Written to be read rather than skimmed past. If any of it is unclear, the support address at the bottom of the page reaches a person who will explain it.
The short version
We keep your email address so we can send your subscription, the details of the order itself so it can be tracked, and some technical information about the request so we can help when something goes wrong. We do not keep anything else, and we do not share any of it.
Your email address
This is the only thing about you we genuinely need. It is stored against the order and used to send the redemption link, and to reply if you write to us. It is not added to a mailing list, because there is no mailing list. Nothing else is sent to it.
The technical bits, explained
An IP address is roughly "which internet connection made this request". A user agent is "which browser and device". We record both against an order. The honest reason is support: when somebody writes in saying a payment did not arrive, matching them to their order without an interrogation is far easier if that information exists. The second reason is that repeated fraudulent orders are only visible if requests can be told apart.
What we deliberately avoid
There are no accounts here, so there is no password to leak. We never see a card number, because you never enter one. There are no analytics, no advertising trackers, and no cookies set for visitors browsing the site.
Who else is involved
The company that performs the currency swap sees the transaction details it needs to do that, and nothing about you personally. Nobody else is involved at all.
Changing your mind
Email us from the address attached to an order and ask us to delete it. We will. The one consequence worth knowing: once the record is gone we can no longer look up that order, so do this after your subscription has arrived rather than before.