Privacy Policy

This policy explains what personal data we collect when you use our store, why we collect it, who we share it with and how you can control it.

1. WHO IS RESPONSIBLE FOR YOUR DATA

The data controller for this website (imoonstudio.com, also called Moonmarket) is:
• Pedro Antonio Gómez Rodríguez, trading as iMoon Studio
• C/ Santa Teresa de Jesús 10, 45800 Quintanar de la Orden (Toledo), Spain
• Privacy contact: info@imoonstudio.com

We process personal data in line with the EU General Data Protection Regulation (GDPR) and the Spanish Organic Law 3/2018 on Data Protection and Digital Rights (LOPDGDD).

2. WHAT DATA WE COLLECT

We only collect the data we need to run the store:
• Account data: name, email address and password (stored encrypted).
• Billing data: name, country and, if you provide them, address, company name and VAT number. We need your country to apply the correct taxes.
• Order data: products, prices, taxes, payment method used, date, order number and Licence ID.
• Payment data: handled by the payment providers. We receive confirmation of the payment and, for cards, only the card type and last four digits. We never see or store your full card details.
• Download and update data: when you download a file or a product checks for updates, we record the product, the date, the IP address and the purchase email or Licence ID used to verify your licence. For WordPress products, the address of the website that asks for the update is also sent. Software activation uses your email address and the activation code.
• Support and contact data: what you write to us by email or through the contact form, including any screenshots or files you send.
• Usage statistics: if you accept analytics cookies, Google Analytics collects how the site is used (pages visited, time on page, approximate location, device and browser type). It does not tell us who you are.
• Technical data: IP address, browser and device, collected by the server for security and to keep the site working. Cookies are explained in our Cookies Policy (https://imoonstudio.com/cookies-policy/).

We do not collect special categories of data, and we do not ask for more information than the store needs.

3. WHY WE USE IT AND ON WHAT LEGAL BASIS

• To create and manage your account and give you access to your downloads, licences and updates. Basis: performance of the contract (art. 6.1.b GDPR).
• To process orders and payments, deliver products, issue the licence certificate and send order emails. Basis: performance of the contract.
• To verify licences and deliver updates to buyers. Basis: performance of the contract.
• To answer support requests and messages. Basis: performance of the contract, or our legitimate interest in replying to people who contact us (art. 6.1.f).
• To keep accounting and tax records of sales. Basis: legal obligation (art. 6.1.c).
• To measure how the site is used and improve it, with Google Analytics. Basis: your consent, given in the cookie banner (art. 6.1.a GDPR). You can withdraw it at any time from the cookie settings.
• To protect the store against fraud, abuse and shared downloads. Basis: legitimate interest.

No marketing emails. We do not send newsletters or promotional emails, and we never sell or rent your data. You will only receive emails about your account, your orders and your support requests.

4. WHO WE SHARE IT WITH

We only share data with the providers we need to run the store, under data processing agreements and only for the purposes above:
• Stripe, through WooPayments (Automattic): card payments and express payments with Apple Pay and Google Pay.
• PayPal and Amazon Pay: when you choose them, you pay on their own platforms under their privacy policies.
• Apple and Google: when you use Apple Pay or Google Pay, under their own terms.
• Google (Google Ireland Limited): Google Analytics, only if you accept analytics cookies.
• STRATO (Germany): website hosting and email.
• Bunny.net (BunnyWay d.o.o., Slovenia): storage and delivery of downloads, audio and video previews.
• Cloudflare: protection of the website against attacks and bots.
• GTranslate, which uses Google Translate to translate page content when you choose another language. It does not receive your account or order data.

We may also disclose data to public authorities when the law requires it, for example to the tax authorities.

5. INTERNATIONAL TRANSFERS

Most of our providers process data in the European Union. Some, such as Stripe, PayPal, Amazon, Apple, Google and Cloudflare, may process data in the United States or other countries. In those cases the transfer is covered by the EU-US Data Privacy Framework or by the Standard Contractual Clauses approved by the European Commission.

6. HOW LONG WE KEEP IT

• Account data: while your account is open. If you ask us to delete it, we delete it, except for the data we must keep by law.
• Orders and billing data: for as long as tax and commercial law requires, generally up to 6 years.
• Licence records (Licence ID, products, date): for as long as the licence may need to be verified, so we can confirm your licence if you or a platform ever ask.
• Support messages: for as long as needed to resolve your request, and up to 2 years afterwards.
• Analytics data: kept by Google Analytics for up to 14 months.
• Server and download logs: for a limited period for security purposes.

7. YOUR RIGHTS

You can at any time:
• Access your data and get a copy of it.
• Rectify inaccurate data. Most of it can be changed directly in My account › Account details.
• Ask us to erase your data.
• Object to or ask us to restrict processing.
• Ask for portability of your data in a common format.

Write to info@imoonstudio.com from the email address of your account, or include enough information for us to identify you. We reply within one month.

If you think we have not handled your data correctly, you can file a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos (https://www.aepd.es), www.aepd.es) or with the authority of your country of residence.

8. SECURITY

The whole website runs over an encrypted HTTPS connection. Passwords are stored encrypted, payments are handled by certified payment providers, and downloads are delivered through protected links. Access to customer data is limited to what is needed to run the store.

9. MINORS

The store is not intended for children. You must be at least 14 years old to create an account, and of legal age in your country to make a purchase.

10. OTHER WEBSITES

Our pages link to other websites, such as product demos, our other brands or payment providers. Those websites have their own privacy policies, and we are not responsible for them.

11. CHANGES TO THIS POLICY

We may update this policy, for example if we add a new provider or the law changes. The date at the top shows the latest version. Important changes will be announced on the website.