Last updated: 31 Aug, 2026 · Applies to leprestore.com and all orders
For your order itself we need only your email, your character and server, your order chats, and — for piloted services — the game login you share for the boost. Analytics and ads run only on the cookie consent you control. We never sell your data, and your booster never sees your payment details. Full breakdown below.
The short version
- We collect what an order needs — account email, character/server, selected options, order chat.
- Card payments are processed by Stripe (PCI DSS Level 1 — the highest payment-security certification); we receive only the confirmation, amount and a payment reference, never your full card number.
- Piloted orders only: access to the game login you share is limited to your assigned booster and the staff handling your order, and we delete it once the order completes.
- We pass your booster your character, server and schedule — not your payment details, email or real name.
- Cookies run in four categories you control from the cookie banner — withdraw consent anytime.
- We never sell personal data for money — and marketing-cookie “sharing” (in the US state-law sense) switches off in Cookie settings.
- You can access, correct, export or delete your data — one message to support.
Who we are
Leprestore is operated by Arcane Software Ltd, 7 Bell Yard, London WC2A 2JR, United Kingdom — the data controller for everything described on this page. Privacy questions go to [email protected] (subject “Privacy”) or the 24/7 live chat.
What we collect
- Account data — email address, display name, password (stored as a hash — we can’t read it).
- Order data — the game, your character name, realm/region/server, the options you selected, order status and history.
- Order communication — messages and attachments in your order chat with your provider and our support.
- Game credentials (piloted orders only) — the login details you share for the boost inside your order. See Game credentials & your booster.
- Payment data — handled by our payment providers: card, Apple Pay and Google Pay payments run through Stripe — a PCI DSS Level 1 certified processor, the same payment infrastructure used by Amazon and Google — PayPal through PayPal, crypto through our crypto processors. Your card number travels encrypted from your browser straight to Stripe; we receive the confirmation, amount and a payment reference — never your full card number.
- Support & attribution — your messages to support and, if you choose to answer it, the optional “where did you find us” question after checkout.
- Technical data — IP address, browser and device type, pages visited; collected via cookies and similar tools (next section).
Why we use it — and what allows us to
| What we do | Legal basis (UK/EU GDPR) |
|---|---|
| Running your orders, order chat, refunds | Performance of our contract with you |
| Payment processing, tax and accounting records | Legal obligation |
| Fraud prevention, securing accounts and orders | Legitimate interest — keeping the store and your account safe |
| Analytics and improving the store | Consent (analytics cookies) |
| Ads and retargeting | Consent (marketing cookies) |
| Service emails about your order | Performance of contract |
| Newsletters and promos | Consent — unsubscribe link in every email |
We don’t make decisions about you by automation alone that have legal or similarly significant effects. Marketing cookies build advertising profiles with the vendors listed below — only with your consent. Your email and order details are needed to run your order — without them we can’t deliver it.
Cookies
Four categories, controlled from the cookie banner — and you can change your mind anytime via “Cookie settings” in the footer:
- Necessary — checkout, sessions, security (including Cloudflare’s security/CDN function). Always on: the store doesn’t work without them.
- Analytics — Google Analytics / Tag Manager, Microsoft Clarity, Cloudflare Web Analytics. Only with your consent.
- Marketing — Google Ads, Bing, Reddit and TikTok retargeting tags. Only with your consent.
- Preferences — remembers your choices (currency, region). Only with your consent.
Who we share data with
Only what each party needs, never for sale:
- Your assigned provider (booster) — we pass your character, server, order options and schedule. We don’t pass your email, payment details or real name — though anything you type in the order chat, your booster can read.
- Payment providers — Stripe (cards and wallets), PayPal and our crypto processors — to process your payment and refunds.
- Infrastructure — hosting, Cloudflare (security/CDN), email delivery.
- Analytics and ads vendors — per your cookie consent above.
- Authorities — only where the law requires it.
We don’t sell or rent personal data. If we invite you to review us on Trustpilot, Trustpilot receives your email and order reference to verify the review is genuine — leaving a review is always optional.
Game credentials & your booster
Piloted orders need your game login — here is exactly how we treat it:
- access to the login you share is limited to your assigned booster and the staff handling your order — nobody else;
- we delete it once the order completes, is cancelled or refunded — and immediately if you ask;
- the login you share may itself be an email address — the same access limits apply to it;
- always change your password after a piloted order — it takes a minute and closes the loop for good.
International transfers
We’re a UK company; some of our processors run globally. Where data leaves the UK/EEA, we rely on recognised safeguards — adequacy decisions or standard contractual clauses. Email [email protected] for a copy of the safeguards we use.
How long we keep it
- Order and billing records — as long as tax and accounting law requires (up to 6 years in the UK).
- Order chats — kept up to 24 months after the order closes (longer only while a dispute is open), then deleted.
- Game login details — deleted when the order completes, is cancelled or refunded — and immediately on your request.
- Account — until you delete it; deleting the account removes personal data not covered by legal retention. Deleting your account also closes your Leprecoin balance — spend it or sort it out with support first.
- Analytics/ads data — per the vendor’s retention, controlled by your consent.
Your rights
Access, correction, export (portability), deletion, restriction and objection — plus withdrawing any consent, anytime. One message to [email protected] or the live chat does it; we respond within a month (unusually complex requests can lawfully take up to two months more — we’ll tell you within the first month if that applies). If you’re unhappy with our answer, you can complain to the UK ICO or your local data-protection authority — though we’d appreciate the chance to fix it first.
Security
Traffic is encrypted (TLS), access to personal data is limited to the people who need it to handle your order, and full card numbers never reach our servers — card payments go from your browser straight to Stripe, a PCI DSS Level 1 certified processor, and we receive only the confirmation, amount and a payment reference. No system is 100% immune — if a breach ever affects your data, we’ll notify you and the regulator as the law requires.
Age
Leprestore is intended for users 18 and older. We don’t knowingly collect data from children; if you believe a minor has used the store, contact us and we’ll delete the data.
Changes
Material changes are announced on this page with their effective date; the “Last updated” date above always shows the current version.
Contact us
[email protected] · 24/7 live chat · Arcane Software Ltd, 7 Bell Yard, London WC2A 2JR, United Kingdom.
Privacy FAQ
Does Leprestore sell my data?
No — we never sell your data for money. We share it only with your assigned booster and the service providers that run the store (payments, hosting, support tools), plus authorities where the law requires — and, only with your consent, with analytics and ad platforms. Some US state laws count ad-retargeting cookies as “sharing” — switching marketing cookies off in Cookie settings is your opt-out.
Is it safe to share my game account for a piloted boost?
Access to the login you share is limited to your assigned booster and the staff handling your order, and we delete it once the order completes, is cancelled or refunded. Change your password afterwards — always.
What does my booster actually see?
We pass your character, server, order options and schedule — not your email, payment details or real name. Anything you write in the order chat is visible to them too.
Do you store my card number?
No. Card payments are processed by Stripe — a PCI DSS Level 1 certified processor — and your card number travels encrypted from your browser straight to Stripe. We receive the confirmation, amount and a payment reference — never the full card number.
How do I delete my data?
Email [email protected] or ask in the 24/7 live chat. Account data is deleted; billing records stay up to 6 years (UK tax law) and closed-order chats up to 24 months.