Privacy Policy

Effective from 14 July 2026 · GDPR (EU 2016/679)

1. Data controller

[FULL LEGAL NAME], Czech Republic · [email protected]

2. What we collect and why

• Account data — email, name (optional), password (stored only as a salted cryptographic hash). Legal basis: contract performance (Art. 6(1)(b)).
• Order data — purchased items, amounts, timestamps, Stripe payment session ID. Legal basis: contract performance and legal obligations (accounting/tax, Art. 6(1)(c)); retained for 10 years as required by Czech accounting law.
• Security data — IP address and browser info of sign-in sessions, verification/2FA codes (stored hashed), failed-login counters. Legal basis: legitimate interest in securing the service (Art. 6(1)(f)); session records are deleted when the session expires.
• Emails we send — verification links, one-time login codes, purchase receipts with download links. These are transactional, not marketing.

We do not collect analytics, run ads, profile you, or sell data.

3. Processors and recipients

• Stripe Payments Europe, Ltd. — payment processing. Your card data goes directly to Stripe; we never receive it.
• Google LLC (Gmail SMTP) — delivery of transactional emails.
• Cloudflare, Inc. — network routing/DDoS protection in front of our server.

These providers may process limited data outside the EEA under EU Standard Contractual Clauses / the EU–US Data Privacy Framework.

4. Retention

• Account data: for as long as your account exists.
• Orders and invoices: 10 years (tax law).
• Sessions and one-time codes: deleted automatically on expiry.

5. Your rights

You can request access, correction, deletion, restriction, portability, or object to processing by emailing [email protected]. Account deletion removes your personal data except order records we must keep by law. You may lodge a complaint with the Czech Office for Personal Data Protection (uoou.gov.cz).

6. Security

Passwords are hashed with scrypt; verification codes, session tokens and download tokens are stored only as SHA-256 hashes; all traffic is encrypted (HTTPS via Cloudflare); two-factor authentication is enabled on every account; rate limiting and login lockouts protect against brute force.

See also: Terms & Conditions · Cookie Policy