Privacy

Last updated: 26 October 2026

This policy explains what personal data Zinkly Shop collects, why, who sees it, how long we keep it and what rights you have. It follows the EU General Data Protection Regulation (GDPR) and, for UK users, the UK GDPR.

1. Who is responsible

The controller of your data is Zinkly, Corfu 49100, Greece. For anything about your data, email support@zinkly.org.

Creators who sell on the shop receive some data about their buyers (see section 5). They use it as separate controllers, for supporting you and for their own records.

2. What we collect

Account

Name, username, email address, password (stored only as a secure hash), profile picture, when you last logged in.
If you sign in with Zinkly: your Zinkly ID, username, profile and cover picture, verified status, and the login tokens Zinkly gives us so the accounts stay linked.

Purchases and downloads

Orders: what you bought, prices, discounts, taxes, payment method, order and payment status, refunds.
Licences: your licence key, licence type, support period.
Downloads: which item and version you downloaded and when.
Licence checks: when a creator's software checks your licence key, the website domain it runs on and how often it was checked.
Zinkly Coins payments: the coin charges made from your Zinkly balance.
For physical items: the shipping name, address and phone number you enter.

Payments

Card payments are handled by Stripe and PayPal payments by PayPal. We do not see or store your full card number. We receive and keep payment references, amounts, status and the messages the provider sends us about the payment.

What you write

Reviews, comments, ratings, support tickets and messages to creators, reports, favourites, followed items and creators, and your notification settings.

Shop assistant (AI)

If the shop assistant is available and you use it, we store your conversation and usage counts. See section 6.

Creators

If you sell on the shop: your public store details (name, bio, pictures, links, location, support email), payout method and payout details (for example PayPal email or bank details), earnings, withdrawals and commission.

Technical data

Your login session, stored on our server with your IP address and browser type, so you stay logged in and to protect accounts.
Item views: we count views using a one-way coded value (a hash) made from your account or, if you are not logged in, your IP address and browser. We do not store the IP address itself for this.
Security and error logs, and a record of important actions taken by staff.

3. Why we use it and our legal basis

To run your account, sell and deliver items, issue licences, give access to downloads and updates, handle support and refunds — needed to perform our contract with you (GDPR art. 6(1)(b)).
To keep invoices, tax and accounting records — legal obligation (art. 6(1)(c)).
To keep the shop secure, prevent fraud, chargeback abuse and licence sharing, count item views, show sales and ratings, and improve the shop — our legitimate interests (art. 6(1)(f)). You can object at any time (section 8).
To let creators support their buyers and check licences — contract and legitimate interests.
To send you emails about items you follow, new updates and offers you chose to receive — your consent or our legitimate interest in telling you about items you bought; you can turn these off in Email settings or with the link in each email. Messages about your orders, payments, downloads and account are always sent because they are part of the service.

We do not sell your personal data and we do not use it for automated decisions that have legal or similarly significant effects on you.

4. Cookies and storage in your browser

We only use cookies and storage that the shop needs to work. We do not use advertising or tracking cookies, so we do not ask for cookie consent.

zinkly-shop-session — keeps you logged in and remembers your cart during a visit.
XSRF-TOKEN — protects forms against forged requests.
remember_web_… — only if you tick "remember me", keeps you logged in longer.
zs_theme (cookie, 1 year) and zs-theme (browser storage) — remember light or dark mode.
Browser storage for the shop assistant — remembers your open conversation.

When you pay, Stripe or PayPal may set their own cookies on their pages for security and fraud prevention; their own policies apply.

5. Who we share data with

Creators of items you get: your name, username and profile picture, which of their items you have, how you got it (bought, free, bundle, subscription), the date, your licence type, whether and when you downloaded it, and the domains your licence was checked from. They also see what you write in support tickets and reviews of their items. For physical items they get the shipping name, address and phone number so they can send it. They do not get your email address, password or payment details.
Everyone visiting the shop: your public reviews, comments and ratings with your name, username and picture; for creators, the public store page.
Payment providers: Stripe and PayPal, to take and refund payments.
Zinkly (zinkly.org): if you sign in with Zinkly or pay with Zinkly Coins, to link accounts and charge or refund coins.
Service providers who host the shop, send emails and, if enabled, run the shop assistant — only as needed and under contract with us.
Authorities, advisers and courts when the law requires it or to defend legal claims.

6. Shop assistant (AI)

When the shop assistant is turned on, the messages you type and information about items are sent to our AI provider to create the answer. Please do not type passwords, payment details or other sensitive information. We store conversations so you can return to them and to prevent abuse, and we limit how much you can use it. You can ask us which provider is used.

7. Transfers outside the EU

Some providers (for example Stripe, PayPal or an AI provider) may process data outside the EU/EEA or UK. When they do, we rely on an adequacy decision (such as the EU–US Data Privacy Framework for certified companies) or on the European Commission's Standard Contractual Clauses with extra safeguards where needed. You can ask us for details.

8. Your rights

You can ask us to:

see the data we hold about you and get a copy (access);
correct wrong data — most of it you can change yourself in Account settings;
delete your data (erasure), unless we must keep it, for example invoices for tax law;
limit how we use it (restriction);
get your data in a portable format (portability);
object to processing based on our legitimate interests, and to direct marketing at any time;
withdraw consent at any time, without affecting what was done before.

Email support@zinkly.org from the address on your account. We answer within one month (we may extend this by two more months for complex requests and will tell you). We may ask you to confirm your identity.

You can also complain to a data protection authority. In Greece this is the Hellenic Data Protection Authority (www.dpa.gr). You can also complain in the EU country where you live or work, and in the UK to the Information Commissioner's Office (ico.org.uk). We would like the chance to help first.

9. How long we keep data

Account data: while your account exists. If you ask us to delete your account, we delete or anonymize it within 30 days, except what we must keep below.
Orders, invoices, payments and refunds: as long as Greek tax and accounting law requires (generally at least 5 years after the end of the tax year), and longer if needed for a legal claim.
Licences and download history: as long as the licence exists, so you keep access to your items and updates, and with the related order after that.
Reviews and comments: until you or we remove them, or your account is deleted (they may then remain without your name).
Support tickets and assistant conversations: while your account exists, unless you ask us to delete them earlier.
Login sessions: they expire after a period of inactivity and are then removed.
Security logs: only for a limited time, unless needed to investigate an incident.
Creator payout records: as long as tax and accounting law requires.

10. Security

We use encrypted connections (HTTPS), hashed passwords, encrypted secrets, access limited to staff who need it, and records of important staff actions. Product files are kept in private storage and every download is checked. No system is perfectly secure; if a breach puts your rights at risk we will tell you and the authority as the law requires.

11. Children

The shop is not meant for children under 15. If you are under the age required in your country, you need a parent's or guardian's permission. If you think a child has given us data without permission, contact us and we will delete it.

12. Changes

We may update this policy when the shop or the law changes. The date at the top shows the latest version. We tell you about important changes by email or on the shop.

13. Contact

Zinkly, Corfu 49100, Greece · support@zinkly.org