Legal
Privacy Policy
In short: we collect what we need to run your account, take payment, deliver your downloads and keep the marketplace safe. We do not sell your personal data and we do not run advertising trackers. Payment providers see your payment details, not us. Sellers see only what they need to support your purchase. You can ask for access, correction or deletion at any time at support@codemercio.com.
This policy explains what personal data CodeMercio collects, why, who we share it with, how long we keep it and what rights you have. It applies to visitors, Buyers and Sellers and takes effect on November 6, 2026.
Who is responsible
The controller of your personal data is CodeMercio. Postal address: [postal address: set it in Admin > Site profile]. You can reach us for anything about privacy at support@codemercio.com or through the contact form. Where the law requires us to name a data protection officer or a representative in the EU or UK, their details will be published here.
What we collect and why
| Data | Why we use it | Legal basis (GDPR Art. 6) |
|---|---|---|
| Account details: name, username, email, password hash, optional bio, avatar, sign-in method (password or Google), two-factor settings | Create and secure your account, let you sign in, show a public author profile if you are a Seller | Contract |
| Records of what you accepted: the time and version of the Terms you agreed to at sign-up, and of the checkout confirmation (including the digital-delivery and withdrawal acknowledgement) | Prove the contract and your consent to immediate delivery | Legal obligation; legitimate interests (evidence) |
| Orders and licenses: items, amounts, billing name, billing email, billing country, VAT or tax ID if you enter one, order and payment references, invoices | Take payment, deliver downloads, issue licenses, calculate tax, keep accounting records, handle refunds | Contract; legal obligation (tax and accounting) |
| Seller data: payout method and destination (PayPal email or bank details), earnings and payout history, tax information and tax forms you upload (for example W-8 or W-9), verified-author application | Pay you, meet tax and anti-fraud duties, confirm who is behind a seller profile | Contract; legal obligation; legitimate interests |
| Messages between Buyers and Sellers and attachments; questions, answers and reviews you post; messages you send us through the contact form | Provide support, resolve questions and disputes, moderate abuse | Contract; legitimate interests |
| Technical data: IP address, browser and device type, pages requested, timestamps; for orders, the IP address and browser string at checkout | Security, abuse and fraud prevention, diagnosing errors | Legitimate interests |
| Cookies and similar technologies (see the Cookie Policy) | Keep you signed in, hold your cart, remember preferences | Strictly necessary: legitimate interests; anything optional: consent |
| Aggregated product statistics: how often a listing is viewed, added to a cart or checked out, and a coarse traffic source, stored as daily totals without IP addresses or visitor profiles | Show Sellers how their listings perform and improve the catalog | Legitimate interests |
| Newsletter email address | Send the newsletter you subscribed to (double opt-in) | Consent |
| Favorites, cart, compare list, recently viewed items and recent searches | Provide the features you use (some of this lives only in your browser) | Contract; legitimate interests |
We do not sell personal data, we do not use it for advertising or profiling, and we do not make automated decisions that have legal or similarly significant effects on you. Automated checks (for example malware scanning of uploaded files, bot detection and payment fraud signals) are used to protect the Service, and you can ask a person to review any decision that affects you.
If you are required to provide data (for example billing country for tax), we cannot complete the order without it.
Who receives your data (processors and recipients)
We use carefully selected providers who process data on our instructions, and we share data with others only as described here:
- Stripe and PayPal process payments and refunds. They receive the details needed to take payment and prevent fraud and act as independent controllers for their own legal and compliance duties. Their privacy notices apply to their processing.
- Our email provider (for example Resend, or whichever mail service the operator configures) delivers transactional emails such as order confirmations, invoices, password resets and replies to the contact form.
- Google, if you choose "Sign in with Google": we receive your name, email address, profile picture and Google account identifier from Google. We do not receive your Google password.
- Cloudflare Turnstile (or a similar bot-protection service, when enabled) checks that a form is being filled in by a person. The provider receives technical signals such as your IP address and browser details.
- Hosting and infrastructure providers store the database, uploaded files, backups and logs, and may run malware scanning on uploaded files.
- Sellers receive the information needed to support your purchase and to deliver an add-on service: your name, your messages, the license and order details for their products and, where needed for support or an add-on service, your email address (never your payment details). If you buy an Installation Service you decide what access to share with them.
- Our team and moderators can see account, order and message data where needed to run the marketplace, handle support, refunds and reports, and prevent abuse. Access is limited to what the role needs.
- Authorities, courts and professional advisers, where the law requires it or to establish, exercise or defend legal claims.
- A buyer of the business, if the business is sold, under the same protections as here.
Some providers process data outside your country, including outside the EEA or UK (for example in the United States). Where that happens we rely on an adequacy decision, the EU standard contractual clauses or another lawful transfer mechanism.
How long we keep data
- Account data: while your account is open. When you delete your account, personal fields are removed or replaced with a pseudonym; records we must keep stay linked to that pseudonym.
- Orders, invoices and payment records: for as long as tax and accounting law requires, usually 6 to 10 years depending on the country.
- Seller tax forms and payout records: as long as required for tax and accounting and for the time a payout can still be disputed; payout destinations are cleared once a payout is final.
- Consent and acceptance records: as long as the related account or order exists, so that we can show what you agreed to.
- Contact form messages and support correspondence: only as long as needed to answer you and handle follow-ups, normally no more than 24 months after the conversation ends.
- Newsletter address: until you unsubscribe, after which only a suppression record is kept so we do not mail you again.
- Server logs and security data: a short period needed for security and debugging, normally no more than 90 days, longer if needed to investigate an incident.
- Reviews and public posts: may remain under your display name (or a pseudonym) after account deletion because they inform other buyers; you can ask us to remove them.
Your rights
Under the GDPR, the UK GDPR and similar laws you can ask us to give you access to your data, correct it, delete it, restrict or object to processing, and receive a portable copy. Where processing is based on consent you can withdraw it at any time. You can object at any time to processing based on our legitimate interests. California and some other US states give residents similar rights; we honour them in the same way and do not "sell" or "share" personal data for advertising as those laws define it.
To exercise a right, write to support@codemercio.com. We may need to confirm it is really you. We will answer within one month (the law lets us extend this for complex requests, and we will tell you). You can also complain to your local data protection authority, for example the one in the country where you live or work.
Security
We protect data with encryption in transit, hashed passwords, access controls, optional two-factor authentication for accounts, private storage for product files and monitoring. No system is perfectly secure. If a breach affects you we will tell you and the authorities as the law requires.
Children
The Service is not directed at children under 16 and we do not knowingly collect their data. If you believe a child has given us personal data, write to support@codemercio.com and we will delete it.
Links to other sites
Seller demos, documentation and payment pages are run by others. Their privacy practices are theirs.
Changes
We will update this policy when our practices change. The "last updated" date above shows the current version, and we will tell you about material changes on the site or by email.