Privacy Policy

This policy explains, honestly and specifically, what personal data the online store available at aspishop.cc and aspishop.net collects, why, who receives it and what rights you have. Both domains are the same store and share the same data and systems. The data controller is ASPI, the operator of aspishop.cc and aspishop.net. You can contact us about anything in this policy — including requests to access or delete your data — through our official Discord server at discord.gg/aspi.

This policy is written for the General Data Protection Regulation (GDPR) and Spanish data-protection law (LOPDGDD).

We only ask for what the store actually needs:

• To place an order: first name, last name, email address and, optionally, your Discord ID (used only to deliver Discord-related perks such as the customer role).
• To create an account: email address and password. The password is stored only as a bcrypt hash — we never see or store it in clear.
• To verify your email when you register and logins from a new device: a 6-digit code we send you by email; we only store a hash of the code, which expires after 10 minutes.
• To top up store credit: the amount; the movement is recorded in your account's balance ledger.
• To leave a review: your rating and the text you write. Reviews are shown publicly with your first name only.
• If you contact support on Discord: whatever you choose to tell us there (Discord's own privacy policy also applies on their platform).

We do not ask for and do not collect postal addresses, phone numbers, national ID documents or dates of birth.

When you use the Website, our servers process certain technical data:

• IP address, country, browser/device identification (user-agent) and language — recorded with orders, account logins, reviews, balance movements and security events.
• Pages visited on our own store: we run a small self-hosted live-visitors panel that keeps IP, current page, country and referrer in server memory for a maximum of 24 hours. We also keep our own record of on-site navigation (page views, journey and errors) together with the IP address and browser identifier, retained for 30 days to detect and block fraud and automated abuse; after that they are erased and only anonymous statistics remain. None of this is ever shared and there is no third-party analytics or advertising tracker on this site.
• Security screening of your IP address: to prevent payment fraud we check IPs against IP-reputation services that tell us the approximate location, network operator and whether the address is a known VPN, proxy or TOR exit (see section 6). High-risk signals may put an order on hold for manual review.
• Technical error reports from your browser (error message, page, browser version) so we can fix bugs. They contain no account data.
• A security log of relevant events (logins, orders, payments, blocked attempts) that includes the technical data above.

We keep cookies to a minimum and we do not use any advertising or cross-site tracking cookies. What we actually set:

Consent choices are stored in the aspi_cc cookie for 12 months, and we keep a technical record of the choice as proof of consent.

Every use of your data maps to one of the GDPR legal bases:

• Processing and delivering your orders, managing your account (including verifying your email and logins from new devices) and store credit, and answering support requests — performance of a contract (art. 6.1.b GDPR).
• Keeping accounting and tax records of sales — legal obligation (art. 6.1.c).
• Preventing payment fraud and abuse: IP screening, rate limiting, security logging and blocking of addresses, email addresses and devices linked to fraud — legitimate interest (art. 6.1.f) in protecting the store and its customers from fraud; the checks are limited to what a payment actually requires.
• Defending ourselves against chargebacks and payment claims by providing the payment processor with evidence of the order and its delivery — legitimate interest (art. 6.1.f) in defending our rights.
• Operational alerts to our own staff when an order is placed or a security event happens — legitimate interest in running the store (see section 6 about where those alerts go).
• Inviting you to review your purchase through Trustpilot — legitimate interest in reputation for our existing customers (soft opt-in); every invitation includes an opt-out and we do not send any other marketing email.
• Showing anonymous notices of recent purchases in the store (product and plan, an approximate time and the country the order was placed from, as reported by its network): they are built from real orders and never include your name, email or anything else that identifies you — legitimate interest in showing real activity in the store (art. 6.1.f).
• Referral cookies — your consent (art. 6.1.a), which you can withdraw at any time.

We never sell or rent personal data. We share only what each provider needs to do its job:

• Stripe (payments): processes your card entirely on its side; we receive and store only the last 4 digits, card brand and the billing name/country Stripe reports back.
• Apple and Google (Apple Pay and Google Pay): only on your order's payment page, their components check whether you can use their wallet; if you pay with one, the wallet authorizes the payment, Stripe charges it and we receive the same as with a card (last 4 digits and card brand).
• NOWPayments (crypto payments): receives the order number and amount to generate the payment invoice.
• PayPal: when you pay by PayPal, the payment is processed through Stripe; PayPal shares your PayPal name and email with Stripe, and we receive them to match the payment to your order and store that confirmation.
• Brevo (EU email provider): sends our transactional emails (order confirmation, delivery, verification codes, password reset) and therefore processes your email address and the email content.
• Cloudflare (CDN, security, Turnstile anti-bot, media hosting): all traffic to the site passes through Cloudflare's network; it processes IP addresses and requests as our security provider.
• Trustpilot (review invitations): after a delivered order, Trustpilot receives your email address and order reference so it can send you a single review invitation with an opt-out.
• Discord: our internal staff notifications (new order, payment, security alert) are delivered into our private staff Discord channels and, depending on the event, may include only the data that event requires — such as your name, email, IP and country; if you buy through our Discord bot or provide your Discord ID, delivery messages and the customer role are also handled through Discord.
• IP-reputation services (vpnapi.io and ipwho.is): receive customer IP addresses — and nothing else — to detect VPN/proxy/TOR usage and estimate location for fraud prevention.
• Public authorities: only where the law obliges us.

Some of the providers above are US companies (Stripe, Apple, Google, Cloudflare, Discord, Trustpilot's US entities). Transfers to them rely on the EU–US Data Privacy Framework where the provider is certified, and on the European Commission's Standard Contractual Clauses otherwise. Brevo is an EU (French) provider; our own database runs on our own EU-located server.

We keep personal data only as long as its purpose requires:

• Orders, invoicing data and the store-credit ledger: at least 6 years, as Spanish commercial and tax law requires for business records.
• Customer accounts: while the account exists. You can ask us to delete your account at any time (section 10).
• Security and fraud-prevention logs (including IP-reputation results): only as long as needed to detect and prevent fraud and to handle any related investigation or dispute, and in any case no longer than 24 months, after which they are deleted or anonymized.
• Verification codes: until they are used and, at most, 10 minutes.
• Anti-fraud blocks on email addresses and devices: while the block remains active.
• Live-visitor statistics: maximum 24 hours, in server memory only. IP address and browser identifier in navigation analytics: 30 days; the rest of the session, once anonymised, up to 90 days.
• Reviews: while the review is published.
• Delivered product keys: kept encrypted with the order so we can re-show you your purchase and honor the conformity guarantee.

All traffic is encrypted with TLS. Our origin server has no publicly reachable ports — it is only accessible through an encrypted Cloudflare tunnel. Among the measures we currently apply: delivered product keys are encrypted at rest with strong authenticated encryption (AES-256-GCM), passwords are stored only as bcrypt hashes, sessions use HttpOnly cookies, access to customer data is limited to store staff, and sensitive staff actions are themselves logged. Card numbers never touch our systems. We may update these measures over time to keep protection appropriate.

Under the GDPR you can, at any time and free of charge: access the data we hold about you, correct it, ask for its deletion, restrict or object to specific uses, ask for a portable copy, and withdraw any consent you gave (for cookies, use the "Cookie settings" link in the footer).

To exercise any of these rights, open a ticket on our Discord server stating what you want; we may ask you to prove control of the order email address before acting. We answer within one month at most. Note that we must keep data covered by legal retention duties (for example invoicing records of completed orders) even if you delete your account.

If you believe we are mishandling your data, you have the right to complain to a supervisory authority — in Spain, the Agencia Española de Protección de Datos (www.aepd.es).

We do not send newsletters or advertising emails. The only post-purchase message is the Trustpilot review invitation described above, which you can opt out of directly from the invitation itself. Every transactional email we send (order confirmation, delivery, verification codes, password reset) is strictly necessary for your purchase or account.

The Website is intended for users aged 18 or over, and we do not knowingly process data of children under 14 (the age of digital consent in Spain). If we learn that a child's data has been submitted, we will delete it.

The Website links to external platforms — mainly our Discord community and the payment providers' own pages. Once you are on a third-party service, its own privacy policy applies. We recommend reading it.

When our data practices change, we update this page and its date. Significant changes will be highlighted on the Website. Earlier versions can be requested through Discord.