Last updated: 10 July 2026
This Privacy Policy explains how SkinSpot ("SkinSpot", "we", "us", "our") collects, uses, shares, and protects personal data when you use skinspot.gg, our related services, and the SkinSpot browser extension (together, the "Service"). SkinSpot is a marketplace for Counter-Strike 2 (CS2) in-game items and is not affiliated with, endorsed by, or sponsored by Valve Corporation or Steam.
The Service is operated by Swen Tech OÜ, a private limited company (osaühing) registered in Estonia (registry code 17582503), which is the controller of the personal data described in this Policy for the purposes of the EU General Data Protection Regulation (GDPR). For any privacy question or request, contact us at contact@skinspot.gg.
| Category | What | Source |
|---|---|---|
| Steam account | Your public SteamID64, profile (persona) name, avatar, and your Steam trade URL. What we receive from your Steam profile depends on your Steam profile privacy settings. | Steam sign-in (OpenID) and your Steam Community profile |
| Contact | Email address (required, verified). Phone number, if you choose to verify one (used only to send the verification code and store your verified status). | You |
| Identity / KYC | Identity documents and a selfie/liveness check, and the resulting verification status. Documents are collected and processed by our verification provider (Sumsub); we receive the verification result. | You, via Sumsub |
| Payments | Crypto wallet addresses and deposit/withdrawal transaction references. We do not collect or store card numbers. | You and our payment providers (NOWPayments, MoonPay) |
| Marketplace | Listings, orders, offers, balances, transaction history, dispute and support messages. | Your use of the Service |
| Trades (extension) | Trade-offer metadata: offer ID and status, the items in the offer and their estimated values, the trade-offer message, and the public Steam profile information of your trade partner (SteamID, persona name, account age, and public VAC/trade-ban status). See Sections 5 and 6 for detail. | SkinSpot browser extension, with your permission |
| Technical | IP address, device/browser information, and server logs (including security and rate-limiting logs). | Automatically |
Under the GDPR, each use of personal data needs a legal basis. We use your data as follows:
| Purpose | Legal basis |
|---|---|
| Operate the marketplace: authenticate you, list and sell items, process orders, and deliver items via Steam trades | Performance of a contract (Art. 6(1)(b)) |
| Process deposits and withdrawals and maintain your balance | Performance of a contract; compliance with legal obligations (Art. 6(1)(b), (c)) |
| Verify your identity and meet anti-money-laundering (AML), sanctions, tax, and other legal obligations | Compliance with legal obligations (Art. 6(1)(c)) |
| Detect, prevent, and investigate fraud, scams, phishing, wash-trading, collusion, and trade reversals — including verifying that marketplace trades were actually delivered on Steam | Our and our users' legitimate interests in a safe, trustworthy marketplace (Art. 6(1)(f); Recital 47 recognises fraud prevention as a legitimate interest) |
| Provide support and resolve disputes | Performance of a contract; legitimate interests (Art. 6(1)(b), (f)) |
| Send transactional messages (email verification codes, SMS phone-verification codes, security notices) | Performance of a contract (Art. 6(1)(b)) |
| Secure and maintain the Service (logging, rate limiting, abuse prevention) | Legitimate interests (Art. 6(1)(f)) |
Where we rely on legitimate interests, you have the right to object (see Section 12). We do not use your personal data for third-party advertising, and we do not sell it.
We share the minimum data needed with providers who process it for us:
We may also disclose data to professional advisors (lawyers, accountants, auditors), to competent authorities where the law requires it, and, in the event of a merger, acquisition, or asset sale, to the parties to that transaction under confidentiality obligations. We do not sell your personal data and we do not share it with advertising networks or data brokers.
The extension is optional. Its single purpose is to automate and verify the delivery of CS2 trades for your SkinSpot orders. When you connect it to your SkinSpot account, you authorize it to:
The extension stores its connection token, known trade-offer IDs, and settings locally in your browser. It runs only on steamcommunity.com and skinspot.gg. It does not collect your Steam password; it does not read, monitor, or transmit your general browsing history, keystrokes, or the content of any other website; and the data it handles is never sold or used for advertising.
You can stop this processing at any time by disconnecting the extension (Log out in the extension popup) or uninstalling it. Without the extension, automatic delivery and delivery verification are unavailable and trades must be handled manually.
This section is addressed to Steam users who trade with a SkinSpot user but may not use SkinSpot themselves. When a SkinSpot user's extension processes a trade offer between you and them, we receive the public Steam information described in Section 5: your SteamID, persona name, account age, public VAC/trade-ban status, the items in the offer, and the trade-offer message. The source of this data is the Steam Community pages of the trade itself; we obtain nothing beyond what Steam makes visible to your trade partner. We process it only to verify delivery of marketplace orders and to protect our users against fraud (legitimate interests, Art. 6(1)(f) GDPR), and we retain it under the criteria in Section 9. Because we have no direct contact channel to Steam users outside our Service, we provide this information publicly here (Art. 14(5)(b) GDPR). If you believe we process data about you, you can exercise the rights in Section 12, including the right to object, by contacting contact@skinspot.gg with your SteamID.
We use only first-party, strictly necessary cookies: a signed session cookie that keeps you logged in, and a small set of display cookies (username, display name, avatar reference) so the interface can load instantly. We do not use third-party advertising or analytics tracking cookies. You can delete cookies in your browser at any time; doing so signs you out.
We are based in the European Economic Area (EEA) and some of our providers process data outside the EEA (for example in the United States). Where data leaves the EEA, we rely on an adequacy decision of the European Commission (including the EU–US Data Privacy Framework where the provider is certified) or on Standard Contractual Clauses (Art. 46 GDPR), together with additional safeguards where appropriate. You can request more information about these safeguards at contact@skinspot.gg.
Where an exact period is not stated, our criteria are: whether the data is needed for an open dispute or investigation, whether a statutory retention duty applies, and the limitation periods for legal claims.
We protect your data with encryption in transit (TLS), signed session credentials, access controls, and audit logging. Extension traffic to SkinSpot is sent only over HTTPS. No method of transmission or storage is 100% secure, but we work continuously to protect your information and will notify you and the supervisory authority of a personal-data breach where the GDPR requires it.
Our fraud screening may automatically pause a transaction or payout (for example, when a trade shows a Steam rollback or a suspicious pattern). A paused transaction is reviewed by a human before any final decision is made. We do not make decisions based solely on automated processing that produce legal or similarly significant effects for you (Art. 22 GDPR).
Under the GDPR you have the right to access, rectify, erase, and receive a copy of your data (portability), to restrict processing, to object to processing based on legitimate interests, and to withdraw any consent at any time. To exercise these rights, contact contact@skinspot.gg; we respond within one month. Some data must be retained to meet legal/AML obligations even after an account is closed, and we will tell you when that is the case.
You also have the right to lodge a complaint with a supervisory authority — in Estonia, the Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate, Tatari 39, 10134 Tallinn, info@aki.ee, aki.ee) — or with the authority of your habitual residence. If you are in Türkiye, you may additionally exercise your rights under Article 11 of the Personal Data Protection Law (KVKK) by writing to contact@skinspot.gg.
The Service is only for users aged 18 or older. We do not knowingly collect data from anyone under 18; if we learn that we have, we delete it.
We may update this Policy from time to time. Material changes will be posted here with a new "last updated" date, and where the change significantly affects you we will notify you in the Service.
Questions or requests: contact@skinspot.gg.
This website (skinspot.gg) is owned and operated by Swen Tech OÜ (Registry code: 17582503).