data controller
The data controller is DEK KEY OÜ ("CRATE"), Registry code 17506258, Kivilinna tn 15-92, Narva, Ida-Viru maakond, Estonia.
For questions about your personal data, to exercise your rights, and for anything else, email support@crate.army.
what we collect
| data | source | purpose |
|---|---|---|
| Steam ID, display name | Steam OpenID | Account creation & auth |
| Username | Onboarding form | Your name on the marketplace |
| Email address (optional) | Onboarding form or account settings, if you add one | Receipts, delivery and refund emails, support. Steam sign-in gives us no email; without one, order updates show in your dashboard only |
| Trade URL | Onboarding form (optional) or account settings | Item delivery via Steam |
| Discord handle (optional) | Account settings, if you add one | Support escalation |
| IP address and the country it resolves to, user agent | Automatic | Refusing new sign-ups from sanctioned countries; security & fraud prevention |
| Card number, expiry, CVV, cardholder name | Wallet top-up form | Forwarded over TLS to our payment processor to authorise the top-up; we keep only a masked reference (such as the last four digits) |
| Billing address (street, city, postcode, country) | Wallet top-up form | Forwarded to our payment processor to process the card payment; the country is checked against the sanctions list |
| Order history, wallet top-ups and refunds | Platform activity | Service delivery & disputes |
| Legal name | KYC / withdrawal form | Identity verification for payouts (legal obligation, AML) |
| Government identity document (image) | KYC / withdrawal form | Identity verification for payouts (legal obligation, AML) |
| Residential address | KYC / withdrawal form | Identity verification for payouts (legal obligation, AML) |
| Payout details (card last 4 or IBAN) | KYC / withdrawal form | Paying out your seller proceeds |
| Name, email address and message | Contact form | Answering your message |
KYC data (legal name, identity-document image, address and payout details) is collected only when you request a payout of seller proceeds. The identity-document image is stored in a private object store and is readable only through an access-controlled, session-checked route; we retain it for the period required by anti-money-laundering record-keeping rules and then delete it.
how we use your data
- ▸Process purchases and deliver items
- ▸Send transactional emails (receipts, trade updates)
- ▸Prevent fraud and meet legal record-keeping obligations
data sharing
- ▸Skin marketplaces we buy items on for you — to execute trades (Steam ID + trade URL)
- ▸Payment processor — receives your card details, billing address and the amount over TLS at the moment of payment, to authorise wallet top-ups (we do not store full card numbers)
- ▸A messaging service used for internal alerts — our operations team receives internal notifications through a messaging service (a non-EU processor). These can include your email, order IDs and item names, top-up / purchase / payout amounts, card last 4, and your Steam trade URL. They are used for order fulfilment, support and fraud monitoring only.
- ▸An AI assistant provider — anonymised item names and public price data only, to generate market commentary. No personal data is sent.
- ▸Hosting and database providers — run the website, the database and file storage, so they process the data described above on our behalf (see section 8)
- ▸An email delivery provider — receives your email address and the message, to send you account, top-up and order emails
- ▸Law enforcement — when required by law
If you send us a message through the contact form, we store it (name, email, message) to answer you and notify our support team.
We never sell, rent, or share your data for advertising purposes.
data retention
Account data is retained while your account is active. Order records are kept for 7 years for legal record-keeping compliance. You can request deletion at any time — we will erase all non-legally-required data within 30 days.
your rights (GDPR)
Under the EU General Data Protection Regulation and Estonia's Personal Data Protection Act (Isikuandmete kaitse seadus) you have the following rights:
- ▸Access (Art. 15) — request a copy of your data in a structured, machine-readable format
- ▸Rectification (Art. 16) — correct inaccurate information
- ▸Erasure (Art. 17) — delete your account and data, except records we must keep by law
- ▸Portability (Art. 20) — export your data yourself, instantly, from Account Settings → Export my data, or request it by email
- ▸Objection (Art. 21) — opt out of non-essential processing
- ▸Restriction (Art. 18) — ask us to pause processing while a claim is assessed
Email support@crate.army with your request and Steam ID to exercise any right; we verify identity via Steam OpenID and respond within 30 days. You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or your local supervisory authority.
legal basis
- ▸Contract — processing necessary to deliver purchased items
- ▸Legal obligation — record-keeping and anti-money-laundering identity checks
- ▸Legitimate interest — fraud prevention and platform security
where your data is processed
Our application and database run on infrastructure in the United States (US East, Northern Virginia). Because you may be in the EU, transfers rely on Standard Contractual Clauses and our payment processor's EU-US Data Privacy Framework adequacy. We do not transfer data to countries without an adequate safeguard.
cookies
See our Cookie Policy for details on what cookies we use and how to manage them.
changes
We announce material changes on the site at least 14 days before they take effect and update the date at the top of this page; if you have added an email address to your account, we also email you.