The types of data are delineated in the Privacy Policy, and they are collected when visiting a website and exclusively during the moment of purchasing products. For further information regarding the terms of service, please refer to the Terms of Service. The data controller is the administrative entity responsible for Afterburner (see Section 1), located at 87-100 Poland. This entity is obligated and responsible for data subjects and for providing information regarding data processing and website security.

This Privacy Policy explains what personal data Afterburner collects when you visit afterburner.cc, buy our products or contact us, why we collect it, how long we keep it and what rights you have. We collect personal data mainly when you place an order. Browsing the website does not require you to give us any personal data, and we do not use advertising or cross-site tracking. The terms that govern purchases and licenses are set out in our Terms of Service.

The prevailing location for any personal information and website hosting that falls under the jurisdiction of Polish and/or European Union laws is determined as such. The website is operated by a single administrator, Sasha N.-Friedlich. In the event that further requests or privacy reservations are required, interested parties should contact the administrator via email at contact@afterburner.cc. Personal data is processed under Polish law and the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR").

When you contact us, for support or with a question, we receive your email address, name, the content of your message and any attachments. For data maintenance period see Section 4.

Strictly only necessary third-party cookies are used solely by our payment provider (Stripe) and security provider (Cloudflare Turnstile) to process transactions and prevent fraud. The website exclusively utilizes Analytics data provided by Cloudflare. It has been determined that the user's activity is not tracked across sites from Afterburner but rather third-party extensions. Furthermore, no advertising is present, nor is cross-site availability a factor. Sensitive or health data is not subject to processing.

(Purchases) The exclusive subject of data collection is personal data, which is utilized for the provision of purchases and products, license validation, and customer support. With Product Data Collection and Usage, Feedback (data with your consent or anonymous survey), the use of feedback may be employed to promote services. Feedback employs anonymized questions or rates. In instances where Feedback incorporates personal data, such as a user's name, company (if provided), and country (if provided), this is done with the user's consent to promote services or products. This may include the initiation of communication for the purpose of commercial engagement. The processing of personal data encompasses the following categories:

• -(1) Email Address
• -(2) Name
• -(3) Phone number
• -(4) Internet Protocol (IP) address
• -(5) Physical Address*
• -(6) Financial information pertinent to payments and shipping (e.g. billing and shipping address)*; card and bank details are entered directly with Stripe and never reach or are stored by Afterburner
• -(6.2) Tax ID (NIP or EU VAT number, if necessary)
• -(7) Voluntary Feedback* and Survey responses

*It is imperative to acknowledge that points (5) and (6) are exclusively mandated within the framework of the Order and Shipping process. The data is maintained for the duration of the license period, as stipulated by accounting law and the tax period. Customers receive information as Order Data (products purchased, order number, price, currency, date, license key) and Payment Data (payment status, payment method type, card brand, the last four digits of the card and the card's country, as reported by Stripe).

By Legal Basis of Processing (General Data Protection Regulation, Art. 6):

• -(1) The processing of data is carried out in accordance with the terms of an order, as stipulated in the contract (Art. 6(1)(b)) for payment processing, delivery and licenses, issue license keys, and provide downloads.
• -(2) (Art. 6(1)(f)) data processing for security and analytics purposes and fraud prevention (Cloudflare Turnstile), email management (support, requests, legitimate communication) and measurement of website traffic in aggregate & exercise of legal claims (legitimate interest)*.
• -(3) Feedback and promotional data are processed solely on the basis of your consent (Art. 6(1)(a)); type of data procession as specified in following Section (testimonial).
• -(4) To issue invoices, keep accounting records and meet tax obligations of legal basis under Polish accounting and tax law (Art. 6(1)(c)).

*Where we rely on legitimate interest, you may object to the processing (see Your Rights). Withdrawing consent does not affect processing carried out before the withdrawal. Giving the data marked as required at checkout is necessary to conclude the contract; without it we cannot complete your order. Giving data for feedback or marketing is optional.

By visiting a website, our hosting and security provider, Cloudflare, processes the technical data needed to deliver the website and protect it from attacks: IP address, browser and device type, requested pages, referrer and time of the request. We use Cloudflare Web Analytics, which counts visits in aggregate without cookies, without building a profile of you and without following you across other websites.

Extended Cookie Policy and Similar Technologies:

• -Cloudflare: security cookies (such as __cf_bm) used to tell people from bots and protect the website. Cloudflare Turnstile may run a short browser check in place of a CAPTCHA.
• -Stripe: cookies set during checkout (such as __stripe_mid and __stripe_sid) to process payments and prevent fraud.

The data which is not collected: special categories of data, such as health data, political opinions or religious beliefs, and we do not buy personal data from third parties. Our software products contain no telemetry and do not send usage data to us.

See Section 2 'Types of data collected' for previous information. Data is shared only with third-party services to run the product as mentioned (Stripe for payments as Financial Infrastructure; Resend for transactional email updates and management; Cloudflare for hosting and security). International transfers outside the EEA rely on Standard Contractual Clauses (SCCs) approved by the European Commission to ensure standard data protection and safeguards. We do not sell or rent personal data. We share it only with providers that help us run the website and fulfill orders. They process data on our behalf under data processing agreements or, where they act as independent controllers, under their own privacy policies:

• -Stripe: payment processing and fraud prevention. For some purposes, such as its own legal obligations, Stripe acts as an independent controller.
• -Cloudflare: hosting, content delivery, DDoS protection, firewall, Turnstile and Web Analytics.
• -Resend: transactional emails such as order confirmations, license keys and download links.
• -Shipping carriers (the update of available carriers will be held on version V1.2 of Privacy Policy, as the product selling begins): delivery of physical products. They receive your name, shipping address, phone number and email address.
• -Disclosed data may be shared to public authorities, such as tax offices or courts, only when Polish or European Union law requires it.

Some of our providers are based in, or use subprocessors in, the United States and other countries outside the European Economic Area. These transfers rely on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework where the provider is certified under it, or on Standard Contractual Clauses approved by the European Commission (Art. 46(2)(c) GDPR). You can ask for a copy of the relevant safeguards at contact@afterburner.cc.

• -Order, invoice and payment records: 5 years from the end of the calendar year in which the tax payment deadline fell, as required by Polish tax and accounting law.
• -License records (email, order number, license key): for as long as the license is valid, so we can confirm it and restore access if you lose it, and in any case until claims under the contract become time-barred.
• -Shipping data: until delivery is complete and any complaint or return period has ended; after that it is kept only as part of the order records above.
• -Support correspondence: up to 24 months after the last message, unless it relates to an open claim.
• -Feedback and testimonials published with consent: until you withdraw consent.
• -Security logs held by Cloudflare: for the short periods set by Cloudflare to detect and stop attacks.

When a retention period ends, we delete the data or anonymize it so that it can no longer identify you.

Under GDPR, you have the right to access, rectify, delete, or restrict the processing of your data. You can also request a copy of your data in a portable form or object to processing. To exercise these rights, contact contact@afterburner.cc. You also have the right to lodge a complaint with the local supervisory authority: Prezes Urzędu Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warszawa, Poland. Requests to contact@afterburner.cc are free. The extended rights you gain are as follows:

• -access your data and receive a copy of it (Art. 15);
• -have inaccurate data corrected (Art. 16);
• -have your data deleted (Art. 17), unless we must keep it, for example for tax records;
• -restrict processing (Art. 18);
• -receive the data you gave us in a structured, machine-readable format and have it sent to another controller (Art. 20);
• -object to processing based on legitimate interest (Art. 21);
• -withdraw consent at any time, without affecting processing carried out before (Art. 7(3)).

To respect your privacy, the user is informed with categories of Personal Data and management options. The Terms of Service, Privacy Policy are available on the website; the license copy and agreement is included in the package. The Afterburner provides open-source products and software only, making the content and its build clear and public to review. The website may link to other websites, such as code repositories or social media profiles. Those sites have their own privacy policies, and we are not responsible for how they handle data.

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Stripe screens payments for fraud automatically. If a payment is declined and you believe it was a mistake, contact us and we will review the order manually.

Our website and products are not directed at children under 16, and we do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, please contact us and the data will be deleted.

All connections to the website are encrypted (TLS). The website is protected by Cloudflare DDoS mitigation, web application firewall and Turnstile. Payment data is handled directly by Stripe, a PCI DSS Level 1 certified provider, and is never stored on our servers. Access to administrative tools and provider dashboards is limited to the administrator and secured with strong authentication. If a personal data breach is likely to put your rights at risk, we will notify UODO within 72 hours of becoming aware of it and, where the risk is high, inform affected users without undue delay (Art. 33 and 34 GDPR).

We may update this policy when our services, providers or the law change. The date at the top shows when it was last updated. If a change materially affects how we use data from existing orders, we will notify affected customers by email before it takes effect.

Terms of Service, contact form