Privacy Policy

1. Who we are

The service is operated by GudDrop. Legal corporate number 3-102-949815, registration date November 24, 2025, legalization number 4062001356531, with its registered address at Province 01, San Jose, Costa Rica.

For any privacy question or request, contact [email protected].

2. Data we collect

2.1. Data you give us

To use certain features — in particular withdrawals and payments — you may be asked for:

• your Steam trade URL;
• an email address for notifications and support;
• identity documents and proof of address, where identity verification (KYC) is required;
• payment details, which are entered with and held by our payment providers rather than by us.

2.2. Data we receive from Steam

Most of the site becomes available only after you sign in through Steam. On first sign-in we receive from Valve Corporation your Steam ID, profile name and avatar. Your Steam ID is used to create your account and to read the in-game items associated with it. We never receive your Steam password.

2.3. Transactions and balances

We store and process:

• your Forge Credits balance and its history;
• deposits and withdrawals, including their status and provider references;
• the items held in your account and their movements;
• every upgrade you play, including the stake, the target, the odds, the outcome and the provably fair seeds and nonce used to generate it;
• promo codes and bonuses you use.

We pass the details necessary to complete a payment to the chosen provider, and receive back status, transaction identifiers and limited payment metadata, including for fraud and anti-money-laundering checks where the law requires them.

2.4. Device and connection data

When you visit the site we may collect:

• IP address and the approximate location derived from it;
• browser type and version, operating system, screen size;
• the page that referred you;
• language and interface preferences, and technical identifiers used to recognise your device and keep the service secure.

2.5. Cookies and similar technologies

We use cookies and similar technologies as described in our Cookie Policy, to keep you signed in, remember preferences, measure usage and, where you consent, for marketing.

2.6. Support messages

Messages you send to support are kept so we can answer them, investigate incidents and improve the service.

3. Why we process it, and on what basis

We process personal data only where we have a lawful basis under applicable law, including the GDPR where it applies.

• Operating the service — creating and managing your account, letting you deposit, upgrade and withdraw, and keeping the site working. Basis: performance of a contract; legitimate interest in improving the service.
• Payments and transactions — processing deposits and withdrawals, verifying them, and keeping accounting records. Basis: performance of a contract; legal obligation; legitimate interest in preventing fraud.
• Fairness and integrity — retaining the seeds, nonces and outcomes needed to let you verify past rounds, and to investigate exploits or abuse. Basis: performance of a contract; legitimate interest.
• Security and fraud prevention — detecting and investigating fraud, abuse and unauthorised access, and enforcing our terms. Basis: legitimate interest; legal obligation.
• Support — answering questions and complaints. Basis: performance of a contract; legitimate interest.
• Marketing — sending news and offers, and measuring them. Basis: consent where required, otherwise legitimate interest in marketing to existing users. You can opt out at any time.
• Analytics — aggregated and anonymised statistics about how the site is used. Basis: legitimate interest.

4. How long we keep it

We keep personal data for as long as your account is open, and afterwards only as long as needed to meet legal, accounting and reporting obligations, resolve disputes and enforce our agreements.

After you delete your account, personal data is deleted, blocked or anonymised in line with applicable law. Some transactional records — deposits, withdrawals and the provably fair history of rounds you played — must be retained in a form that keeps that history consistent and verifiable, and are anonymised rather than erased.

5. Who we share it with

We do not sell your personal data. We share it with:

• Payment and trading providers — to execute deposits, withdrawals and refunds, and to run fraud and AML checks;
• Valve Corporation (Steam) — to the extent needed to authenticate you and to deliver or receive items;
• Processors acting for us — hosting, analytics, email delivery and support tooling, under contractual safeguards;
• Professional advisers — lawyers and auditors, where reasonably necessary to protect our rights;
• Authorities— where we are legally required to disclose, or where disclosure is necessary to protect our rights or someone’s safety;
• A successor — in a merger, acquisition or sale of assets, subject to confidentiality protections.

6. International transfers

Your data may be processed inside and outside the European Economic Area. Where data leaves the EEA we rely on an appropriate safeguard, such as the European Commission’s Standard Contractual Clauses. Everyone processing data on our behalf is required to keep it confidential and process it lawfully.

7. Your rights

Depending on where you live you may have the following rights over your personal data:

• Access — confirmation of whether we process your data, and a copy of it.
• Rectification — correction of inaccurate or incomplete data; some details you can change yourself in your account.
• Erasure — deletion of your data where it is no longer needed, where consent was the only basis and you withdraw it, or where you have objected and no overriding basis remains.
• Restriction — a pause on processing, for instance while we check accuracy or assess an objection.
• Portability — a machine-readable copy of data you gave us, where processing is automated and based on consent or a contract.
• Objection — to direct marketing at any time, and to processing based on legitimate interests.
• Withdrawal of consent — at any time, without affecting processing already carried out.
• Complaint — to your local data protection authority. We would ask you to raise it with us first.

To exercise any of these, write to [email protected]. We may need to verify your identity before acting on a request.

8. Children

The service is not intended for anyone under 18, or under any higher minimum age set by local law, and we do not knowingly collect their personal data. If you believe a minor has created an account, contact us and we will close it and delete the associated data.

9. Security

We take technical and organisational measures to protect personal data against unauthorised access, loss, alteration and disclosure — including encrypted transport (HTTPS), access controls, monitoring, and limiting access to those who need it. No online service can promise absolute security. You can help by protecting your Steam credentials, keeping Steam Guard enabled and never sharing account access.

10. Changes

We may update this policy to reflect changes to the service, the law or our practices. Material changes are published on this page with a new “last updated” date, and where the law requires it we will ask for your consent. Continuing to use the service after publication means you accept the updated policy. This version is dated 28 July 2026.

11. Contact

Privacy questions and data-protection requests: [email protected]. Anything else: [email protected]. Please include enough detail for us to identify your account.