Privacy policy

This policy explains what we collect when you use naxoprojects.com, why, and what you can do about it. We collect as little as we can.

Who is responsible

NaxoProjects is the data controller. Contact us through the contact page or at [email protected] about anything in this policy.

What we collect

• Account details: username, email address and a securely hashed password. If you turn on two-factor authentication we store its encrypted secret.
• Orders: the email used at checkout, what you bought, the amount, and the payment reference from Stripe or NOWPayments. We never receive your full card number.
• Licence keys: which keys belong to your orders and when you revealed them. Keys are encrypted in our database.
• Security logs: sign-ins, failed sign-in attempts and the IP address they came from, so we can spot and block attacks.
• Messages: what you send through the contact form.
• Reviews: the rating and text you submit, shown with your username.

Why we use it

• To deliver what you bought and run your account (contract).
• To keep the site and your account secure and prevent fraud (legitimate interest).
• To keep accounting records the law requires (legal obligation).
• For analytics, only if you accept the analytics cookie (consent).

Cookies

We use one essential cookie to keep you signed in and protect forms from forgery, and a second to remember your cart. If analytics is turned on, we ask before setting any analytics cookie and only load it after you accept. You can change your mind by clearing your cookies.

Who else processes your data

• Stripe processes card payments. See Stripe's privacy policy.
• NOWPayments processes cryptocurrency payments. See NOWPayments' privacy policy.
• Our hosting and email providers store and send data on our behalf.
• If enabled: Cloudflare Turnstile (bot check on sign-in and sign-up) and Google Analytics (only with your consent).

We don't sell your data, and we never share it for advertising.

How long we keep it

• Unpaid, abandoned orders are deleted after 30 days.
• Security logs are deleted after 180 days.
• Paid order records are kept as long as accounting law requires, even if your account is removed. They're detached from your account when it is.
• Everything else is deleted when your account is removed.

Your rights

You can see, correct, export and delete your data. Signed in, go to Account › Settings to download everything we hold about you as a file. To have your account removed, contact us from your account's email address. You can also ask us directly about anything else, and you have the right to complain to your local data protection authority.