Privacy Policy

Last updated: 18 June 2026. This policy explains what personal data Ecstacy Studio ("we", "the Studio") processes about you, on what legal basis, for how long, and the rights you have under the EU General Data Protection Regulation (GDPR). We follow a data-minimisation approach and only process what is required to operate the storefront and deliver commissioned work.

1. Who Processes Your Data

Ecstacy Studio is operated by Simone B. (the "Operator"), contactable at support@ecstacy.ac. For all data described below we act as the Data Controller.

2. What We Collect

• Account & login: when you sign in we receive, via your chosen OAuth provider (Discord, GitHub or Google), your user ID, username/display name and email address. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).
• Commission requests: the project details and contact information you submit through the commission form. Legal basis: steps taken at your request prior to entering a contract (Art. 6(1)(b) GDPR).
• Orders & licences: the products you buy, order status, licence keys and download history. Legal basis: performance of the contract.
• Billing: payment status, amounts and transaction identifiers. Card and bank details are never seen or stored by us — they are handled solely by our payment provider (see section 4). Transaction records are retained for 10 years as required by Italian tax law (art. 2220 Civil Code). Legal basis: legal obligation (Art. 6(1)(c) GDPR).

3. Cookies

We use strictly necessary cookies only: a session cookie to keep you logged in, an anti-forgery (CSRF) token to protect form submissions, and security cookies set by Cloudflare (DDoS and bot mitigation). These do not require consent and we therefore do not show a cookie banner. We do not use analytics, advertising or cross-site tracking cookies. The commission and login forms load Cloudflare Turnstile, a privacy-preserving anti-bot challenge that does not track you across sites.

4. Third Parties & Payments

Payments are processed by Stripe, which handles your card or bank details and the applicable tax, and is an independent data controller for that transaction — we never store or have access to your full card number or bank details. We also rely on Cloudflare (CDN, DDoS protection and bot mitigation) and our EU-based hosting provider. We do not sell, rent or trade your personal data.

5. Retention

Account and order data are kept for as long as you have an account with us; billing records are kept for the legally required 10 years. Commission requests that do not lead to a contract are deleted once they are no longer needed to answer your enquiry.

6. Your Rights (GDPR)

You have the right to access, rectify, erase, restrict or port your personal data, and to object to processing. To exercise any right, contact us at support@ecstacy.ac or via a ticket on our Discord. Deleting your account will terminate any active licences. You may also lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali).