Privacy Policy

Version 2026-04-v1 — Last updated 2026-07-04

1. Introduction

This Privacy Policy explains how DungeonStock ("we", "us") collects, uses, and shares information when you use the Platform.

2. Minimum Age

You must be at least 18 years old to use the Platform, whether as a buyer or a creator. We do not knowingly collect data from anyone under 18; if we learn that we have, we will delete it.

3. Information We Collect

• Account data: name, email, password hash, role (buyer/creator/admin).
• Creator payout data: legal name, tax identifiers, bank/Stripe Connect account details.
• Transaction data: purchase history, order totals, billing address, tax jurisdiction.
• Content data: assets you upload, metadata, tags.
• Usage data: pages viewed, clicks, device, browser, IP address, approximate location.
• Support data: messages you send us.

4. How We Use Information

To operate the Platform, process payments, deliver purchased assets, comply with legal obligations (tax, anti-fraud, content moderation), improve product quality, and communicate with you about your account.

5. Legal Bases (GDPR)

We process personal data under: performance of contract, legitimate interests (product improvement, fraud prevention), consent (analytics cookies), and legal obligations (tax, record-keeping).

6. Retention

• Account data: while the account is active, plus up to 90 days after deletion for audit and fraud prevention.
• Transaction records: 7 years (tax compliance); 10 years for EU/EEA sales recorded under the VAT One Stop Shop scheme, as required by EU VAT law.
• Support messages: 3 years.
• Server logs: 30 days.

7. Third-Party Processors

We share data strictly as needed with these sub-processors:

• Stripe (payments, payouts, tax)
• Neon (database hosting)
• Cloudflare (CDN, WAF, DDoS protection, R2 storage)
• Vercel (application hosting)
• Resend (transactional email)
• Trigger.dev (background job processing)
• Typesense (search indexing)
• OpenAI (search embeddings — generated from asset content and search queries)
• Anthropic (AI tagging and content moderation of uploaded assets)
• Mixpanel (product analytics — only with your consent)
• Sentry (error monitoring; session replay only with your consent)

We do not sell personal information.

8. Cookies & Analytics

• Essential cookies: authentication session, CSRF protection, cart state. These are always active and cannot be disabled.
• Error monitoring (Sentry): loaded on all pages to diagnose outages; captures technical metadata, not analytics profiles.
• Session diagnostics (Sentry Session Replay): a recording of what happened on the page leading up to an error. Loaded only if you accept via our banner.
• Analytics (Mixpanel): loaded only if you accept via our banner.

If you have accepted neither, we write no non-essential storage to your device at all — which is why we do not interrupt signed-out visitors with the banner. You can review, change or withdraw your choice at any time using the Cookie preferences link in the site footer.

9. Your Rights

Depending on your jurisdiction you may have rights to:

• Access your data
• Correct inaccuracies
• Delete your account and data (via Account Settings → Delete Account)
• Port your data (contact privacy@dungeonstock.com — full export tooling rolling out post-launch)
• Object to or restrict processing
• Withdraw consent
• Lodge a complaint with your national data-protection supervisory authority (EU/EEA)

To exercise any of these rights, contact privacy@dungeonstock.com. We respond within one month, as required by GDPR.

Deleting your account removes your personal data, but records we are legally required to retain — notably transaction and tax records (see Section 6) — are kept for the required retention period even after account deletion.

10. California Residents (CCPA / CPRA)

We do not sell or share personal information as defined under the California Consumer Privacy Act. California residents have the right to know what personal information we collect, the right to delete it, the right to correct it, and the right to non-discrimination for exercising these rights. To exercise any of these rights, contact privacy@dungeonstock.com or use the account deletion flow in Account Settings.

Your right to opt out. Although we do not sell your personal information for money, some privacy laws define "sharing" broadly enough to include certain analytics. As a precaution, you may opt out of any such sale or sharing at any time using the "Do Not Sell or Share My Personal Information" link in our site footer, or from your account's Privacy settings. We also automatically honor the Global Privacy Control (GPC) signal: if your browser sends GPC, we treat it as an opt-out request.

11. International Transfers

Data may be transferred to and processed in the United States, Canada, and other countries where our sub-processors operate. We rely on Standard Contractual Clauses and equivalent safeguards where required.

11.1 EU/EEA Representative

Our representative in the EU/EEA for the purposes of GDPR Article 27 is [EU-REP-NAME]. EU/EEA residents may contact our representative on any matter relating to the processing of their personal data. Our electronic contact point and EU representative details are also published on our Contact & Legal Notices page.

12. Security

We use TLS in transit, encryption at rest where supported, scoped access controls, and audit logging. No system is perfectly secure; we cannot guarantee absolute security.

13. Changes

We will announce material changes via email or in-app notice. Continued use constitutes acceptance.

14. Contact

privacy@dungeonstock.com