Privacy Policy

1. Information we collect

From store owners

• Account information from your sign-in provider (currently Google): your email address, name, profile picture and account identifier.
• Session information each time you sign in: the time, your IP address and your browser's user-agent string.
• Store information: store names, addresses, settings, theme choices, pages, uploaded images and other content you add.
• Commerce Provider credentials: API tokens, private keys, plugin secrets and store identifiers for Tebex, PayNow or similar providers. Secret keys are encrypted before they are stored.
• Marketplace information, if you link a BuiltByBit account: your BuiltByBit username and member ID, and the results of licence checks for our themes.
• Messages you send us, such as support requests.

From shoppers on hosted stores

• A session cookie that keeps each shopper's basket and sign-in together while they browse.
• The username a shopper enters to sign in to a store, such as an in-game name.
• Store activity used for the store owner's analytics: pages, categories and packages viewed, basket actions, the referring website's domain, a device category (desktop, mobile or tablet) derived from the user-agent string, and an approximate country provided by our network provider.
• Purchase information reported by the Commerce Provider, such as the username, amount, currency and payment reference, used for the store's analytics and features like "recent payments" and "top customer".

We do not receive or store shoppers' card numbers or other payment-card details; payments are handled entirely by the Commerce Provider. Store analytics do not store a shopper's IP address.

From visitors to this website

We do not use advertising or third-party analytics cookies on this website. Like most websites, our hosting and network providers process technical information such as IP addresses and user-agent strings to deliver pages and protect against abuse.

2. How we use information

We use personal information to:

• provide, operate and maintain the Service, including signing you in, rendering stores and connecting to Commerce Providers;
• show store owners analytics and suggestions about their own store;
• check theme licences you have linked;
• secure the Service, prevent fraud and abuse, and enforce our Terms;
• communicate with you about the Service, including changes, security and support; and
• comply with legal obligations.

Where the law requires a legal basis, we rely on performing our contract with you, our legitimate interests in running and securing the Service, your consent where we ask for it, and legal obligations. We do not sell personal information, and we do not use it for targeted advertising.

3. How information is shared

• Store owners can see the analytics and purchase information collected on their own store.
• Service providers who help us run the Service, such as hosting, database, network, security and content-delivery providers, process information on our behalf.
• Services you connect: we exchange information with your sign-in provider (Google), your Commerce Provider (such as Tebex or PayNow) and, if you link it, BuiltByBit, as needed to provide the features you use.
• Font delivery: pages load fonts from Google Fonts, which receives the visitor's IP address when the font is requested.
• Legal and safety: we may disclose information if we believe it is required by law or legal process, or needed to protect the rights, property or safety of us, our users or others.
• Business transfers: information may be transferred as part of a merger, acquisition, financing or sale of all or part of the Service.

4. Cookies

We only use cookies that the Service needs to work:

• admin_sid keeps a store owner signed in to the dashboard.
• admin_mode and admin_current_store remember the dashboard's light or dark mode and the store you last worked on.
• sid keeps a shopper's basket and sign-in on a hosted store.
• Preview cookies (tebex_draft_preview and related) let a store owner view unpublished changes to their own store.

Blocking these cookies will stop the related features from working.

5. How long we keep information

• Store activity used for analytics is deleted automatically after 90 days.
• Dashboard sessions are deleted after they expire or you sign out.
• Account, store and credential information is kept while your account or store is active, and deleted within a reasonable period after you ask us to delete it or after the account or store is removed.
• We may keep information for longer where we need to for legal, security or dispute-resolution reasons, and deleted information may remain in backups for a limited time.

6. Security

We use reasonable technical and organisational measures to protect personal information, including encryption of stored Commerce Provider secrets, access controls and secure connections. However, no method of transmission or storage is completely secure, and we cannot guarantee the security of any information. You use the Service at your own risk, as described in our Terms of Service. If we become aware of a security incident that affects your personal information, we will notify you and any authorities where the law requires us to.

7. Your choices and rights

Depending on where you live, you may have the right to access, correct, delete, restrict or object to the processing of your personal information, to receive a copy of it, and to withdraw consent. You can make a request by emailing business@coldfiredzn.com. We may need to verify your identity before responding, and we will respond within the time the law requires. You may also have the right to complain to a data-protection authority.

Shoppers who want to exercise these rights for a particular store should contact that store's owner first; we will help store owners respond to requests about data we process for them.

8. Children

Store owner accounts are only for adults, and we do not knowingly collect personal information from children under 13 (or the minimum age required where they live). Stores hosted on the Service may be visited by younger players; store owners are responsible for complying with laws that apply to their audience. If you believe a child has provided us with personal information, contact us at business@coldfiredzn.com and we will delete it.

9. International transfers

We and our service providers may process information in countries other than the one where you live, including the United States, which may have different data-protection laws. Where required, we use appropriate safeguards for those transfers.

10. Changes to this policy

We may update this Privacy Policy from time to time. We will post the new version here and update the date above, and where a change is material we will make reasonable efforts to tell you in advance.

11. Contact us

Questions or requests about this Privacy Policy can be sent to business@coldfiredzn.com.