This policy explains what Legacy Scripts ("we", "us") does with personal data.
Who is responsible for your data
Legacy Scripts, based in Sweden, is the data controller for everything described below — except payment data, which is covered in the next section.
For any question about your data, or to exercise the rights further down this page, email contact.kevkazz@gmail.com. We answer from there and you do not need a Discord account to reach us.
Checkout and payment
Payments are handled by Tebex Limited, acting as merchant of record. Tebex takes the payment and is the controller for the payment data itself — we never see your card details. Tebex's own privacy policy covers that part of the transaction.
After a purchase completes, Tebex sends us a record of it, and we become the controller for that copy.
What we collect
When you buy something. Your email address, your Tebex username, what you bought, the amount and currency, any coupon used, the name of the payment method, and the transaction record Tebex sends us.
When you start a checkout and do not finish it. Your email address and the contents of that cart, so we can send you one reminder.
When you subscribe to updates or ask for a discount code. Your email address and where you subscribed from.
When you visit. If you accept analytics, we use Vercel Analytics, which counts page views without cookies and without building a profile of you across sites. Our hosting provider also keeps standard server logs, including IP addresses, for security and debugging.
We do not collect your name, postal address, phone number, date of birth, or any special category data. We do not buy data about you from anyone, and we do not profile you or make automated decisions about you.
What we store in your browser
The store uses your browser's local storage — not tracking cookies — for things it needs to work:
- Your cart, so it survives a reload.
- Whether you dismissed the announcement bar or the discount popup.
- Your analytics choice, so we stop asking.
These stay on your device, we cannot read them from our servers, and they are not shared with anyone. Clearing your site data removes them. Because they are strictly necessary for a service you asked for, they do not require consent.
Analytics loads only if you accept it in the banner, and you can change your mind at any time using Cookie settings in the footer. Declining does not affect the store.
Signing in to the admin area sets a session cookie. That applies to our staff, not to customers.
Why we are allowed to use it
- Completing your order and delivering what you bought — performance of our contract with you (Art. 6(1)(b) GDPR).
- Providing support — performance of our contract with you.
- Abandoned cart reminders, marketing email and analytics — your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.
- Keeping the store working and secure — our legitimate interests (Art. 6(1)(f) GDPR).
- Accounting records — a legal obligation (Art. 6(1)(c) GDPR), under the Swedish Accounting Act.
Who we share it with
| Provider | What it handles |
|---|---|
| Tebex Limited | Payments, invoicing, tax, product delivery |
| Supabase | Our database, where orders and subscribers are stored |
| Vercel | Hosting, and cookieless page view analytics |
| Resend | Sending order confirmations and marketing email |
| Discord | Our community server, and staff sign-in for the admin area |
We do not sell your data, and we do not share it for anyone else's advertising.
International transfers
Some of these providers process data outside the EU/EEA, mainly in the United States. Where they do, transfers rely on the European Commission's standard contractual clauses and, where applicable, the EU–US Data Privacy Framework, as set out in each provider's data processing terms.
How long we keep it
- Order records — seven years after the end of the financial year, as required by the Swedish Accounting Act (bokföringslagen).
- Abandoned cart records — until the cart is recovered, or 30 days, whichever comes first.
- Marketing subscribers — until you unsubscribe.
- Server logs — as long as our hosting provider retains them.
Your rights
Under the GDPR you can ask us to give you a copy of your data, correct it, delete it, restrict what we do with it, or object to us using it. You can ask for it in a portable form, and you can withdraw consent for marketing or analytics at any time.
Email contact.kevkazz@gmail.com and we will respond within one month.
If you think we have handled your data badly, you can complain to the Swedish Authority for Privacy Protection, Integritetsskyddsmyndigheten (IMY), at imy.se.
Children
The store is not intended for children under 13, and we do not knowingly collect their data. If you believe a child has given us data, contact us and we will delete it.
Security
Data is held in managed services with access restricted to the people who need it. No system is perfectly secure, but we will tell you and the IMY if a breach occurs that is likely to affect your rights.
Changes
We may update this policy. The date at the top shows when this version was published.
Contact
Email contact.kevkazz@gmail.com for anything relating to your personal data. For general support, our Discord server is faster.