Privacy Policy

Effective date: [EFFECTIVE DATE, e.g. August 1, 2026]

This policy explains what personal data [COMPANY LEGAL NAME, e.g. Example Media LLC] collects when you use [https://www.example.com], how we use it, who we share it with, and the choices you have. Given the nature of the Site, we treat the fact that you are a member as sensitive information and design for minimal data collection.

1. Data we collect

• Account data: email address and a hashed password. We do not require your real name to create an account.
• Billing data: payments are handled by our payment services provider. We receive subscription status, transaction identifiers, amounts, and the email you used at checkout — never your full card number.
• Usage data: server logs (IP address, user agent, pages requested) retained for security and fraud prevention, and session cookies required to keep you logged in.

We use self-hosted, cookieless analytics that do not track you across other sites, and we do not use advertising trackers or sell personal data.

2. How we use data

• Providing and securing the membership service (contract).
• Processing payments, refunds, and chargebacks via our payment provider (contract / legal obligation).
• Fraud prevention, abuse prevention, and defending legal claims (legitimate interest).
• Transactional email — receipts, password resets, material changes to terms. We do not send marketing email without separate opt-in consent.

3. Who we share data with

• Payment processing: our payment services provider, as independent controller of the checkout and billing data you provide to it.
• Infrastructure: our hosting and content-delivery vendors, acting as processors under contract.
• Legal: where required by law, court order, or to protect our rights, we may disclose data to authorities. We do not voluntarily share member lists with anyone.

4. Retention

Account data is kept while your account exists and deleted or anonymized within 30 days of account deletion, except transaction records, which we retain as required for tax, accounting, and chargeback-defense purposes, and server logs, which are retained for no more than 90 days.

5. Your rights

Depending on your jurisdiction (including under GDPR and US state privacy laws), you may have the right to access, correct, delete, or export your personal data, and to object to or restrict certain processing. To exercise any of these rights, email [support@example.com]. We will verify the request via your account email and respond within the legally required period. You may also lodge a complaint with your local data-protection authority.

6. Security

All traffic is encrypted in transit (TLS). Passwords are stored only as salted hashes. Session tokens are stored hashed. Access to production data is restricted and logged.

7. Contact

Data controller: [COMPANY LEGAL NAME, e.g. Example Media LLC], [REGISTERED BUSINESS ADDRESS]. Privacy contact: [support@example.com]. See also our Terms of Service.