HTZen

Privacy Policy

1. Scope and data controller

Last updated: October 2026

This Privacy Policy explains how HTZen ("we", "us", "our") collects, uses, shares, and protects personal data when you browse our catalog, create an account, purchase digital assets, download releases, or contact support.

For paid transactions, Dodo Payments (dodopayments.com) acts as our authorized Merchant of Record and acts as an independent data controller for payment processing, tax compliance, billing verification, and anti-fraud screening.

2. Personal data we collect

We follow a strict data-minimization principle and collect only what is needed to operate the store safely:

  • Account and identity data: Email address, display preferences, locale, email verification status, account role, and encrypted authentication credentials. Staff accounts using multi-factor authentication store encrypted MFA secrets.
  • Transaction and entitlement data: Purchased offer and license identifiers, order totals, currency, promotional discount codes, Dodo Payments checkout/payment reference IDs (cks_..., pay_...), refund status, and digital library download entitlements. We never collect, process, or store your full credit card number, CVV, or bank account credentials on our servers—all payment instrument entry happens directly on Dodo Payments' PCI-DSS compliant checkout.
  • Support and community submissions: Support ticket messages, attachments, bug reports, product reviews, and community comments you choose to submit. Public reviews and comments are visible to other visitors; support tickets are private to you and authorized staff.
  • Technical and security telemetry: IP address, browser user-agent, session identifiers, rate-limit counters, audit logs of administrative actions, and download grant verification records used to prevent credential sharing and abuse.

3. How and why we process your data (Legal bases)

Depending on your jurisdiction (including the EEA/UK GDPR and applicable international privacy laws), we process personal data on the following legal bases:

  1. Performance of a contract: To create your account, generate checkout sessions, verify completed orders, issue software licenses, deliver files inside My library, and provide technical support.
  2. Legal and tax compliance: To retain transaction references, license audit trails, and accounting records required by tax and commercial regulations alongside our Merchant of Record.
  3. Legitimate interests: To secure accounts, detect automated abuse or unauthorized redistribution, maintain service reliability, and improve store usability.
  4. Consent: For optional product update notifications, which you can withdraw at any time in Account settings. Purchasing a product never auto-enrolls you in third-party marketing lists.

4. Infrastructure providers and third-party processors

We share necessary operational data only with trusted infrastructure providers bound by confidentiality and data-protection commitments:

  • Dodo Payments (Merchant of Record & Payment Processor): Receives checkout metadata, customer email, billing country/tax inputs, and payment details to process orders, calculate global taxes, prevent fraud, and issue receipts.
  • Cloudflare: Provides global edge hosting, Web Application Firewall (WAF), DDoS mitigation, and application runtime infrastructure.
  • Supabase: Provides managed PostgreSQL database storage with encryption at rest and in transit.
  • Resend: Delivers essential transactional emails such as account verification codes and support notifications.
  • Google Drive (External Archive Delivery): When a product release archive is hosted on Google Drive, opening the download link from My library connects your browser directly to Google under Google's privacy policy.

We never sell, rent, or trade your personal data or email address to data brokers or advertisers.

5. Cookies and tracking controls

  • Strictly necessary cookies: We use secure, HttpOnly first-party cookies for authenticated sessions, CSRF protection, locale preferences, and checkout continuity.
  • No third-party ad trackers: We do not run invasive cross-site behavioural advertising pixels.

6. Data retention and security

  • Security measures: We protect data using TLS encryption in transit, AES-256-GCM encryption for sensitive operational secrets, role-based access control (RBAC), cryptographic webhook signature verification, and strict rate limiting.
  • Retention schedule: Active account and library entitlement records are kept while your account remains open so you can re-download purchased assets. Order, license, and tax audit records are retained for the statutory accounting period (typically 7 to 10 years depending on jurisdiction). Security and rate-limit logs are rotated periodically.

7. Your privacy rights (GDPR, CCPA, and global rights)

Regardless of location, you may exercise the following rights:

  • Access and portability: Request a structured export of your account and order data directly in Account settings.
  • Correction and deletion: Update your profile settings or submit a privacy deletion request. Please note that while we can anonymize or close your account profile upon verified request, statutory tax, anti-fraud, and completed transaction records must be retained where required by law.
  • Objection and restriction: Withdraw optional notification consent at any time.
  • Non-discrimination & supervisory complaints: We will never discriminate against you for exercising your privacy rights, and EEA/UK/international residents have the right to lodge a complaint with their local data protection authority.

For any privacy inquiry, submit a request through Account settings, Support, or Contact.

Contact support