Privacy

The data controller for this website is the owner of Seraph Packs. Contact details are on the Contact page. We collect as little as possible.

Buying (handled by Gumroad)

Purchases happen on Gumroad, which sells the products as the seller (merchant of record). Gumroad collects your email address, payment and billing details under its own privacy policy, as an independent controller. As the creator, we receive the purchase details Gumroad shares with sellers (such as your email address, what you bought and when), and use them only to support you, deliver updates and keep the accounting records Norwegian bookkeeping law requires. We never see your card or payment details.

What this website stores

• Contact messages: the topic, your message, a receipt or order number if you add one, and our replies. You read replies through a private ticket link (stored only in scrambled form). To stop spam, we count messages per visitor using a scrambled value derived from your IP address. It changes every day and is deleted after the day ends.
• Not stored: no names, emails, IP addresses, payment details or accounts. Browsing and previewing packs (including the 3D viewer) stores nothing about you.

Why (legal basis)

To answer your messages and support what you bought (GDPR Art. 6(1)(b), contract), to keep accounting records required by Norwegian bookkeeping law (Art. 6(1)(c), legal obligation), and to prevent spam and abuse (Art. 6(1)(f), legitimate interest).

Who else processes data

• Gumroad handles checkout, payment, tax and delivery as the seller, under its own privacy policy. Gumroad and its payment processors may process data outside the EEA.
• Cloudflare hosts this website and necessarily handles your IP address to deliver pages and protect against abuse. It may process data outside the EEA under its standard data protection terms.
• Discord: when you send a contact message, its topic and ticket number (never the message text) are posted to a private Discord channel so the shop owner gets notified. Discord may process this outside the EEA. Don't put personal details in the topic.

This website loads no analytics, advertising, social-media or other third-party scripts, fonts or trackers. Everything here is served from the shop itself. Pressing a Buy button takes you to Gumroad's own website.

Cookies and storage on your device

This website sets no cookies. A few items are kept in your browser's storage, only to make features you use work. Because they are strictly necessary for those features and are not used for tracking, no consent banner is needed. (Gumroad's website, once you go there to buy, has its own cookie notice.)

ba.cart

Your cart. Kept until you continue to Gumroad checkout or clear it.

ba.tickets

Links to your last 20 contact conversations on this device.

ba.theme

Only if you press the light/dark button: whether you chose light or dark mode. Otherwise the shop follows your device setting and stores nothing.

Clear all shop data on this device

Children

If you are under 13, please ask a parent or guardian before you buy or send us a message, and don't include personal details about yourself in messages. Buyers under 18 need a parent's or guardian's permission to make a purchase.

How long

Purchase details we receive from Gumroad are kept for as long as Norwegian bookkeeping rules require (normally five years after the end of the financial year). Contact conversations are deleted 12 months after the last message, or straight away if you delete them yourself.

Your rights, and deleting your data

• Delete a conversation yourself: open your private ticket link and press "Delete this conversation". It's removed immediately.
• Clear this device: use the button above.
• Anything else (access, correction, deletion, objection): email us at the address on the Contact page or use the contact form. We delete what we're allowed to. Purchase records needed for bookkeeping are kept until the legal period ends. For data Gumroad holds, you can also contact Gumroad directly.

You may also complain to the Norwegian Data Protection Authority (Datatilsynet).