Legal

Privacy Policy

This policy explains what personal data we process when you use Concept Studio’s website, accounts, and purchases.

Last updated 31 July 2026

1. Controller

Concept Studio is the controller of personal data collected through this website. Contact: support@conceptstudio.dev.

2. Data we collect

Depending on how you use the site, we may process:

Account data — name, email, password hash, optional Cfx username, marketing preference, and timestamps.
Purchase data — package identifiers, purchase dates, and Tebex payment references we store to show your library / support purchases. Card details are handled by Tebex / payment providers, not stored on our servers.
Support communications — messages you send by email or Discord.
Technical / usage data — pages viewed, approximate referrer host, and aggregate event counts (for example add-to-cart), when you allow analytics cookies / similar tech. See our Cookie Policy.
Cart data — stored in your browser (local storage) so your cart persists between visits.

3. Why we process data (purposes & bases)

Provide the storefront and accounts — contract / steps prior to contract.
Process and fulfil orders(via Tebex & Cfx) — contract.
Customer support and fraud prevention — legitimate interests and/or contract.
Security and essential site operation (session cookies) — legitimate interests / contract.
Optional analytics — consent (you can accept or refuse in the cookie banner).
Marketing emails — only if you opt in; you can withdraw anytime via profile or by emailing us.
Legal compliance — legal obligation where applicable.

4. Who we share data with

We do not sell your personal data. We may share data with:

Tebex — checkout, payments, and related order fulfilment.
Cfx.re / Keymaster — escrow product delivery tied to your Cfx identity.
Hosting / infrastructure — e.g. our website host (such as Vercel) processing requests and logs.
Discord — if you contact us there (under Discord’s terms).
Professional advisers or authorities when required by law or to protect our rights.

5. International transfers

Our host and processors may process data in the EU/EEA, United States, or other countries. Where required, we rely on appropriate safeguards (for example Standard Contractual Clauses) provided by those processors.

6. Retention

Account data — while your account is active, then deleted or anonymised on request unless we must keep records longer.
Purchase records — as needed for support, accounting, and dispute handling.
Analytics aggregates — kept in summarised form for business insights; not used to build marketing profiles of individuals.
Support messages — for as long as useful to resolve your issue and related follow-up.

7. Your rights

If GDPR or similar law applies, you may have rights to access, rectify, erase, restrict, object, and data portability, and to withdraw consent. Contact support@conceptstudio.dev. You may also lodge a complaint with your local supervisory authority. In Hungary, that is the National Authority for Data Protection and Freedom of Information (NAIH).

8. Security

We use reasonable technical and organisational measures (including hashed passwords and httpOnly session cookies). No method of transmission or storage is perfectly secure.

9. Children

The site is not directed at children under 16. If you believe we hold a child’s data without appropriate basis, contact us to delete it.

10. Changes

We may update this policy and will change the “Last updated” date. Material changes may also be highlighted on the site where appropriate.