Privacy Policy

Who is responsible

The controller of your personal data is Stokefy. For anything about your data write to support@stokefy.com.

What we keep

• Your account: your name, your email address and your password, which we keep only as a one-way hash we cannot read. If you buy as a guest, the name and address you give make the account, which nobody can enter until you open it from the receipt.
• Your orders: the products, the amounts, how you paid, the payment's reference at Stripe or PayPal, and the moment you agreed at checkout to receive the files at once.
• Your downloads: which products your account holds.
• Your reviews: the stars, the text, and the first name of your account, which is shown beside them.
• If you sell: your shop's name, the line about you, the link to your work, and the covers and files you upload.
• Your messages: what you write to hello@stokefy.com or support@stokefy.com, and the address it came from.
• Your cart: if you are not signed in, the products you put in it, under a code kept in the cookie cart.
• Security: the attempts to sign in, counted for a minute by network address, to stop anybody trying passwords over and over.

We use no analytics or advertising tools, and we do not track what you do on the site.

Why, and on what basis

• To give you an account, sell you products, deliver them, publish your reviews, and run your shop if you sell: the contract between us (GDPR, art. 6(1)(b)).
• To keep the records of each sale that tax law requires: a legal obligation (art. 6(1)(c)).
• To protect accounts and payments from abuse: our legitimate interest (art. 6(1)(f)).

We send you no advertising, and no decision about you is made automatically.

For how long

• Your account, reviews and shop: as long as your account is open, or until you ask us to delete them.
• Your orders: ten years, the time the law requires for accounting records (Italian Civil Code, art. 2220).
• A guest's cart: thirty days from its last change.
• A session: twenty-four hours. A sign-in attempt: one minute.
• Your messages: as long as the conversation needs them.

Who else handles it

We do not sell or hand over your data to anybody. These providers handle it on our behalf, under contract, to run the shop:

• Supabase, which holds the database;
• Upstash, which holds the sessions and the carts;
• Cloudflare, which stores the products' files and pictures;
• Vercel, which serves the site;
• Stripe and PayPal, which take the payments and handle your card or account details;
• Resend, which sends the receipts and the links for your account;
• Hostinger, which holds our mailboxes.

Where one of them handles data outside the European Economic Area, it does so with the safeguards the GDPR requires, such as the European Commission's standard contractual clauses.

Your rights

You can ask to see your data, correct it, delete it, restrict its use, receive it in a readable format, or object to its use, by writing to support@stokefy.com. If you think we have not handled it properly, you can complain to the data protection authority where you live, or to Italy's Garante per la protezione dei dati personali (garanteprivacy.it). The cookies are in the cookie policy.