Privacy policy

Effective date: 14 October 2026 1. Operator and contact This notice describes Script Tonic's marketplace, account, security and community data categories. Responsible operator: Script Tonic. This name does not represent a claim of incorporation, registered-company status or a particular corporate legal form. Privacy requests: privacy@scripttonic.com; legal notices: legal@scripttonic.com. It is not a claim of certification or compliance with a particular legal regime. 2. Information and purposes Account/profile information includes information supplied to register, authenticate, maintain a profile and contact support. Seller and buyer transaction records may include products, licenses, purchased-release evidence where recorded, prices, charges, payment references, payment/settlement/refund status and support entitlements. These records support order administration, access decisions, disputes and financial integrity. Security records may include request/network information, verification and credential-use metadata, access decisions and operational audit events. API credential records support issuance, authorization and revocation. Treat API secrets and license codes as sensitive; verification audit records are designed not to store plaintext license codes. Do not assume every other system log is certified secret-free. Where identity verification is required, submitted KYC documents and associated verification records are sensitive information. The canonical system uses private document storage and controlled administrative access; they are not public profile attachments. Seller/developer identity verification is required only when reasonably necessary for payments, withdrawals, compliance, fraud prevention or applicable operational requirements. Depending on the requested verification, supported document categories include identity-document front/back, passport and selfie; not every category is required in every case. Only authorized reviewers may access documents for the relevant purpose. Do not submit unrelated sensitive information. Community posts, reviews, product discussions and moderation reports/decisions contain user-submitted content and related account/context metadata. Public contributions may be visible to other visitors. Pre-sale inquiries and support conversations have participant/authorization boundaries; do not place unrelated sensitive information in them. Session/security cookies maintain login and request protection. Email addresses and notification preferences support account messages, transactional notices and optional notification choices. Following a seller does not itself subscribe a user to marketing; optional follower publication notifications require their own choice. Information is limited to what is reasonably required for operation, security, payments, support, compliance and explicitly chosen features. Session and security cookies serve those operational purposes. Optional marketing or tracking requires the applicable choice/consent where required; ordinary marketplace interaction is not marketing consent. No additional optional tracking program is authorized by this notice. 3. Recipients and providers Sellers may receive information needed for the buyer/seller interaction and order/support process, not unrestricted access to buyer data. Authorized staff may access information needed for their duties. Hosting, mail and payment providers may process information necessary to deliver their services; payment-provider processing is also governed by the provider's own notice. Hostinger provides hosting infrastructure. PayPal, when enabled and selected, processes the payment interaction and provides order, capture and related payment-status metadata. Mail service providers process information needed for the relevant account/transactional message. This notice does not claim a particular processor location, universal data residency or an unverified international-transfer mechanism. Provider use and any required transfer disclosures must reflect the actual enabled service. No claim is made here that Script Tonic never handles any particular payment-data field. Legal requests and disclosures require an appropriate verified basis; Contact legal@scripttonic.com for legal notices. Disclosure requests are assessed for authority, scope and applicable legal requirements; only information reasonably required for the verified purpose is disclosed. Processing serves the requested service, security and fraud prevention, applicable obligations and explicitly chosen features; consent is used where required. This notice does not assume that one legal ground applies to every activity or jurisdiction. 4. Retention and safeguards Retention must account for account operation, financial/dispute evidence and security needs. KYC retention/hold/purge controls exist; a hold can prevent purge. An audit or financial record may need to remain after other content is removed. Retention is category- and purpose-based: account/support records support the relevant relationship and requests; transaction/license/refund evidence supports financial integrity and disputes; security logs support investigation and access protection; KYC documents support the necessary verification purpose. Records are reviewed for retention or deletion against legitimate operational, legal and security obligations. Relevant holds may delay deletion, and backup copies follow their applicable retention cycle rather than an instant-deletion promise. No fixed period unsupported by actual operations is promised. No immediate deletion guarantee is made. The canonical design includes controlled private-file access, credential protection and capability checks. These controls reduce risk but do not guarantee absolute security, encryption of every stored file, or any certification. Access controls, private-document handling, credential protection and operational review are used for the relevant data categories. Report a security concern privately to support@scripttonic.com or legal@scripttonic.com; never send passwords or API secrets. Incidents are assessed and affected persons or authorities notified where applicable requirements call for it. No certification, universal encryption or fixed notification deadline is asserted. 5. Choices and requests Use available account/notification controls to manage supported preferences. Request access, correction or deletion through the confirmed privacy contact; additional rights depend on applicable law and circumstances. Identity checks may be needed without requesting secrets in a public channel. Send privacy/access/correction/deletion requests to privacy@scripttonic.com. Requests are reviewed, identity may be checked safely, and applicable rights and response requirements are respected subject to lawful retention limits. Accounts are restricted to persons aged 18 or over for V1. Report suspected underage account information through the same privacy channel for review; do not send unnecessary identity documents. No unimplemented self-service export/deletion feature is promised. 6. Notice changes Material changes are recorded in the published notice version and communicated through an appropriate available service or account channel. Additional consent is sought where required rather than treating publication alone as permission. A notice change must not be treated as automatic permission for a new use of previously collected information.