Privacy notice

Contact form and private support inbox

The contact form stores your name, reply email, topic, subject, message, submission time, status and reference; an account reference is linked only when you are signed in. Authorized administrators can read, mark or close messages and use your email address to reply. Messages are not public and are not automatically emailed to third parties. This supports your requested contact or complaint under Article 6(1)(b) GDPR where contract-related, otherwise Article 6(1)(f) and the legitimate interest in support and resolving concerns. Hashed network/email rate-limit keys help prevent spam. Messages are retained while needed to handle the matter and any applicable legal obligations or claims; contact the controller to exercise your rights. Please omit passwords, card details and unnecessary sensitive information.

Exclusive usage-rights transactions

Optional exclusive purchases store the seller's accepted agreement, separate price, buyer's acceptance, purchased license terms, order/payment reference, buyer identity and sale time. Original-file SHA-256 fingerprints help prevent duplicate exclusive listings and relisting of sold work. Checkout reservations prevent competing sales and are released after a confirmed cancellation or Stripe expiration. Processing supports the requested transaction (Article 6(1)(b) GDPR), accounting duties where applicable (Article 6(1)(c)), and legitimate interests in preventing conflicting sales (Article 6(1)(f)). Authorship and mandatory statutory rights are not erased. File fingerprints cannot detect all modified copies or external licenses.

Uploads, free downloads and community votes

Uploaded originals and generated previews are stored with their titles, descriptions, bundle assignments and publication settings. Originals use private Supabase storage when configured, otherwise private PostgreSQL storage; access is restricted to entitled buyers, owners and administrators, except when the creator explicitly chooses free public downloads. Free access is under the standard license and does not transfer copyright or place the work in the public domain. Votes link an account to a listing, a positive or negative value, and an update time. They support community ranking and hiding after five downvotes; administrators can review hidden listings. Processing supports requested publication and download services under Article 6(1)(b) GDPR and legitimate interests in community quality and abuse prevention under Article 6(1)(f).

Pay-later commitments

When you choose pay later, we record your account, typed full name, accepted terms and version, order items and prices, acceptance time, due date and payment status. This supports the requested purchase, digital delivery and collection of the outstanding amount (Article 6(1)(b) GDPR), and any applicable accounting obligations (Article 6(1)(c)). A commitment receipt is available from your library. Records are retained while needed for the contract, payment claims and applicable statutory retention periods. PayPal is unavailable during beta. Local demo commitments create no real debt.

About this notice

This notice explains personal-data processing by BuyMyClick during its beta phase under the GDPR and German data-protection rules. The controller is identified above. Browsing the public catalog does not require an account. A beta label does not remove our data-protection obligations or your statutory rights.

Website access and security

When you visit, the hosting infrastructure processes connection and request data such as IP address, browser/device information, URL, time and response status. Cloudflare provides delivery, security and diagnostic logging in the configured Worker deployment; a self-hosted deployment uses its operator-selected host. We use this information for secure, reliable operation and investigating errors, based on Article 6(1)(f) GDPR. Authentication limits use hashed account/network identifiers and counters; these are pseudonymous, not anonymous. Asset approvals are reviewed by an administrator.

Accounts, purchases and licenses

We process your display name, email address, salted password hash, session records, favorites and, where used, credit balance and plan expiry. Purchases store order references, asset/license snapshots, amounts and payment status; contributor sales record royalties. These data provide your requested account, marketplace and licensing services under Article 6(1)(b) GDPR. Required registration, upload and checkout fields are necessary for the respective feature. Without them it cannot be provided. Statutory accounting obligations may require retention under Article 6(1)(c) GDPR.

Uploads and what becomes public

Submitted originals and previews, titles, descriptions, tags, formats, prices, AI disclosures and rights attestations are processed to publish and license your work. Approved previews, descriptions and your contributor display name are public; your account email is not published with listings. Originals are restricted to authorized review and entitled buyers, except when the creator explicitly chooses free public downloads. Only upload material and third-party personal data you may lawfully provide, with necessary permissions. For contributors, the purposes are the requested contract (Article 6(1)(b)) and rights verification/abuse prevention (Article 6(1)(f)). Data about people depicted in media comes from the contributor and requires an appropriate lawful basis and permissions. If an asset depicts you, contact the controller with its URL to exercise your rights.

Recipients and service providers

Authorized administrators access submissions, sales and technical records for operation, review and support. Hosting/database providers process the data needed to operate the platform. Cloudflare supplies Worker hosting and, when enabled, Hyperdrive; the PostgreSQL database host depends on the operator’s deployment. Supabase receives original media when private storage is configured; this app uses its own database-backed login rather than Supabase Auth. When Stripe checkout is enabled, Stripe receives your email, transaction amount and order reference, and processes payment details on its own checkout. This app does not store full card numbers. Email sent to the published Gmail address is processed through Google. Required disclosures to public authorities may occur.

Cookies and browser storage

Authentication and a cart you request use functional storage; a language cookie is written only when you choose a language. Such requested functionality uses Section 25(2)(2) TDDDG, with associated processing under Article 6(1)(b) or (f) GDPR. Optional recently viewed history is off by default and is stored only after your explicit choice (Section 25(1) TDDDG and Article 6(1)(a) GDPR). The preference below lets you withdraw consent and delete that history without affecting earlier lawful processing. The application code does not embed advertising trackers or optional analytics. Fonts and bundled sample previews are served by this website.

You can also clear or block cookies and local storage in your browser settings; this may restrict sign-in or cart functionality. Clearing recent history does not delete independent hosting request logs.

Retention and deletion

Account, asset and transaction data are kept for the services you use and while needed for unresolved cases, legal claims or applicable accounting/tax duties. Data no longer needed should be erased or anonymized, subject to lawful exceptions. There is no automatic account deletion or general server-side purge in this release: contact the controller to exercise your rights. Session expiry does not itself erase database rows. Technical logs and backups follow the configured provider retention/rotation schedules; the controller can provide the settings relevant to your data. Beta resets remain subject to these obligations.

Processing outside the EU/EEA

Infrastructure, payment, storage and email providers may process data or provide support outside the EU/EEA, including in the USA. An EU database region alone does not establish that all processing stays in the EU. Any transfer must use an applicable Chapter V GDPR mechanism, such as a valid adequacy decision or Standard Contractual Clauses with necessary safeguards. You can request details and a copy of the applicable safeguards from the controller. Provider information is linked below; the operator must verify the arrangements actually in use.

Your rights and complaints

Subject to the applicable conditions, you may request access, correction, erasure, restriction and data portability (Articles 15–20 GDPR). You may object to processing based on legitimate interests for reasons arising from your particular situation (Article 21). Consent can be withdrawn for the future. Send requests to the contact above; proportionate identity verification may be needed. Requests are normally answered within one month, with any permitted extension explained. You may complain to a supervisory authority, including the Lower Saxony authority linked below, or the authority where you live or work. Rights requests are handled by email; there is no self-service account export/deletion tool yet.

Support and feedback

If you email us, we process your contact details, message and relevant account/order references to answer the request. The basis is Article 6(1)(b) GDPR for contract-related enquiries, otherwise Article 6(1)(f), our interest in support and resolving problems. Please do not send passwords, full payment-card details or unnecessary sensitive/third-party data.