Last updated: July 2026
This Privacy Policy explains how Palace97 (“we”, “us”) collects, uses, and protects your personal data when you use Palace97 (the “Store”).
The Store is operated by Palace97. For privacy questions, contact support@palace97.com.
| Data | When collected | Purpose |
|---|---|---|
| Email address | When you make a purchase or request an order lookup | Order delivery, order retrieval, customer support |
| Payment metadata | When you make a purchase (processed by Stripe/Oxapay) | Order fulfillment, fraud prevention |
| Order data | When you make a purchase | Order history, delivery, customer service |
| Technical data | Automatically when you visit (IP address, browser type) | Security, fraud prevention, site operation |
What we DO NOT collect:
We process your personal data under the following legal bases:
| Data | Legal basis | Explanation |
|---|---|---|
| Email + order data | Contract | Necessary to fulfill your purchase and deliver the product |
| Email for order lookup | Contract | Necessary to provide the order retrieval service you requested |
| Technical data (IP) | Legitimate interests | Security and fraud prevention |
| Customer statistics (aggregate) | Legitimate interests | Business analytics, no individual identification |
We do NOT process your data for marketing purposes without separate consent. Receipt emails are transactional (part of contract fulfillment), not marketing.
| Data | Retention period | Why |
|---|---|---|
| Order records + buyer email | 7 years | Tax record retention (varies by jurisdiction) |
| Customer records (aggregate stats) | Indefinite (email is the key) | Order history, customer support |
| Order lookup tokens | 1 hour | Security — tokens are single-use, short-lived |
| Webhook event logs | 90 days | Dispute resolution, debugging |
| Technical logs (IP, errors) | 30 days | Security, debugging |
After the retention period, data is deleted or anonymized. Order records may be retained longer if required by law (e.g., tax audits).
| Recipient | What they receive | Why |
|---|---|---|
| Stripe | Email, payment amount, product description | Card payment processing |
| Oxapay | Email, payment amount | Crypto payment processing |
| Resend | Email address, email content (receipt) | Email delivery |
| Neon | All stored data (encrypted at rest) | Database hosting |
| Cloudflare R2 | Product files (not personal data) | File storage |
| Vercel | IP address, request data | Web hosting |
We do NOT sell your data. We do NOT share your data with advertisers. We do NOT use your data for marketing unless you separately opt in.
If you are in the EU/UK or California, you have the following rights regarding your personal data:
| Right | What it means | How to exercise |
|---|---|---|
| Access | Request a copy of your data | Email support@palace97.com with "Data Access Request" |
| Rectification | Correct inaccurate data | Email support@palace97.com with the correction |
| Erasure | Request deletion of your data | Email support@palace97.com with "Deletion Request" |
| Restriction | Limit processing of your data | Email support@palace97.com |
| Portability | Receive your data in a machine-readable format | Email support@palace97.com with "Data Portability Request" |
| Object | Object to processing based on legitimate interests | Email support@palace97.com |
We respond to all requests within 30 days (GDPR deadline). For CCPA, we respond within 45 days.
Exceptions: We may retain order data even after a deletion request if required by tax law or to resolve disputes. In such cases, we will restrict the data to only what is legally required.
Your data may be processed in the following countries:
If you are in the EU/UK, your data is transferred to the US under the EU-US Data Privacy Framework (for participating companies) or Standard Contractual Clauses. Vercel, Stripe, and Cloudflare are DPF participants.
The Store uses minimal cookies:
Buyers can browse and purchase without any cookies being set on their device. The Store does not use Google Analytics, Facebook Pixel, or any third-party tracking.
The Store is not directed to children under 13 (or 16 in the EU). We do not knowingly collect data from children. If you believe a child has provided us data, contact support@palace97.com and we will delete it.
We may update this Privacy Policy. Changes take effect when posted. The “Last updated” date will change. Material changes will be noted at the top of the page.
Privacy questions? Contact support@palace97.com.
For GDPR complaints, you can also contact your local Data Protection Authority. EU residents: find your DPA at edpb.europa.eu.