Privacy Policy

The service

Zoymu is operated by Alaab FZE, registered in Sharjah, United Arab Emirates. The service connects buyers and sellers of digital in-game items. Company details and contacts are on the Company page.

Information we process

We process account and contact details, profile images, preferences, game-account identifiers, inventory snapshots, listings, purchases, sales, balances, delivery and support records. Security records include IP addresses, device information, sessions and account events. Linked game access is described separately below. Do not send passwords, two-factor codes or full card details to support.

When you sign in through Google, we may receive your account identifier, email, name and profile image. Snapchat provides an identifier and display name, plus a Bitmoji image if you allow it. Facebook provides an identifier, name and available profile image. We do not request access to your contacts, messages or posts. An avatar you upload takes priority over a provider image.

Information is used for requested account and order functions, support, security, fraud prevention, accounting and legal claims or obligations. The lawful basis depends on the purpose and applicable law; any required consent must be obtained separately. Optional avatar access is not required for purchases.

Linked game accounts

Where available, profile details from a linked Roblox account may include the username, age group, country setting, account status and privacy settings. These details come from the account; they do not verify the user’s age or location.

Linking a Roblox account, including through Quick Sign In, gives Zoymu game-session access to check the account, read its inventory and transfer items. Pausing sales does not unlink the account or remove its stored access. Unlinking removes stored active access after current operations are safely stopped; required transaction records may remain. You can also revoke the session in Roblox security settings.

Sharing and public activity

Information may be shared as necessary with hosting, authentication, fulfilment, security and support providers, or as law requires. External sign-in and image services receive connection information. Processing abroad is subject to applicable transfer requirements. Before a payment or identity-check provider receives your data, we identify the recipient, purpose and applicable privacy information.

The public activity feed may show the item received, the time and partially hidden participant or recipient names. These details may still identify a person. Pausing the feed affects your view only. Contact support about your data rights. The applicable safeguards for children's data still apply.

Identity and payment checks

We ask only for information needed for the check. Before requesting documents, we explain what to provide, why, who will receive it, how long it may be kept and how to send it securely. Do not send identity documents, passwords, login codes or full card details by email or chat. Verification does not require a payment or trade.

Your choices and rights

We keep records for as long as needed to provide the service and meet accounting, security or legal requirements. Some records must remain after an account is deleted. Contact support if you have questions about retention or account security.

Depending on applicable law, you may request access to, correction or deletion of your data, restriction of processing or data portability. You may also object to processing, withdraw consent or complain to the relevant authority. Withdrawing consent does not affect the lawfulness of earlier processing. We explain any limits on these rights and respond within the applicable legal deadlines. Identity checks must be proportionate.