Privacy Policy

1. Software Licensing & Store Purchases
Why We Process It: To verify your order, generate unique software license keys, deliver plugin files for Blender, DAZ Studio, and Photoshop, and comply with UK statutory accounting regulations.
Lawful Basis: Contractual Necessity (UK GDPR Article 6(1)(b)) to fulfill your purchase, and Legal Obligation (Article 6(1)(c)) to maintain corporate financial records.
Information Involved: Full name, physical billing address, email address, transaction identifiers, IP address, and payment card tokens (handled securely through Stripe; we never store your full payment card number).
Who We Share It With: Stripe Payments Europe/UK (payment processing) and our dedicated web hosting infrastructure.
How Long We Keep It: For the duration of your active software license, plus 6 statutory years following the transaction to comply with UK HM Revenue & Customs (HMRC) audit requirements.

2. User Account Management
Why We Process It: To let you log in, manage software downloads, retrieve license keys, and update your personal account details.
Lawful Basis: Contractual Necessity (Article 6(1)(b)) to maintain your registered user profile and deliver services you request.
Information Involved: Username, securely hashed password, email address, and saved account preferences.
Who We Share It With: Stored directly inside our secure, local WordPress database; not shared with external advertising third parties.
How Long We Keep It: Maintained for the active life of your account, and permanently purged after 24 continuous months of total account inactivity.

3. Technical Support & Inquiries (Email & WhatsApp)
Why We Process It: To troubleshoot plugin bugs, answer pre-sales questions, resolve integration issues, and provide one-on-one customer assistance.
Lawful Basis: Contractual Necessity (Article 6(1)(b)) for customer support relating to purchased products, or Legitimate Interests (Article 6(1)(f)) to resolve general pre-sales inquiries.
Information Involved: Your name, email address, WhatsApp mobile number (when messaging us on WhatsApp), full correspondence logs, and any optional diagnostic files or error logs you choose to provide (such as host application version details).
Who We Share It With: Meta Platforms Ireland Ltd. (operating WhatsApp Business) and our business email server providers.
How Long We Keep It: Retained for 24 months following ticket resolution so our team has past diagnostic context if you encounter recurring technical issues.

4. Blog & Tutorial Discussions
Why We Process It: To enable community discussions, answer reader questions under tutorials, moderate public feedback, and block automated comment spam.
Lawful Basis: Legitimate Interests (Article 6(1)(f)) to foster and moderate our creative community, and Consent (Article 6(1)(a)) if you choose to save your details in your browser via comment cookies.
Information Involved: Display name, email address, website URL, comment text, IP address, and submission timestamp.
Who We Share It With: Stored locally in our website database and published publicly on the relevant tutorial page.
How Long We Keep It: Retained for the lifetime of the published article, or erased immediately upon your verified request.

5. Direct Email Updates & Tutorials
Why We Process It: To send workflow guides, announcements on new 3D bridges, and subscriber discounts to community members who specifically opted in.
Lawful Basis: Freely Given Consent (Article 6(1)(a)) and PECR Regulation 22. Subscribing is never pre-ticked, never bundled into purchases, and strictly optional.
Information Involved: First name, email address, and email engagement metrics (open rates and link clicks).
Who We Share It With: Our email distribution service provider.
How Long We Keep It: Retained only until you revoke consent by clicking the one-click "Unsubscribe" link at the bottom of any newsletter or contacting us.

6. Website Security & Fraud Prevention
Why We Process It: To secure our website against unauthorized access, prevent brute-force attacks, mitigate malicious traffic, and detect payment fraud.
Lawful Basis: Legitimate Interests (Article 6(1)(f)) to protect our business, users, and digital store against security incidents and fraud.
Information Involved: IP address, browser headers, operating system information, and Stripe security tokens.
Who We Share It With: Stripe, Inc. (fraud scoring) and our Web Application Firewall / hosting infrastructure.
How Long We Keep It: Standard firewall and server access logs are automatically deleted after 90 days; Stripe fraud telemetry is retained in accordance with payment industry security benchmarks.

International Data Transfers: When service providers (such as Stripe, Discord, or WhatsApp) process data outside the United Kingdom, we ensure statutory protections remain in place as required by Chapter V of the UK GDPR. These transfers rely on UK Adequacy Regulations, the UK International Data Transfer Agreement (IDTA), standard contractual clauses, or the UK Extension to the EU-US Data Privacy Framework.