Privacy Policy

This policy explains what VYRO Studio (“the studio”, “we”, “us”) does with personal data when you browse this site, buy a product, run a licensed resource, or open a support ticket. It covers the website, the customer dashboard and the licensing API that our resources talk to.

We collect the minimum a licensing platform needs to work, and we do not sell personal data or use it for advertising. The legal entity responsible for this data is [registered studio entity to be completed], reachable at support@vyro.studio.

• Discord account data — your Discord user id, username and avatar URL, received when you sign in with Discord. The id is your account identity across the platform; the username and avatar exist so support and the dashboard can show who you are. We do not read your messages, servers or friends.
• Email address — used to send order confirmations, licence details, security notices and replies to your tickets. If you sign in with email rather than Discord, it is also your login identifier and we store a hash of your password, never the password itself.
• Order records — what you bought, the amount, the currency, the coupon applied, the payment method type and the provider’s reference. These are your proof of purchase, the basis of your entitlements, and the records we are required to keep for accounting.
• Server address and installation identity — the IP address a licensed resource runs on, and the installation identity it mints on first start. Together they are how a licence is bound to one authorised server. Without them there is no way to tell a customer from a copy.
• Verification and download logs — the time, outcome and origin address of each licence check, IP change, installation reset and download. They exist so you can audit your own licences, and so we can investigate leaks, abuse and support problems.
• Support tickets and contact messages — what you write to us, plus whatever you attach. Kept so a conversation has a history and a later ticket does not start from nothing.
• Technical request data — the IP address, user agent and timestamps attached to requests to this site and the API, held briefly for rate limiting, fraud prevention and diagnosing errors.

We want to be explicit about this rather than bury it. When a licensed resource verifies itself, we record the IP address it is running on and compare it with the address the licence is authorised for. That address is treated as a licensing signal: it is used to decide whether a resource may start, to detect one licence being used on several servers, and to show you the change history of your own installations.

It is not used to profile you, build an audience, or track individuals. It is not shared with other customers, and it is not combined with player data — we never receive any. A server address is normally the address of a hosted machine rather than a home connection, but where it can identify a person it is treated as personal data under this policy.

Most of what we hold is processed to perform the contract you entered into when you bought a licence: delivering downloads, verifying licences and providing support. Verification logs, rate-limit records and anti-leak checks rest on our legitimate interest in protecting the studio’s software from redistribution, balanced against your interests. Order and tax records are kept because the law requires it. Where we ask for consent — for example, product announcement emails — you can withdraw it at any time.

• Account and profile data — for as long as your account exists, and deleted within 30 days of a deletion request except where an order record must be kept.
• Order and invoice records — retained for the period required by tax and accounting law in the studio’s jurisdiction, typically between five and ten years.
• Licences, servers and installation identities — for the life of the licence, plus 12 months so a revoked or refunded licence cannot be quietly re-registered.
• Verification, IP change and download logs — 24 months, then deleted or aggregated into counts that no longer identify anyone.
• Support tickets and contact messages — 24 months after the conversation is closed.
• Rate limiting and error diagnostics — days, not months.

We keep the list of third parties short, and each one only receives what it needs to do its job:

• Discord — identity provider for sign-in and the venue for our community support. What you share with Discord is governed by their own privacy policy.
• Our payment provider — processes the payment and holds the card details we deliberately never touch. We receive only the amount, the outcome, the method type and a reference.
• Hosting and database infrastructure — runs the site, the API and the database that stores everything described above.
• Transactional email — delivers order confirmations, licence details and security notices.

We do not sell personal data, and we do not share it with advertisers or data brokers. We will disclose data where the law compels it, and we will tell you when we are permitted to.

We set one essential cookie: your signed session, which keeps you logged in and is required for the dashboard to work. Your cart lives in your browser’s local storage and never leaves it until you check out — the server recalculates every price from its own catalogue rather than trusting what the browser sends.

There are no advertising cookies, no third-party trackers and no cross-site analytics on this site.

Depending on where you live you may have the right to access the data we hold about you, to have inaccurate data corrected, to have data deleted, to receive a copy in a portable format, to object to or restrict certain processing, and to withdraw consent where processing rests on it.

Much of this is self-service: your dashboard shows your profile, orders, entitlements, licences, servers and the verification history behind them, and you can unlink Discord or sign out everywhere from your account settings. For anything else, write to support@vyro.studio and we will respond within 30 days. If we get it wrong, you can complain to your local data protection authority.

Deleting your account revokes your licences. Entitlements cannot be restored afterwards, so export anything you need first.

Sessions are signed and short-lived, passwords are hashed, download links are signed and expire, and privileged actions are written to an audit trail that records who did what and from where. Access to production data is limited to the people who need it to run the studio.

Our infrastructure and our processors may store or process data outside your country. Where that happens we rely on the transfer mechanisms available to us, such as standard contractual clauses. No system is perfectly secure; if a breach affects you we will tell you and the relevant authority as the law requires.

Our products and this store are not directed at children, and accounts require you to meet the minimum age of the platforms we rely on. If you believe a child has given us personal data, tell us and we will remove it.

When this policy changes, the date at the top of the page changes with it. Material changes are announced in our Discord and by email before they take effect. Questions go to support@vyro.studio.