Privacy Policy
Last updated: October 2026
NovaTopup ("we", "us", or "our") operates the api.novatopup.com platform. This Privacy Policy explains how we collect, use, and protect your personal information when you use our Garena Free Fire topup and PIN redeem API services.
1. Information We Collect
We collect the following types of information:
- Account Information — email address, username, and account preferences.
- Garena Credentials — encrypted using AES-256 encryption and stored securely. We never store plaintext credentials.
- Telegram Bot Tokens — encrypted at rest for bot functionality integration.
- Transaction History — records of topup and redeem requests processed through our platform.
- Technical Data — IP addresses, browser type, and access timestamps for security and service monitoring.
2. How We Use Your Data
- Processing topup and redeem requests on your behalf via the Garena platform.
- Managing your account, subscriptions, and API access.
- Authenticating sessions and preventing unauthorized access.
- Improving our service reliability, performance, and user experience.
- Communicating important service updates and security notifications.
3. Data Security
We take the security of your data seriously and implement the following measures:
- AES-256 Encryption — all Garena credentials are encrypted with AES-256 before storage.
- HTTPS/TLS — all data in transit is encrypted using industry-standard TLS protocols.
- Secure Session Management — sessions are token-based with automatic expiration.
- Encrypted Bot Tokens — Telegram bot tokens are encrypted at rest and only decrypted during active use.
4. Third-Party Services
We integrate with the following third-party services to provide our platform:
- Garena — for processing topup and PIN redeem transactions.
- Telegram Bot API — for bot functionality and automated notifications.
- Binance Pay — for processing subscription payments.
We do not sell, trade, or rent your personal data to any third parties.
5. Data Retention
- Active account data is retained for as long as your subscription remains active.
- Transaction history is retained for 90 days after account closure.
- Upon account deletion, all personal data and encrypted credentials are permanently removed from our systems.
6. Cookies
We use session cookies strictly for authentication purposes. These cookies are essential for maintaining your logged-in state and do not track your browsing activity. No third-party tracking or analytics cookies are used.
7. Children's Policy
Our service is intended for users aged 18 and above. We do not knowingly collect personal information from minors. If we become aware that a user under 18 has provided us with personal data, we will take steps to delete that information promptly.
8. Your Rights
You have the right to:
- Request a Data Export — obtain a copy of the personal data we hold about you.
- Request Account Deletion — have your account and all associated data permanently removed.
- Update Personal Information — modify your account details, credentials, or preferences at any time.
To exercise any of these rights, please contact us via WhatsApp (details below).
9. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons. We encourage you to review this page periodically for the latest information on our privacy practices.
10. Contact
If you have any questions or concerns about this Privacy Policy, please reach out to us: