Privacy Policy

This policy applies to license holders (clients who purchased access to our templates or hosted platform) and visitors to our public website. It does not govern purchases made by end players on individual Tebex stores operated by our clients; those transactions are handled by Tebex and each store owner under their own policies.

We may collect the following categories of information:

• Account data: email address, login credentials (managed via Supabase Auth), and account identifiers assigned when your license is created.
• License and billing references: transaction IDs, marketplace usernames (e.g. BuiltByBit), Discord ID or username, and license status — used to verify your purchase and activate access.
• Store configuration: Tebex public tokens, encrypted Tebex private keys and plugin secrets, storefront settings (appearance, widgets, sidebar modules, product tabs, rank upgrades, and similar dashboard data you submit).
• Technical and usage data: IP address, browser type, device information, request logs, error reports, and cookies required for authentication, security, and cart/session functionality.
• Support communications: messages you send us via Discord or other support channels.

We use collected information to:

• Provide, operate, and maintain the Platform and your licensed storefront.
• Authenticate you and enforce license access controls.
• Connect to Tebex on your behalf (server-side only) to load products, baskets, and checkout flows.
• Secure the Platform, prevent abuse, and investigate incidents.
• Improve features, fix bugs, and provide customer support.
• Comply with legal obligations and enforce our Terms of Service.

Tebex private keys and plugin secrets are encrypted at rest using AES-256-GCM. Database access is protected by Row-Level Security (RLS) so each client can only access their own records. Session and basket cookies use HttpOnly flags and are marked Secure in production. Tebex private keys are never sent to the browser.

We use trusted subprocessors to run the Platform. These may process data on our behalf:

• Supabase — authentication and database hosting.
• Tebex — store catalog, baskets, player authentication, and payment processing for storefronts.
• Upstash — rate limiting for API endpoints.
• Sentry — error monitoring (may include technical context; we configure redaction for sensitive values).
• Cloudflare — CDN, DDoS protection, and HTTPS termination.

Each subprocessor operates under its own privacy terms. End-player payment data is collected and processed directly by Tebex when a purchase is made on a storefront.

The Platform uses cookies and similar technologies for:

• Keeping you signed in to the client dashboard.
• Maintaining Tebex basket and storefront session state.
• Security features such as rate limiting and CSRF protection where applicable.

You can control cookies through your browser settings, but disabling essential cookies may prevent login or checkout from working correctly.

We retain account and configuration data for as long as your license is active and as needed to provide the Platform. After license termination or account closure, we may retain certain records for a limited period for fraud prevention, dispute resolution, backups, and legal compliance, then delete or anonymize them where no longer required.

Depending on your location, you may have rights to access, correct, delete, or restrict processing of your personal data, or to object to certain processing. To exercise these rights, contact us through Discord. We may need to verify your identity before fulfilling a request.

The Platform is not directed at children under 13 (or the minimum age required in your jurisdiction). We do not knowingly collect personal information from children. If you believe a child has provided us data, contact us and we will take appropriate steps to remove it.

Your data may be processed in countries other than your own, including where our hosting and subprocessors operate. We take reasonable steps to ensure appropriate safeguards are in place when data is transferred internationally.

We may update this Privacy Policy from time to time. The "Last updated" date at the top will reflect the latest version. Continued use of the Platform after changes constitutes acceptance of the updated policy.

For privacy-related questions or requests, contact Atzl Project via Discord or our documentation contact page.

This document is provided for informational purposes and does not constitute legal advice. Consult a qualified attorney if you need jurisdiction-specific compliance guidance.