Privacy Policy
Last updated Document privacy
This is a provisional draft.
This text has not yet been through legal review. It describes how we intend to operate and is published early so you can read it before you buy — but do not treat it as final or as legal advice. Ask us at support@gplreal.com if any of it matters to a decision you are about to make.
[Controller identity and, where required, an EU/UK representative and DPO contact must be inserted before launch.]
What we collect and why
| Data | Why | Lawful basis | Kept for |
|---|---|---|---|
| Name, email, password hash | To give you an account and let you sign in | Contract | Life of the account |
| Billing name, address, country, VAT number | To take payment and meet tax obligations | Contract, legal obligation | 7 years (tax) |
| Order and payment records | To provide what you bought and handle refunds | Contract, legal obligation | 7 years (tax) |
| Download records: product, version, time, IP, user agent | To enforce your daily limit, detect account sharing and abuse, and prove what we supplied | Contract, legitimate interests | 12 months, then aggregated |
| Support messages | To answer you | Contract, legitimate interests | 3 years |
| Marketing preferences | To send what you asked for | Consent | Until withdrawn |
| Site analytics | To understand and improve the site | Consent | 14 months |
We do not see or store your card details. Payments are handled by Stripe, which receives your card data directly.
Cookies
See our cookie policy. Non-essential cookies are set only with your consent, and you can change that choice at any time.
Who we share it with
Only processors who need it to run the service: our payment provider, our hosting and CDN provider, our email provider, and our analytics provider once you consent. We do not sell personal data. Where data leaves the UK/EEA we rely on the appropriate safeguards for that transfer.
Automated decisions
We use automated signals to spot account sharing and abusive download patterns. A suspension that follows is reviewed by a person before it becomes permanent, and you can contest it by contacting support.
Your rights
You may ask us for a copy of your data, to correct it, to delete it, to restrict or object to our use of it, and to receive it in a portable form. Where we rely on consent you may withdraw it at any time. Tell us and we will respond within one month.
Some data we must keep even if you ask us to delete it — tax records, and the minimum needed to enforce a suspension. We will tell you when that applies.
You may also complain to your data protection authority. In the UK that is the ICO.
Security
Passwords are hashed. Traffic is encrypted in transit. Product archives sit on private storage and are only ever released through short-lived signed links tied to your account.
Questions about this page?
If anything here is unclear, or you think it is wrong, tell us — a policy nobody can follow is not doing its job.
Contact us about this page support@gplreal.com
Notice-and-action contact (illegal content and copyright notices under the DSA and the DMCA): dmca@gplreal.com. Notices sent to general support are re-routed, which costs time we would both rather keep.
