Privacy Policy

Last updated: 18 February 2026

1. Data Controller

The data controller responsible for your personal data is:

Nexal Studios
Athens, Greece
Email: [email protected]

2. Data We Collect

We collect and process the following types of personal data:

  • Account Information: Name, email address, username, and password (hashed)
  • Purchase Information: Billing details, purchase history, and transaction records (payments processed by Stripe)
  • Technical Data: IP address, browser type, device information, and cookies
  • Usage Data: Pages visited, features used, and interaction with our services
  • Support Data: Communication history, support tickets, and feedback

3. Purpose and Legal Basis

We process your data for the following purposes:

Contract Performance

To provide our services, process purchases, deliver digital products, and manage your account.

Legitimate Interest

To improve our services, prevent fraud, ensure security, and analyze usage patterns.

Consent

For marketing communications and non-essential cookies (you may withdraw consent at any time).

Legal Obligation

To comply with tax, accounting, and other legal requirements.

4. Third-Party Processors

We share your data with the following third-party service providers:

  • Stripe Payments Europe, Ltd.:Payment processing, card handling, and tax calculation. Card data is sent directly to Stripe and never stored on our servers. View Stripe's privacy policy at stripe.com/privacy
  • Google Cloud Platform: Hosting and file storage for plugin files
  • Analytics Services: To understand usage patterns (only with your consent)

5. Data Retention

We retain your personal data for the following periods:

  • Account Data: Until account deletion or 3 years of inactivity
  • Purchase Records: 10 years (Greek tax law requirement)
  • Support Tickets: 3 years after resolution
  • Technical Logs: 90 days
  • Marketing Data: Until consent is withdrawn

6. Your Rights (GDPR)

Under the General Data Protection Regulation (GDPR), you have the following rights:

  • Right to Access: Request a copy of your personal data
  • Right to Rectification: Correct inaccurate or incomplete data
  • Right to Erasure: Request deletion of your data
  • Right to Restriction: Limit how we process your data
  • Right to Data Portability: Receive your data in a machine-readable format
  • Right to Object: Object to processing based on legitimate interests
  • Right to Withdraw Consent: Withdraw consent for marketing or cookies

To exercise any of these rights, email us at [email protected].

7. Cookies and Tracking

We use cookies and similar technologies. Essential cookies are necessary for the site to function. Non-essential cookies require your consent. See our Cookie Policy.

8. Data Security

We implement appropriate technical and organizational measures to protect your personal data:

  • Encryption of data in transit (TLS/SSL) and at rest
  • Regular security assessments and updates
  • Access controls and authentication mechanisms
  • Secure hosting infrastructure

9. International Data Transfers

Some service providers may be located outside the EEA. We ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission.

10. Children's Privacy

Our services are not intended for children under 16. We do not knowingly collect data from children. If you believe we have collected data from a child, please contact us immediately.

11. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of significant changes by email or through a notice on our website.

12. Contact and Complaints

For any questions about this privacy policy or to exercise your rights:

You also have the right to lodge a complaint with the Hellenic Data Protection Authority (HDPA):

Hellenic Data Protection Authority
Kifisias Ave. 1-3, 115 23 Athens, Greece
Phone: +30 210 6475 600
Website: www.dpa.gr