Privacy Policy

1. Who we are

This Privacy Policy explains how Wyvern ("we", "our", "us") handles personal data when you buy from the Wyvern store (wyvern.software/store) and use Wyvern software and our order pages. Wyvern is the data controller. Wyvern (sole proprietorship / eenmanszaak), Keurenplein 41 Box C6494, 1069CD Amsterdam, Netherlands. KVK: 98080490. VAT: NL005308257B06. Privacy contact: [email protected]. Support: [email protected]. Phone: +31 6 45715726. We are not required to appoint a Data Protection Officer (GDPR Article 37). Our store website is operated for us by a partner company, which processes your data only on our behalf and on our instructions.

2. Data we collect

• Order data: your email address, billing country, the products you bought, prices, VAT and payment status.
• Checkout country: the country your connection came from at checkout, as determined by our network provider (Cloudflare). We use it as evidence of your country for EU VAT.
• Payment data: payments are processed by Stripe (cards and other methods) or NOWPayments (cryptocurrency). We never receive your full card number. From Stripe we receive limited details such as the card brand, the last 4 digits, the card country and a card fingerprint that recognises the same card again.
• Consent records: the time you accepted our terms, asked for immediate delivery and acknowledged the information about your right of withdrawal and about third-party games, with the IP address and browser (user agent) at that moment, and the version of the terms you accepted.
• Delivery and access records: whether our emails to you were delivered or bounced, and when your order page or key was opened or activated, with the time, IP address and browser.
• Login records: when you sign in to view your orders with a one-time email code, with the time, IP address and browser.
• Web server logs: for every request to our servers, the IP address, time, requested address, result and browser.
• Messages you send to our support.

3. Why we use your data and on what legal basis

• To perform our contract with you (GDPR Art. 6(1)(b)): taking and delivering your order, giving you access to your keys and order pages, and support.
• To meet legal obligations (Art. 6(1)(c)): accounting and tax records, including proving your country for EU VAT.
• For our legitimate interests (Art. 6(1)(f)): preventing fraud and abuse, keeping our services secure, and establishing, exercising or defending legal claims, including payment disputes and chargebacks. We have weighed these interests against your privacy and limit the data and retention periods to what these purposes need.

4. Fraud prevention and payment disputes

Payments are screened automatically for fraud by Stripe. If an order is blocked and you think this is wrong, email [email protected] and a person will review it. If you dispute a payment or file a chargeback, we send Stripe, the card network and your bank the records of the disputed order (order details, email address, IP address, consent, delivery, access and activation records). For Visa disputes we may also send the same kind of records for up to two earlier orders paid with the same card that were not disputed. We do this to defend the claim (Art. 6(1)(f)).

5. Your right to object

You can object at any time, on grounds relating to your particular situation, to processing that is based on our legitimate interests (section 3). We will then stop, unless we have compelling legitimate grounds that override your interests, or we need the data to establish, exercise or defend legal claims. To object, email [email protected].

6. Emails

We send order confirmations, license-key emails, one-time sign-in codes and support replies through our email provider Resend. Our emails contain no tracking pixels and no tracked links. We only receive a notice from Resend that an email was delivered or bounced.

7. Cookies

We use only strictly necessary cookies, so no consent is required (Dutch Telecommunications Act, Art. 11.7a). The customer session cookie (__Host-wyvern-customer-session) keeps you signed in to your orders after you enter a one-time email code; it expires after 8 hours. Cloudflare may set security cookies to protect our sites against bots and attacks. We use no advertising, analytics or tracking cookies.

8. Who receives your data

We do not sell or rent your personal data. We share it only with these recipients, for the purposes described:

• Our website operator: the partner company that runs the Wyvern store website for us, as our processor.
• Stripe: card and other payments, fraud screening and payment disputes.
• NOWPayments: cryptocurrency payments. We send NOWPayments only the order amount and an order reference; you provide your payment details to NOWPayments directly.
• Card networks and your bank: only when a payment is disputed (section 4).
• Resend: sending our emails.
• Cloudflare: network, security (bot protection) and storage of our encrypted backups.
• OVHcloud: hosting of our servers and database.
• Authorities: when we are legally required to share data, for example with the tax authorities.

9. International transfers

Our servers and database are hosted by OVHcloud in Canada. Canada is recognised by the European Commission as providing adequate protection for personal data handled by commercial organisations (Commission Decision 2002/2/EC). Stripe and Cloudflare are certified under the EU-US Data Privacy Framework (Commission adequacy decision of 10 July 2023). For Resend we rely on the EU-US Data Privacy Framework and, as a safeguard, on the European Commission's Standard Contractual Clauses. Our backups are encrypted before they leave our server, so Cloudflare cannot read them.

10. How long we keep your data

• Orders, invoices, payment and VAT records, including your billing country and checkout country: 10 years for sales under the EU VAT One-Stop-Shop scheme, otherwise 7 years (Dutch tax law, Art. 52 AWR and Art. 2:10 BW).
• IP addresses and browser data stored with an order, including those recorded with your consent: 18 months after the order, unless a dispute or legal claim about the order is still open; then until it is closed.
• Order-page access logs, login logs and referral-click logs: 180 days.
• Web server logs: 14 days.
• Encrypted backups: up to 6 months.
• One-time sign-in codes: until used or expired.
• When a period ends, the data is deleted or anonymised.

11. Security

All connections to our services are encrypted (TLS). Payments are handled by PCI-compliant payment providers. Access to personal data is limited to the people who need it, and backups are encrypted. No system is completely secure, but we work to protect your data and to fix problems quickly.

12. Your rights

Under the GDPR you have the right to access your personal data (Art. 15), to have it corrected (Art. 16) or erased (Art. 17, unless we must keep it by law or need it for legal claims), to restrict processing (Art. 18), to receive it in a portable format (Art. 20), and to object (Art. 21, see section 5). To use these rights, email [email protected] with "GDPR Request" in the subject. We reply within one month and may ask you to confirm your identity. You can also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl) or the authority in your own country.

13. Children

Our services are not intended for people under 18. We do not knowingly collect data from children. If you believe a child has given us personal data, contact us and we will delete it.

14. Changes

We may update this policy. The current version is always on this page with its date. If a change materially affects how we use your data, we will also tell you by email or on our website.