LegalPrivacy policy

Sigrix Marketplace Privacy Policy

Read the Sigrix privacy policy for marketplace users.

Last updated

  1. Introduction

    This Privacy Policy explains how Sigrix (“we,” “us,” or “our”) collects, uses, and protects personal information when you access or use the Sigrix marketplace (the “Marketplace”).

  2. Scope

    This Privacy Policy applies to all visitors, users, and creators who access the Marketplace or interact with our services, including through web or mobile browsers.

  3. Data We Collect

    We collect the following categories of personal information:

    • Account data (name, email address, username, and profile information)
    • Transaction data (purchase history, order details, and payment status)
    • Stripe Connect onboarding and payout data for creators/sellers (legal name, address, date of birth where required, bank details/IBAN, tax information, verification documents, and verification status)
    • Payment method data and transaction/payment identifiers, where applicable to payment and payout processing
    • Technical data (IP address, device type, browser type and language, and usage measurements)
    • Communication data (support inquiries, feedback, and marketplace messages)

  4. How We Use Your Data

    We use personal data to:

    • Provide, operate, and improve the Marketplace
    • Process transactions and deliver digital products
    • Communicate with you about your account, purchases, and support requests
    • Detect, prevent, and investigate fraud or misuse

  5. We process personal data under the following legal bases:

    • Performance of a contract (to provide Marketplace services and deliver purchased products)
    • Legitimate interests (to operate, secure, and improve the Marketplace)
    • Compliance with legal obligations (tax, accounting, and regulatory requirements)
    • Consent (for optional marketing communications where required)

  6. Sharing of Information

    We share personal data only as necessary with trusted service providers acting as processors on our behalf, and when required by law. The categories of providers and the providers we currently use are:

    • Cloud hosting, infrastructure, and storage: Microsoft Azure (Microsoft Corporation) — application hosting (Azure App Service) and data storage (Azure Table Storage and Azure Blob Storage).
    • Transactional email delivery: Azure Communication Services (Microsoft Corporation) — sign-in links, purchase confirmations, and service notifications.
    • Error monitoring: Sentry (Functional Software, Inc.) — application error reports, which may include technical request metadata.
    • Sign-in providers: Google and GitHub, when you choose to sign in with those accounts — they share your account email and basic profile with us as part of authentication.

    We use Stripe to process payments and payouts. Stripe processes personal data for payment/payout processing, fraud prevention, and legal/compliance obligations. For step-by-step privacy and deletion instructions, see our Stripe data deletion guide. For more information, please review Stripe's privacy policy: https://stripe.com/privacy.

  7. Cookies and Tracking

    We use a small number of strictly necessary cookies to operate the Marketplace: to keep you signed in, to protect forms against cross-site request forgery, and to remember your cart and whether you chose the light or dark theme. These are set without consent because the Marketplace cannot function without them. We set no other cookies and use no third-party analytics, which is why the Marketplace shows no cookie banner: there is no choice to ask you for.

    We measure how the Marketplace is used from our own servers: which listings are viewed, added to a cart and purchased; for signed-in accounts, the time of your most recent visit; a daily count of how many distinct browsers loaded a page, so that we can count how many people are actually using the Marketplace; and a daily count of sign-ins. That daily visitor count is taken without storing anything on your device: your IP address and browser type are combined into a short code using a secret key that is different every day and is destroyed together with that day's records, so the code cannot be traced back to you or matched against any other day, and the IP address itself is never stored. Beside that code we keep three short values, none of which identifies you: whether the browser is on a phone or a computer, the language it asks for without any region, and the country the address is registered to in the public records of the internet address registries, looked up on our own servers, so that we can see how many visitors use a phone, which languages to support and which countries visitors come from. Each sign-in is counted as a day, the sign-in method (Google, GitHub or an emailed link), the kind of device and the hour, and never which account signed in. Those daily records are kept for 90 days and then deleted. The searches you run are kept too, as the search text and how many results it found, for 92 days; for signed-in accounts a search is linked to your account for that time, so that we can see what people look for and do not find. This measurement sets no cookies of its own; for signed-in accounts it reads the sign-in cookie your browser already sent. We rely on our legitimate interest in operating and improving the Marketplace. Deleting your account erases the record of your most recent visit; your searches are not erased early but expire on their own within 92 days.

  8. Data Retention

    We retain personal data only for as long as necessary to fulfill the purposes described in this policy and to meet our legal, accounting, and regulatory obligations.

    Transaction and financial records are retained for 7 years in accordance with Polish accounting and tax law. Security logs and support messages are retained for up to 2 years. Other operational data is retained only as long as necessary for the purpose it was collected.

    If you delete your account before the 7-year accounting period ends, we keep the transaction record itself but remove you from it: your name and email address are deleted, and your account reference is either replaced with a random identifier or removed from the record entirely. We keep no means of linking that identifier back to you, so the remaining record is anonymous.

    Stripe Connect and payment data is retained by Stripe under their own legal obligations, which may include longer periods required by financial regulation and anti-money laundering law. For details see stripe.com/privacy.

    Where retention is required by law or to resolve an active dispute, we may retain data beyond these periods. Once the obligation is resolved, data is deleted or anonymized promptly.

  9. Security

    We implement reasonable technical and organizational safeguards to protect personal data against unauthorized access, alteration, disclosure, or destruction.

  10. Your Rights

    Depending on your location, you may have rights to access, correct, delete, or restrict the processing of your personal data, and to object to certain processing activities. For requests that involve Stripe payment or Stripe Connect data, follow our Stripe data deletion guide.

  11. How to Request Deletion of Personal Data Processed by Stripe

    Personal data in the Marketplace may be processed by different parties:

    • Data controlled by Sigrix: account, profile, and support data we hold in Marketplace systems.
    • Data controlled by Stripe: payment method details, transaction/payment identifiers, and Stripe Connect onboarding/KYC data.

    To submit a deletion or privacy rights request, please follow the channel that matches the data type:

    To help verify your request faster, include your account email address, approximate transaction dates and amounts, your order reference number from your purchase confirmation email, and for creators and sellers your Stripe account ID if available.

    We and Stripe may retain certain records where required for legal, tax, anti-money laundering (AML), fraud prevention, or dispute-resolution obligations, even after a deletion request.

    For more information, see Stripe's Privacy Policy: https://stripe.com/privacy.

  12. International Transfers

    If you access the Marketplace from outside the country where our servers are located, your data may be transferred internationally, and we will take steps to ensure adequate protections are in place.

  13. Contact Us

    If you have questions about this Privacy Policy or our data practices, please contact us at privacy@sigrix.io.