Legal
Privacy
Controller
BytesForges · 6500 Côte Saint Luc Rd, Montreal, Quebec H4V 1G2 · [email protected]
What is stored
- Account and identities — the Discord account that created the account, and any BuiltByBit, GitHub, Steam or email identity you link. Email is stored only when it is verified.
- Orders and payments — the order, its lines, the amounts, the country used for tax, and the reference the payment provider gave. Card data never reaches this site; checkout is always hosted by the provider.
- Licences and installs — a hash of the licence key, a per-install identifier, coarse host and version information reported by the software, and the time of each verification.
- Downloads and demos — which artifact was issued for which entitlement, and demo lifecycle events. IP addresses in these records are stored only as a salted hash.
Why
To perform the contract (licences, downloads, updates, support), to meet legal duties (invoices, VAT, ten-year retention of accounting records), and for the legitimate interest of preventing fraud and unlicensed redistribution.
How long
- Webhook payloads: 90 days.
- Order and payment raw payloads: 400 days, then pseudonymised.
- Licence verification events: 400 days.
- Invoices, refunds, credit notes, tax lines and ledger entries: 10 years.
- Audit log: 2 years.
Processors
Payment providers, the transactional email provider, the edge network in front of this site, and object storage for encrypted backups. Each processes only what its function needs.
Your rights
Access, rectification, erasure, restriction, portability and objection. Erasure pseudonymises your personal data everywhere it is not legally required to stay: emails become non-routable placeholders and stored payloads are rewritten. Accounting records that must be kept are retained without identifying detail beyond what the law requires. Write to [email protected].
Cookies
A session cookie after sign-in, a short-lived state cookie during sign-in, and a CSRF token. No advertising or analytics cookies are set.