Privacy Policy

This Privacy Policy explains how Light Services ("we", "us") processes your personal data when you visit Light Store, create an account or buy products. It follows the EU General Data Protection Regulation (GDPR).

1. Data Controller

Light Services
Piotr Mazurkiewicz
Email: [email protected]

For any question about your data or to exercise your rights, contact us at the address above.

2. Data We Process and Why

2.1 Visiting the store

When you visit the store, our server processes technical data such as your IP address, browser type, operating system, the pages requested and the time of the request. We need this data to deliver the website, keep it secure and prevent abuse such as excessive requests. We use your IP address to determine your country with a local database. Your IP address is not sent to a third party for this.

Legal basis: our legitimate interest in operating a secure website (Art. 6(1)(f) GDPR).

2.2 Your account

When you register, we process your name, email address and password (stored only as a secure hash). If you use them, we also store your profile picture, two-factor authentication settings, passkeys, notification preferences and wishlist. For security, we keep a list of your active sessions with their IP address, browser and device, which you can view and end in your profile.

Legal basis: performance of the contract for your account (Art. 6(1)(b) GDPR).

2.3 Signing in with Discord, Google or GitHub

If you choose to sign in with or link an external account, we receive the data you approve from that provider, typically your account ID, username, email address and profile picture. We use it only to sign you in and to provide features linked to that account, such as assigning Discord roles for your purchases. You can unlink the account in your profile at any time.

Legal basis: performance of the contract (Art. 6(1)(b) GDPR).

2.4 Orders and payments

When you buy a product, we process your name, email address, the products ordered, prices, coupons or vouchers used, your country and the country detected from your IP address, payment status and transaction references, and whether you consented to immediate delivery and waived your right of withdrawal. We need this data to process and deliver your order, issue licenses, handle withdrawals and refunds, calculate taxes and prevent fraud.

Payments are handled directly by the payment provider you choose at checkout. We never see or store your full card details. The provider tells us the result of the payment and may share limited details such as the payer's country.

Legal basis: performance of the contract (Art. 6(1)(b) GDPR), our legal obligations under tax and accounting law (Art. 6(1)(c) GDPR), and our legitimate interest in preventing fraud (Art. 6(1)(f) GDPR).

2.5 Reviews, support and other content

If you write a product review, it is published together with your name and profile picture. If you contact support, we process the content of your messages and any files you attach so we can help you.

Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and our legitimate interest in answering your requests (Art. 6(1)(f) GDPR).

2.6 Emails

We send emails necessary for your account and orders, such as email verification, password resets, order confirmations and license delivery. You can manage optional notifications in your profile.

Legal basis: performance of the contract (Art. 6(1)(b) GDPR).

3. Cookies

We use the following cookies:

  • Strictly necessary: a session cookie that keeps you signed in, a security token that protects forms against forgery, a "remember me" cookie if you choose to stay signed in, a cart cookie that keeps your cart for up to 7 days, and a cookie that stores your cookie choices. These cookies are essential for the store to work and do not require your consent.
  • Statistics: a short-lived cookie (60 minutes) that prevents counting the same product view twice. We set these only if you consent through the cookie banner.

You can change or withdraw your consent at any time through the cookie settings, and you can delete cookies in your browser.

Legal basis: Strictly necessary cookies are covered by Art. 6(1)(f) GDPR and the exemption for necessary storage under the ePrivacy rules. For statistics cookies, we rely on your consent (Art. 6(1)(a) GDPR).

4. Who Receives Your Data

We share personal data only where needed for the purposes above, with:

  • Payment providers you choose at checkout, which act as independent controllers for the payment: Stripe, PayPal, NOWPayments.
  • Sign-in providers you choose to use: Discord, Google, GitHub.
  • Cloudflare Turnstile, which checks that sign-ins and registrations are made by a human. Cloudflare processes your IP address and browser data for this.
  • Hosting and infrastructure providers that store and deliver the store and its files on our behalf: Hetzner Online GmbH.
  • Independent creators who sell products in the store, who receive the order details needed to support the products you bought from them.
  • Authorities and advisors where we are legally required to share data, such as tax authorities, or need to establish or defend legal claims.

We do not sell your personal data.

5. Transfers Outside the EU

Some of the providers above, such as Discord, Google, GitHub, Cloudflare, Stripe and PayPal, may process data in the United States or other countries outside the European Economic Area. Where this happens, the transfer is protected by an adequacy decision, such as the EU-U.S. Data Privacy Framework for certified companies, or by the European Commission's Standard Contractual Clauses.

6. How Long We Keep Your Data

  • Account data: until you delete your account. You can do this in your profile at any time.
  • Session data: until the session ends or expires.
  • Order, payment and invoice records: for as long as tax and accounting law requires, currently 5 years. They are kept after you delete your account, but only for that purpose.
  • Server logs: for up to 30 days, unless needed to investigate a security incident.
  • Support messages: until your account is deleted, or 2 years after your last message.

7. Your Rights

Under the GDPR, you have the right to:

  • access the personal data we hold about you and get a copy of it,
  • have inaccurate data corrected,
  • have your data deleted, unless we must keep it by law,
  • restrict how we process your data,
  • receive the data you gave us in a machine-readable format (data portability),
  • object at any time to processing based on our legitimate interests, on grounds relating to your particular situation,
  • withdraw your consent at any time, without affecting the lawfulness of processing before the withdrawal.

To exercise any of these rights, email [email protected]. We will respond within one month.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work, or where you believe an infringement occurred.

8. Automated Decisions

We do not make decisions based solely on automated processing that produce legal effects for you or similarly significantly affect you. Payment providers may run their own automated fraud checks on payments under their own privacy policies.

9. Security

We protect your data with appropriate technical and organizational measures, including encrypted connections (HTTPS), hashed passwords, optional two-factor authentication and passkeys, and restricted access to administrative functions under their own privacy policies.

10. Children

The store is not intended for children under 18. If you are under 18, you may use the store only with the consent of a parent or legal guardian.

11. Changes to This Policy

We may update this Privacy Policy when our services or the law change. The current version is always available on this page. We will notify you of significant changes by email or in the store.

Last updated: 26 Oct 2026