VST CheckoutVST Checkout
Legal

Privacy Policy

Last updated: October 12, 2026

This policy explains what personal data VST Checkout (“we”) collects when you use vstcheckout.com and the checkout pages we host, why we collect it, who we share it with and what choices you have. It applies to developers who sell through the service (“Sellers”) and to people who buy from them (“Buyers”).

1. Who is responsible

VST Checkout operates the platform and is the controller of the account and billing data described below. For a purchase, the Seller you buy from also receives your order data and is independently responsible for how they use it (for example to provide support or process a refund).

2. What we collect

If you are a Seller

  • Account data: email address, name, company name, password (stored hashed by Firebase Authentication) or a sign-in link sent to your email.
  • Products: names, descriptions, prices, artwork, audio demos, formats, tags and the license keys you upload. Keys are stored so they can be delivered to Buyers and are never shown publicly.
  • Stripe Connect: the identifier and status of the Stripe account you connect (whether charges and payouts are enabled). Stripe collects your identity, bank and tax details directly under its own privacy policy; we do not receive them.
  • Subscription: your Stripe customer and subscription identifiers, plan status, trial and billing dates and any unpaid amount. Card details are entered on Stripe-hosted pages and never reach our servers.
  • Settings and usage: notification preferences, custom email templates, and server logs of your use of the dashboard.

If you are a Buyer

  • Checkout details: first and last name, email address, country and any coupon code you enter.
  • Order details: the product, amount paid, Stripe checkout session identifier, date and the license key issued to you. Card details are entered on Stripe’s checkout page and never reach our servers.
  • Technical data: your IP address and the approximate location derived from it (city and country), and marketing parameters in the checkout link (UTM source, medium, campaign, term, content) so Sellers can see which campaigns bring sales.

Everyone

  • Messages you send through the contact form (name, email, topic, message and IP address).
  • Standard server and security logs (IP address, browser, pages requested, timestamps).

3. Why we use it

  • To run the checkout: create the Stripe payment, confirm it, issue a license key and email it to the Buyer.
  • To give Sellers their dashboard: orders, customers, revenue, stock levels, top countries and campaign referrers.
  • To send transactional email: license keys to Buyers; low-stock, sale and billing notifications to Sellers; replies to contact-form messages.
  • To bill Sellers for their subscription and to detect and prevent fraud, abuse and unpaid use.
  • To comply with legal obligations, such as tax and accounting rules, and to establish or defend legal claims.

Where data-protection law requires a legal basis, we rely on performance of a contract (Sellers’ accounts and Buyers’ purchases), our legitimate interests (security, fraud prevention, analytics for Sellers, running the service) and compliance with legal obligations. We do not sell personal data and do not use it for third-party advertising.

4. Who we share it with

  • The Seller you buy from sees your name, email, country, approximate location, order details and campaign parameters, so they can support you and manage their sales.
  • Stripe processes payments, payouts and Seller subscription invoices (Stripe privacy policy).
  • Google Firebase / Google Cloud host the application, database, file storage and sign-in.
  • Resend delivers our transactional emails.
  • ip-api.com turns a Buyer’s IP address into an approximate location at the moment of purchase.
  • Authorities or other parties where the law requires it, or to protect our rights, users or the public.

These providers may process data outside your country. Where required we rely on their standard contractual safeguards.

5. Cookies and local storage

We use only what the service needs to work: Firebase Authentication keeps Sellers signed in, and your browser stores whether you dismissed the cookie notice. Stripe sets its own cookies on its checkout and billing pages for fraud prevention. We do not use advertising or cross-site tracking cookies.

6. How long we keep it

  • Order records (including the license key issued) are kept for as long as the Seller’s account exists and for as long as needed afterwards to meet tax, accounting and dispute obligations.
  • Seller account, product and billing data are kept while the account is active and deleted or anonymised within a reasonable time after it is closed, except where we must retain records by law.
  • Contact messages are kept for up to 2 years. Server logs are kept for a limited period for security purposes.

7. Security

Data is transmitted over HTTPS and stored with Google Cloud security controls. Access to Seller data is restricted by per-user rules, payment details are handled by Stripe only, and incoming payment notifications are verified with Stripe signatures before any license key is issued. No system is perfectly secure; if we learn of a breach affecting you we will tell you as the law requires.

8. Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict certain processing, and to complain to a supervisory authority. Sellers can edit most account data in the dashboard. For anything else, including deleting your account or a Buyer order record, contact us; we may need to verify your identity first. Note that we may have to keep some records for legal reasons, and that Buyer data held by a Seller is subject to that Seller’s own policy.

9. Children

The service is not directed at children under 16 and we do not knowingly collect their data. If you believe a child has provided data to us, contact us and we will delete it.

10. Changes

We may update this policy as the service evolves. The date at the top shows the latest version; for significant changes we will notify Sellers by email or in the dashboard.

11. Contact

Privacy questions or requests: use the contact page. See also our Terms of Use.