Legal

Privacy Policy

This policy explains what personal data we process when you use Concept Studio’s website, accounts, and purchases.

Last updated 4 September 2026

1. Controller

Concept Studio is the controller of personal data collected through this website. Contact: support@conceptstudio.dev.

2. Data we collect

Depending on how you use the site, we may process:

Account data — Cfx.re forum user id and username, display name, and avatar URL after you Sign in with Cfx.re.
Purchase data — package identifiers, purchase dates, and Tebex payment references we may store for support. Card details are handled by Tebex / payment providers, not stored on our servers. Keymaster remains the source of truth for grants.
Support communications — messages you send by email or Discord.
Technical / usage data — pages viewed, approximate referrer host, and aggregate event counts when you allow analytics. See our Cookie Policy.
Newsletter — email if you opt in via the promo signup (separate from Cfx sign-in).

3. Why we process data (purposes & bases)

Provide the storefront and accounts — contract / steps prior to contract.
Process and fulfil orders(via Tebex & Cfx) — contract.
Customer support and fraud prevention — legitimate interests and/or contract.
Security and essential site operation (session cookies) — legitimate interests / contract.
Optional analytics — consent (you can accept or refuse in the cookie banner).
Marketing emails — only if you opt in to the newsletter; you can withdraw anytime via the unsubscribe link in each email or by emailing us.
Legal compliance — legal obligation where applicable.

4. Who we share data with

We do not sell your personal data. We may share data with:

Tebex — checkout, payments, and related order fulfilment.
Cfx.re / Keymaster — escrow product delivery tied to your Cfx identity.
Hosting / infrastructure — e.g. our website host (such as Vercel) processing requests and logs.
Discord — if you contact us there (under Discord’s terms).
Professional advisers or authorities when required by law or to protect our rights.

5. International transfers

Our host and processors may process data in the EU/EEA, United States, or other countries. Where required, we rely on appropriate safeguards (for example Standard Contractual Clauses) provided by those processors.

6. Retention

Account data — while your account is active, then deleted or anonymised on request unless we must keep records longer.
Purchase records — as needed for support, accounting, and dispute handling.
Analytics aggregates — kept in summarised form for business insights; not used to build marketing profiles of individuals.
Support messages — for as long as useful to resolve your issue and related follow-up.

7. Your rights

If GDPR or similar law applies, you may have rights to access, rectify, erase, restrict, object, and data portability, and to withdraw consent. Contact support@conceptstudio.dev. You may also lodge a complaint with your local supervisory authority. In Hungary, that is the National Authority for Data Protection and Freedom of Information (NAIH).

8. Security

We use reasonable technical and organisational measures (including httpOnly session cookies after Cfx.re sign-in). No method of transmission or storage is perfectly secure.

9. Children

The site is not directed at children under 16. If you believe we hold a child’s data without appropriate basis, contact us to delete it.

10. Changes

We may update this policy and will change the “Last updated” date. Material changes may also be highlighted on the site where appropriate.