Privacy Policy
This Privacy Policy explains how SDKC66 collects, uses, shares and protects personal information when you visit sdkc66.com, create an account, buy a digital product or contact our support team.
In short: we collect only what is needed to sell and deliver digital goods; we never ask for or store full card numbers; we do not sell or share your personal information for advertising; you can request access, correction or deletion at any time by writing to [email protected].
- 1. Who is responsible (controller)
- 2. Scope of this policy
- 3. Information we collect
- 4. How we use it and our legal bases
- 5. Marketing and newsletters
- 6. Cookies and similar technologies
- 7. Who receives personal information
- 8. International transfers
- 9. How long we keep it
- 10. Security and data breaches
- 11. Your rights (GDPR / UK GDPR)
- 12. California privacy notice
- 13. Other regions, children, automated decisions
- 14. Changes to this policy
- 15. How to contact us
1. Who is responsible (controller)
The data controller for this website is the business operating under the trading name SDKC66. We deliberately do not print our corporate registration details on a public page. Our full legal name and registered address are provided, free of charge and within two business days, to any customer who needs them for a withdrawal, a complaint, a tax document or a legal notice, and to any supervisory authority, court, payment provider or merchant of record that asks for them.
Because checkout, invoicing and tax reporting run through our merchant of record Gumroad, that company is the trader of record for each purchase and the controller of payment and billing data. Its registered address is published on your invoice, and it holds the accounting records that consumer and tax law require us to keep.
Data protection enquiries: [email protected] (please put "Privacy" in the subject line).
We have not appointed a Data Protection Officer; the mailbox above is handled by the person in our team responsible for data protection. Where an EU or UK representative is required under Article 27 GDPR, the representative appointed by our merchant of record acts for the sales relationship, and its identity is stated on request and on the invoice.
2. Scope
This policy applies to this website and to the customer relationship created when you order from it. It does not apply to third-party services we link to, to products that carry their own privacy notice, or to software you download from us after installation on your own systems (which does not phone home to us unless the product description says otherwise).
3. Information we collect
3.1 Information you give us
- Identity and contact data: first and last name (or a display name), email address, and company name and VAT/tax ID if you order as a business.
- Order data: products purchased, licence keys or entitlements issued, order number, amount, currency, billing country (needed for tax and VAT), invoice details, and the delivery email address.
- Payment confirmation data: payment method type, brand and last four digits, transaction reference and status. Full card numbers, CVV codes and wallet credentials are handled by our payment provider and are never sent to or stored by us.
- Communications: support tickets, pre-sales questions, refund or withdrawal requests, and the account content you upload when you contact us.
- Consent records: your cookie choice and, where relevant, proof of your consent to start delivery immediately (see our withdrawal clause).
3.2 Information collected automatically
- Device, browser and operating system; screen and language settings; referring site; pages viewed, clicks and time on page; approximate geographic location derived from IP address; and the IP address itself (which may be truncated where our tools allow it).
- Basic server logs (URL requested, timestamp, status code, user agent) used for security, abuse prevention and debugging.
3.3 Information from third parties
- Payment providers: transaction status, risk/fraud signals, and the billing country they verify.
- Our hosting and CDN provider: aggregated traffic data and security events.
- Email delivery provider: delivery, bounce and open events for transactional messages.
We do not collect sensitive personal information (health, biometric, religious, political, sexual orientation or similar) and we do not knowingly do so for digital-goods sales. Government ID is requested only where a payment provider or a legal obligation requires verification, and is deleted once the check is complete.
4. How we use it and our legal bases
| Purpose | Data used | Legal basis (GDPR Art. 6) |
|---|---|---|
| Process an order, issue licences and deliver the product | Name, email, order and payment reference data | Performance of a contract (Art. 6(1)(b)) |
| Payment processing, fraud prevention and chargeback defence | Order data, IP and device data, payment provider signals | Contract + legitimate interests: preventing fraud (Art. 6(1)(b)/(f)) |
| Invoicing, tax reporting and accounting | Name, billing country, VAT/tax ID, order amounts | Legal obligation (Art. 6(1)(c)) |
| Support, dispute resolution and service improvement | Communications, order data, product usage statistics | Contract + legitimate interests: running the business (Art. 6(1)(b)/(f)) |
| Optional newsletters and product announcements | Email address, name | Consent (Art. 6(1)(a)); lawful marketing on existing-customer basis where applicable law allows |
| Non-essential analytics and preference cookies | Usage data, device data | Consent via our cookie banner (Art. 6(1)(a)) |
| Website security, abuse blocking and legal compliance | Server logs, IP data | Legitimate interests + legal obligation (Art. 6(1)(c)/(f)) |
We do not use personal information for automated decision-making that produces legal or similarly significant effects, and we do not build behavioural profiles of customers for advertising.
5. Marketing and newsletters
Transactional messages (order confirmation, licence keys, invoices, security notices) are part of the service and cannot be switched off while you keep your orders. Promotional email is sent only if you opted in, using double opt-in confirmation. Every promotional email contains an unsubscribe link and you can also ask us to stop by writing to [email protected]. Withdrawing consent does not affect processing that already happened.
6. Cookies and similar technologies
A cookie is a small file stored by your browser. We use:
| Category | Examples | Why | When set |
|---|---|---|---|
| Strictly necessary | session/cart identifier, CSRF token, language choice, cookie_consent | So the cart, checkout and your consent choice work | Always (no consent required) |
| Functional | preferences such as display settings | Convenience, not tracking | Always, non-personal |
| Analytics | privacy-friendly page statistics | Understand which products are viewed and fix broken pages | Only after you choose "Accept all" |
| Advertising | none | We do not run ad-tech trackers or sell/reshare user data | Never |
You can change or withdraw your choice at any time by clearing the cookie_consent entry in your browser storage, or by reloading this page after deleting site data. You can also block or delete cookies in your browser settings; blocking strictly necessary cookies will break checkout.
Local storage is used to remember your consent choice and, if you create an account, your session.
7. Who receives personal information
We do not sell or share personal information for advertising. We disclose it only to the categories of recipients below, each bound by contract to process data on our instructions (Article 28 GDPR processor terms and CCPA service-provider terms):
- Our merchant of record — Gumroad acts as the seller of record: it processes the payment through its own processors, issues the invoice, handles refunds and chargebacks, and keeps the transaction records. Card details reach Gumroad and its processors, never us.
- Hosting, CDN and DNS — Cloudflare, Inc. serves this website and the delivery links; product files are stored either by our merchant of record or behind the same CDN.
- E-commerce / order management and invoicing tools — store order and invoice records.
- Email delivery services — send confirmations, licences and newsletters.
- Analytics tools — only after consent, and configured to minimise identification (IP truncation where available).
- Customer support / helpdesk software — so tickets can be handled.
- Accountants, tax authorities and auditors — where required by law, and only the accounting records they need.
- Professional advisers and courts / law enforcement — to establish, exercise or defend legal claims or to comply with a valid order. We review every such request for legality and minimisation and notify you where legally permitted.
A current list of the specific sub-processors we use is available on request from [email protected] and we will tell you in advance about new sub-processors that handle personal data in a materially different way.
8. International transfers
This website is operated for customers outside mainland China, and our service providers store and process data in several countries. Where personal data is transferred out of the European Economic Area (EEA) or the United Kingdom to a country without an adequacy decision, we rely on the European Commission's 2021 Standard Contractual Clauses (Module 2 controller-to-processor and, where relevant, Module 3 processor-to-processor), together with the UK International Data Transfer Addendum for UK data, plus technical measures such as transport encryption and restricted access.
Transfers currently involve service providers operating in the United States: our merchant of record (Gumroad, which processes the sale, the payment and the invoice) and our hosting, CDN and DNS provider (Cloudflare, Inc.), which serves this website and the download endpoints. Where either provider stores or accesses data from another country, the safeguards below apply to that access as well. We update this list whenever we add a provider that stores data elsewhere, and the current list is available on request.
You can obtain a copy of the safeguards applied to a specific transfer (the SCCs and the transfer risk assessment summary, redacted for confidentiality) by contacting [email protected].
9. How long we keep it
We keep personal information only as long as necessary for the purposes above, applying these criteria:
| Data | Retention criterion |
|---|---|
| Account profile | Until you delete the account, plus up to 30 days for backups; deleted earlier if the account is inactive for 24 months and we have contacted you once. |
| Orders, licences, invoices | Kept for the statutory accounting and tax retention period of the country we are established in (typically 6–10 years from the end of the financial year). |
| Support and dispute records | Up to 3 years after the ticket is closed; longer if a claim is open or a chargeback is pending. |
| Cookie/analytics data | Rolling 14 months maximum for aggregated reports; raw events deleted earlier where our tool allows. |
| Server and security logs | Up to 90 days, extended only for an active security investigation. |
| Consent records | Until 12 months after consent is withdrawn or the account is closed. |
At the end of a retention period data is deleted or aggregated so it can no longer identify you. Backups are overwritten on a rolling schedule.
10. Security and data breaches
Measures we apply include TLS/HTTPS across the site, encryption of data at rest where our providers support it, least-privilege access with multi-factor authentication for staff accounts, pseudonymisation where feasible, vetted suppliers, processor agreements, logging of administrative access, and staff training. We do not store full payment card data at any time.
If a personal data breach occurs and is likely to result in a risk to individuals, we will notify the competent supervisory authority without undue delay (within 72 hours where the GDPR applies) and inform affected customers without undue delay when the breach is likely to result in a high risk.
11. Your rights (GDPR / UK GDPR)
If you are in the EEA or the UK, you have the right to:
- Access a copy of the personal data we hold about you (Article 15);
- Rectify inaccurate data and complete incomplete data (Article 16);
- Erase your data where our grounds for keeping it no longer apply (Article 17) — note that we must retain invoice and tax records for the statutory period;
- Restrict processing while a dispute about accuracy or lawfulness is resolved (Article 18);
- Object to processing based on legitimate interests, including direct marketing, which we stop immediately (Articles 21 and 19);
- Data portability — receive the data you gave us, for an order or account, in a structured machine-readable format (Article 20);
- Withdraw consent at any time where consent is the basis (Article 7(3));
- Lodge a complaint with your data protection supervisory authority. You can also complain to our local authority if you prefer we handle it first, but you are free to go straight to your own authority.
To exercise a right, write to [email protected] (a reply address we can verify is usually enough; we may ask for one extra identifier for deletion or portability requests, and we will never ask for a copy of your passport unless a legal verification duty requires it). We respond within one month. Complex or numerous requests may take up to two additional months, and we will tell you within the first month. Requests are free of charge unless they are manifestly unfounded or excessive.
12. California privacy notice (CCPA/CPRA)
This section is a "notice at collection" for California residents and applies for the 12 months preceding the date of this policy.
12.1 Do we sell or share personal information?
No. We do not sell or share personal information as those terms are defined by the CCPA/CPRA, we do not run cross-context behavioural advertising, and we do not receive anything of value in exchange for your data. In the last 12 months we have sold or shared zero categories of personal information. Because we do not sell or share, there is nothing to opt out of; the link in our footer still takes you to this section for clarity.
12.2 Categories we collect
| Category (CCPA §1798.80) | Examples | Sources | Purpose | Disclosed to |
|---|---|---|---|---|
| Identifiers | Name, email, IP address, online identifier | You; automatically | Order fulfilment, security, support | Payment, hosting, email, support providers |
| Customer-recorder information | Billing country, VAT/tax ID, company name | You; payment provider | Invoicing, tax, fraud prevention | Accounting, payment providers |
| Commercial information | Products purchased, order value, licence keys | You | Contract performance, warranty and support | Order management, email providers |
| Internet / network activity | Pages viewed, referring site, browser and device data | Automatically | Site function, consented analytics, abuse blocking | Hosting/CDN, analytics providers |
| Precise geolocation | Not collected (only country-level inference from IP) | — | Tax/VAT determination | — |
| Sensitive personal information | Not collected; card data is handled by the payment provider | — | — | — |
| Employment / professional information | Company role or contact person, only for business orders | You | Billing and licensing | Invoicing tools |
12.3 Your California rights
- Right to know / access the categories and specific pieces of personal information collected, the sources, purposes and recipients (for the 12-month window).
- Right to delete personal information we collected from you, subject to the statutory exceptions (for example completing the transaction, security, and legal compliance).
- Right to correct inaccurate personal information.
- Right to opt out of sale or sharing — not applicable because we do not sell or share.
- Right to limit use and disclosure of sensitive personal information — not applicable because we do not collect it.
- Right to non-discrimination: exercising any of these rights will not cost you anything, change our prices or reduce the service you receive.
How to submit a request: email [email protected] with the subject "California Privacy Request", or write to the postal address in section 1. Two methods are available so you can choose. If you use an authorised agent, we will require the agent's signed permission and may verify your identity directly.
Verification and timing: we match the requesting email against your account, or ask for two data points not already on file. We respond free of charge within 45 days, extendable once by a further 45 days with notice. Opt-out preference signals, including Global Privacy Control (GPC), are respected automatically: our site sets no advertising cookies, so a GPC "do not sell or share" signal requires no change.
Requests are logged for 24 months so we can demonstrate compliance.
13. Other regions, children and automated decisions
Other jurisdictions. We apply the same baseline protections to everyone regardless of location. If you are in the UK (UK GDPR and Data Protection Act 2018), Canada (PIPEDA), Australia (Privacy Act 1988 and APPs), Singapore (PDPA), Brazil (LGPD), Japan (APPI), South Korea (PIPA) or another jurisdiction with mandatory rules, you have the equivalent local rights described in sections 11 and 12, and you may complain to your local authority.
Mainland China. This site is operated in English for customers outside mainland China. We do not target, solicit or knowingly collect personal information from users located in mainland China, and the site is not registered or filed there. If you contact us from that region, we will process your information only under this policy.
Children. Our products are not directed at children. We do not knowingly collect personal information from anyone under 16 (under 13 in the United States, COPPA). Digital purchases require an adult and a payment method the purchaser is legally entitled to use. If you believe a child has given us data, contact us and we will delete it.
Automated decisions and profiling. None. Our payment provider's fraud screening may contribute to a decision to accept or decline a transaction; if a transaction is declined and you ask us, a person will review it.
14. Changes to this policy
We may update this policy. Material changes are announced at least 14 days before they take effect, by a notice on this page and, where you have an email relationship with us, by email. The version and date at the top of this page always show the version in force; superseded versions are archived on request.
15. How to contact us
- Privacy and data protection: [email protected]
- General support and account requests: [email protected]
- Registered business details: supplied on request to any customer, supervisory authority or payment partner; our merchant of record Gumroad also prints its own registered address on every invoice
You can also use the channels on the contact page, or read our Terms of Service for licence, refund and withdrawal rules.