Privacy Policy

1. What We Collect

We only collect what the store needs to work. Depending on how you use it, this is:

• Account data: your email address and a securely hashed password, or, if you sign in with Google, the email address and account identifier Google shares with us. We never receive your Google password.
• Profile data: the username you choose and, if you link Discord, your Discord user ID and username.
• Purchase data: which assets you bought, when, the price paid, credits used, promo codes applied, and the Stripe payment or subscription reference. We do not receive or store your card number.
• Membership data: your subscription tier, status, renewal date and credit balance and history.
• Referral data: if you join through a referral link or share one, the link between the referring and referred accounts and the rewards issued.
• Reviews: the rating and text you post on a product, shown publicly with your username.
• Support messages: the name, email and message you send through the Support form.
• Technical data: standard server and security logs (IP address, browser type, requested page, time) kept by our hosting and security providers to run and protect the service, and aggregate, country-level visitor statistics.

2. Why We Use It and Our Legal Basis

• To provide the store (account, library, downloads, membership, credits, referrals, reviews): performance of our contract with you.
• To take payment and keep accounting records: performance of the contract and our legal obligations under UK tax and company law.
• To answer support requests: performance of the contract and our legitimate interest in helping customers.
• To secure the service (rate limiting, fraud and abuse prevention, security logs): our legitimate interest in protecting the store and other users.
• To send service emails (receipts, password resets, subscription notices, changes to terms): performance of the contract. We do not send marketing emails unless you opt in, and every such email will include an unsubscribe link.
• To measure visits with anonymous, aggregate analytics: our legitimate interest in understanding how the store is used. This does not identify you.

3. Who Processes Your Data

We use a small number of service providers who process data on our instructions under written contracts:

• Supabase — database and authentication (account, profile, purchase, membership and review data).
• Stripe — payment and subscription processing. Stripe is an independent controller for the payment itself; see Stripe's privacy policy.
• Google — only if you choose to sign in with Google.
• Discord — only if you choose to link your Discord account.
• Resend — delivery of transactional emails and Support form messages.
• Cloudflare — content delivery, security, file storage for asset downloads, and cookie-free visitor statistics.

We do not sell personal data and we do not share it with advertisers. We may disclose data where the law requires it, to enforce our terms, or to protect the rights and safety of users.

4. International Transfers

Some of these providers store or process data outside the United Kingdom and the European Economic Area, including in the United States. Where that happens, the transfer is protected by the UK International Data Transfer Addendum or EU Standard Contractual Clauses, or by an adequacy decision covering the provider.

5. How Long We Keep It

• Account, profile, library and membership data: for as long as your account exists.
• Purchase and payment records: 6 years after the transaction, as required by UK tax and accounting law, even if the account is deleted.
• Support messages: up to 2 years after the request is closed.
• Security logs: typically 30 to 90 days.
• Reviews: until you delete them or your account is deleted, after which they are removed or anonymised.

6. Your Rights

You have the right to:

• Access the personal data we hold about you and receive a copy.
• Correct inaccurate data. You can change your username on your account page.
• Delete your data (see section 7).
• Receive the data you gave us in a portable, machine-readable format.
• Object to processing based on our legitimate interests, and to any direct marketing.
• Withdraw consent at any time where processing is based on consent, such as a linked Discord account.
• Complain to the UK Information Commissioner's Office at ico.org.uk, or to the data protection authority in your EU country. We would appreciate the chance to resolve any concern first.

To exercise any of these rights, contact us through the Support page from the email address linked to your account. We respond within one month.

7. Deleting Your Account

You can delete your account and personal data yourself at any time from the My Account page (after confirming your password and typing DELETE), or ask us through the Support page and we will complete it within 30 days. Deletion removes your account, profile, linked Discord data, credit balance and access to your asset library. Purchase and payment records are kept for 6 years in anonymised form, without your name or email, to meet our legal accounting obligations. An active membership is cancelled at deletion and any remaining credits are forfeited.

8. Cookies and Local Storage

The store uses only what is strictly necessary to work: browser storage that keeps you signed in, remembers your cart and holds a referral code until your first purchase. Visitor statistics are collected by Cloudflare Web Analytics, which does not use cookies and does not track individuals across sites. Because we use no advertising or tracking cookies, we do not show a cookie banner. The Stripe checkout page sets its own cookies for fraud prevention, covered by Stripe's policy.

9. Children

The store is not intended for children under 13 and we do not knowingly collect their data. If you believe a child under 13 has created an account, contact Support and we will remove it.

10. Security

Data is transmitted over encrypted connections, passwords are stored only as salted hashes, database access is restricted by row-level security, payment details never touch our servers, and administrative access is limited to authorised staff.

11. Changes to This Policy

We may update this policy as the store changes. The date at the top shows the latest version. For material changes we will notify registered users by email or by a notice on the store before the change applies.

12. Contact

GELOS GAMES LIMITED, 128 City Road, London, England, EC1V 2NX. Company number 15459335. For any privacy question or request, use our Support page.