarket — only for items listed by ARCANUM users: the seller's Steam ID and trade URL when the item is deposited into our custody account. Item names are also sent to DMarket to look up recent sale prices, with no personal data.
- ▸Payment provider — to process card top-ups once they are live (card data goes to the provider, not to us)
- ▸Law enforcement — when required by law
We never sell, rent, or share your data for advertising purposes.
Identity documents submitted for seller verification are stored privately. They are never published at a public web address, and only authorised staff reviewers can open them, through a signed-in staff account.
data retention
- ▸Account & profile data — retained while your account is active; deleted within 30 days of a confirmed deletion request.
- ▸Order & transaction records — retained for 6 years after the transaction date, to meet legal record-keeping and fraud/AML obligations.
- ▸KYC / identity-verification documents — retained for 5 years after your last withdrawal, then securely deleted.
- ▸Support communications — retained for 2 years, then deleted.
- ▸Security logs (IP, user agent) — retained for 12 months, then deleted.
You can request deletion at any time — we will erase all non-legally-required data within 30 days. Some of our service providers may process data outside the European Economic Area; see our GDPR page for details on international transfers.
your rights
- ▸Access — request a copy of your data
- ▸Rectification — correct inaccurate information
- ▸Erasure — delete your account and data
- ▸Portability — export your data in machine-readable format
- ▸Objection — opt out of non-essential processing
You may also lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee), our lead supervisory authority, or with the data protection authority in the EU country where you live.
Email privacy@arcanum.boutique to exercise any right, or use the self-service data export and account deletion tools in Dashboard > Account. We respond within 30 days.
cookies
See our Cookie Policy for details on what cookies we use and how to manage them.
changes
We will notify you of material changes via email 14 days before they take effect.