SteamPlay legal
Privacy policy
What data SteamPlay collects, why we collect it, and the controls you have.
1. Data we collect
Account data: name, email address, hashed password or Auth0 subject identifier, and two-factor authentication status.
Order data: products purchased, order value, payment provider reference and delivery status. Card numbers are handled exclusively by our payment providers.
Technical data: IP address, user agent, approximate region and security events used for fraud prevention and rate limiting.
2. Why we use it
To deliver your order, provide support, prevent fraud, comply with tax and accounting obligations, and improve the storefront.
Marketing email is opt-in only and can be withdrawn at any time from your account settings or the unsubscribe link.
3. Sharing
We share the minimum necessary data with Stripe, PayPal and Coinbase Commerce for payment processing; with Auth0 for authentication; with Supabase for encrypted data storage; and with Cloudflare for edge security.
We do not sell personal data.
4. Retention
Order records are retained for seven years where required by tax law. Security and audit logs are retained for 90 days. Account data is deleted within 30 days of a verified deletion request, except records we must keep by law.
5. Your rights
You may request access, correction, export or deletion of your data, and you may object to processing based on legitimate interests.
Send requests to support@steamplay.store from the email address on your account. We respond within 30 days.
6. Security
Data is encrypted in transit with TLS 1.3 and at rest by our infrastructure providers. Admin access requires two-factor authentication and is logged in an append-only audit trail.
This document is a demo template and does not constitute legal advice. Have your final policies reviewed by a qualified lawyer before accepting live payments.