Privacy Policy

What personal data Studio Forward collects, why, on which legal basis, who receives it, how long we keep it and your rights under the GDPR.

This Privacy Policy explains how Studio Forward ("Studio Forward", "we") processes your personal data when you use Studio Forward, in accordance with the EU General Data Protection Regulation (GDPR) and the French Data Protection Act.

1. Data controller

• Controller: Studio Forward, address available on request through Support.

• Contact for any privacy question or request: contact@studio-forward.com (or open a ticket in Support → Login & Security).

2. Data we collect

Account data

• Email address, display name, password (stored only as a secure hash by our authentication provider), profile picture, account creation date, role (customer, seller, admin).

• With Sign in with Google: your name, email address and profile picture as shared by Google. We never receive your Google password.

Preferences

• Preferred games and notification preferences (updates, creators, deals), favorites (wishlist), cart content.

Orders and payments

• Order number, Products, licenses, amounts, discount codes, account credit used, dates, order status, refunds and disputes.

• Payment data is processed by Stripe. We receive limited information from Stripe (payment status, fraud risk level, last processing fees, the identifiers of the payment) but never your full card number.

Seller data

• Seller application: full name, email, Discord username, country of residence, brand name, website and social links, product types, answers to the rights and policy questions, payout readiness, notes.

• Store profile and listings. Identity and bank details are collected directly by Stripe Connect, not by us; we only receive the status of your Stripe account (details submitted, payments and payouts enabled, requirements).

• Tax information required by law (for example under DAC7), when applicable.

Affiliate data

• Affiliate code, referred visits (counted anonymously), referred orders, earnings and payout requests (payout email or method you provide).

Gift cards

• Gift card amount, purchaser, optional recipient name, recipient email and message, code status and redemption.

Communications and support

• Support tickets and their messages, attachments (for example DMCA evidence), product reports, buyer-seller conversations and moderation actions on them.

Downloads and license fingerprints

• For each download of a fingerprinted file: the fingerprint code, the Product, the order, your account, and the date. Used to trace leaks.

• If the Seller enabled placeholders, your license code, account ID, display name and order number are written into the text files of the archive you download.

Usage and analytics (only with your consent)

• A random visitor identifier and session identifier, pages and products viewed, add-to-cart and checkout steps, searches on the site, traffic source (referrer, utm parameters), device type and browser language. No IP address is stored in our analytics.

Technical data

• Our hosting and database providers process IP addresses and technical logs for security and to deliver the service.

3. Purposes and legal bases

4. Recipients and processors

We only share your data with:

• Stripe Payments Europe Ltd. / Stripe, Inc.: payment processing, fraud prevention, Connect accounts of Sellers.

• Supabase: hosting of our database, authentication and file storage (servers in the European Union, Paris region).

• Lovable: hosting and delivery of the website.

• Google: only if you choose Sign in with Google.

• An email delivery provider (for example Resend), when transactional emails are enabled.

• YouTube (Google): only when you play a video embedded on a product page; we use the privacy-enhanced "youtube-nocookie" mode.

• Sellers: when you buy a Product, the Seller can see your order number, license, the date, your display name and email (to support you), the license fingerprints of your downloads, and the messages you send them. A Seller may also receive your order details (order number, items, amounts, account ID and email) on their own server through a webhook or the Seller API they configured; they act as an independent controller for that copy and must protect it under the Seller Terms. Discord notifications never include your email.

• Authorities: when required by law (tax authorities, courts, law enforcement on a valid request).

We do not sell your personal data.

5. International transfers

Some providers (for example Stripe, Google) may process data outside the European Economic Area, in particular in the United States. These transfers are covered by the EU-US Data Privacy Framework where the provider is certified, or by the European Commission's Standard Contractual Clauses.

6. Retention periods

• Account: as long as the account is active; deleted within 30 days after closure, except data we must keep.

• Orders, invoices and accounting records: 10 years (legal accounting obligation).

• Payment and fraud records: up to 13 months after the transaction for chargeback handling, longer if a dispute is ongoing.

• Seller applications: for the life of the store; 3 years after rejection or closure, for fraud prevention.

• Support tickets and conversations: 3 years after the last message.

• Download fingerprints: as long as the License exists and 5 years after, to trace leaks.

• Analytics events: 25 months maximum.

• Consent choices: 6 months, after which we ask again.

7. Security

Access to data is restricted by role-based access rules enforced in the database. Passwords are hashed by our authentication provider. Card data is never handled by our servers. Files are stored privately and only accessible to Buyers through short-lived links. Despite these measures, no system is perfectly secure; we notify the competent authority and affected Users of any personal data breach as required by law.

8. Your rights

Under the GDPR you have the right to:

• access your data and obtain a copy (you can export most of it from Account → Settings → Export my data);

• rectify inaccurate data (most fields can be edited in your account);

• erase your data, subject to legal retention obligations;

• restrict or object to processing based on legitimate interest;

• data portability for data you provided;

• withdraw your consent at any time (cookie settings link in the footer, notification preferences), without affecting prior processing;

• give instructions about the fate of your data after your death (French law).

To exercise your rights, contact contact@studio-forward.com or open a ticket. We answer within one month. If you are not satisfied, you can lodge a complaint with the CNIL (www.cnil.fr) or the data protection authority of your country.

9. Automated decisions

Fraud risk scores from Stripe and automatic scam detection in messages can pause a payment or flag a message. These are always reviewed by a human before any refusal, refund decision or account sanction.

10. Children

The Platform is not intended for children under 16. We do not knowingly collect data from children under 16 without the consent of a parent or guardian.

11. Changes

We will publish any update of this policy on this page with its date, and inform you of significant changes.