Privacy Policy

This is a plain-English summary of what data ShippedStack collects when you buy one of our digital product packs, why we collect it, and your rights. This policy applies to every pack sold through shippedstack.com via Lemon Squeezy or Gumroad.

1. Data we collect

We collect only what is strictly needed to process a purchase and deliver the pack.

• Order data: email address, country (for VAT), payment timestamp, product purchased, order ID. Collected by our payment processors (Lemon Squeezy or Gumroad); we see it through their seller dashboard.
• Support emails: if you email info@shippedstack.com we retain the email thread until the issue is resolved, then 12 months for audit trail.
• Website analytics (shippedstack.com): privacy-friendly, cookieless analytics. We record page views, referrer, and country — no IP addresses stored, no cross-site tracking, no advertising cookies.

We do NOT collect: payment card details, home address, phone number, birthday, social graph, or any behavioral profile. The packs themselves (zip downloads) contain no telemetry — once you download, we have no visibility into what you do with the files.

2. Cookies

shippedstack.com uses only strictly-necessary cookies. We do not use advertising, profiling, or cross-site tracking cookies, so under the EU ePrivacy Directive prior consent is not required for our own site cookies.

• Strictly necessary: a single first-party preference cookie (ss-cookie-notice) used only to remember that you have dismissed the cookie notice. Stored 12 months. No personal data attached.
• Analytics: aggregated, cookieless, privacy-first. No identifier is stored on your device.
• Third-party checkout: when you click "Buy on Lemon Squeezy" or "Buy on Gumroad" you leave our site and the third-party processor sets its own cookies, governed by their privacy policies (linked below).

3. How we use your data

• Deliver the download link and receipt after purchase.
• Process refunds within the 30-day window.
• Respond to support emails.
• Send at most one email per major version release (v1.0 → v1.1) with the update download link. You can unsubscribe with one click; this does not affect your ability to access purchased products.
• Comply with EU VAT / US sales tax reporting obligations through our Merchant of Record (Lemon Squeezy).

We do NOT use your data for: targeted advertising, selling to third parties, training AI models, or profiling.

4. Legal basis (GDPR Art. 6)

• Performance of contract (Art. 6(1)(b)) — to deliver the digital product you bought.
• Legal obligation (Art. 6(1)(c)) — to retain order and tax records for the period prescribed by EU and national tax law.
• Legitimate interest (Art. 6(1)(f)) — to keep the service secure, prevent abuse, and answer support requests. You may object at any time.
• Consent (Art. 6(1)(a)) — only when you opt in to release notifications. Consent can be withdrawn with one click.

5. Third-party processors

We rely on the following processors. Each has their own privacy policy which governs their processing:

• Lemon Squeezy (Merchant of Record, EU VAT handling) — lemonsqueezy.com/privacy
• Gumroad (secondary sales channel) — gumroad.com/privacy
• Stripe (payment processing via LS or Gumroad) — stripe.com/privacy
• Cloudflare (hosting, CDN, DNS) — cloudflare.com/privacypolicy
• Nominalia (DNS registry, email forwarding for info@shippedstack.com) — nominalia.com/privacy

We do not hand your data to any other third party.

6. International transfers

Some of our processors (Stripe, Gumroad, Cloudflare) are based in the United States and may transfer data outside the EU/EEA. Such transfers rely on the European Commission's Standard Contractual Clauses (SCCs) and/or adequacy decisions, where applicable, as documented in each processor's privacy policy.

7. Your rights

Under GDPR (EU/EEA/UK) and comparable laws, you can:

• Request a copy of your data (Article 15).
• Correct inaccurate data (Article 16).
• Erase your data when the lawful basis ends (Article 17), except order records we must retain for tax purposes (typically 10 years in the EU).
• Object to processing or restrict it (Articles 18 + 21).
• Lodge a complaint with your local data protection authority.

To exercise any of these rights, email info@shippedstack.com with "Privacy request" in the subject. We reply within 30 days.

8. Data retention

• Order records: retained 10 years for tax compliance (EU + most jurisdictions).
• Support emails: 12 months from resolution.
• Website analytics: 24 months aggregate, no personal identifiers.
• Cookie-notice preference cookie: 12 months from your last visit.

9. Children

Our products and services are aimed at professional developers and are not directed to children under 16. We do not knowingly collect data from minors. If you believe a minor has submitted data, contact us and we will delete it.

10. Changes to this policy

If we materially change this policy we update the "Last updated" date and, for current customers, send a notification email. Continued use after the new effective date means you accept the updated policy.

11. Data Controller & Contact

The data controller for the purposes of GDPR is:

NamiDev Studio (independent project ShippedStack)
Italy (Lazio region)
Email: info@shippedstack.com

For GDPR purposes, the full postal address of the data controller is provided on request via email — typically required only for formal complaints, subject access requests, or legal notices. Day-to-day support and rights requests are handled at the email above.

The competent supervisory authority is the Italian Data Protection Authority — Garante per la protezione dei dati personali. EU/EEA residents may also lodge complaints with the supervisory authority of their country of residence.

This privacy policy is provided in good faith and reflects our actual data handling practices. For specific legal questions, consult a privacy lawyer in your jurisdiction.