Privacy Policy | NextByte Commerce

This policy describes how NextByte AB ("we", "us", "our") collects and uses information when you buy or use a license through NextByte Commerce (nextbytecommerce.com). We're a Swedish company based in Norrköping, and this policy is written to comply with the EU General Data Protection Regulation (GDPR).

Who we are

NextByte AB, Norrköping, Sweden. For anything privacy-related, contact us.

What we collect

Account data: your name, email address, and a hashed (never plain-text) password.
Purchase & license data: which modules you've licensed, the term you bought, and your license key.
Payment data: we never see or store your card details. Payments are processed entirely by Stripe, our payment processor; we only receive confirmation that a payment succeeded and the email address Stripe collected.
Reviews & bug reports: anything you submit through those forms, tied to your account.
Cookies: a session cookie (keeps you logged in and your cart intact) and a CSRF token (blocks a class of attack on forms) always run and are strictly functional. If you accept the cookie banner, we also use analytics and ad-measurement cookies to improve your experience and see how our ads are performing; the store works the same either way, and you can decline this without losing any functionality.
Visit data (our own): for every page load, we log the page, what referred you here, your IP address, and an approximate location (country/region) looked up from it, the same way most web servers log requests. This isn't a cookie and doesn't depend on the cookie banner. If you're signed in, it's linked to your account so we can see the path that led to a purchase; it stays on our own server and is never sent to any third party.

Why we process it (legal basis)

Contract: creating your account, issuing your license, and providing support and updates for the term you bought.
Legitimate interest: preventing fraud, moderating reviews before they're published, keeping the store secure, and understanding how the site is used (see visit data, above).
Legal obligation: Swedish bookkeeping law requires us to retain accounting records (which include purchase records) for 7 years.
Consent: analytics and ad-measurement cookies only run if you accept the cookie banner; you can decline them and the store still works normally.

Who we share it with

Only the processors we need to run the store: Stripe (payments), an analytics provider (site analytics, only if you accept the cookie banner), an advertising provider (measures whether our ads led to a purchase, only if you accept the cookie banner, and only ever the order value and currency, never your name, email, or what you bought), and our email provider (sending your license key and account emails). We don't sell or rent your data to anyone.

How long we keep it

Account and license data for as long as your account exists, plus the 7-year retention Swedish accounting law requires for purchase records. You can ask us to delete your account at any time (see your rights, below), and we'll remove what we're not legally required to keep. Visit data (see above) linked to your account is deleted along with it; visit data from before you had an account, or that never became one, isn't on its own enough to identify you and is kept for internal reporting only.

Your rights

Under GDPR, you can ask us to:

Give you a copy of the data we hold about you (access)
Correct anything that's wrong (rectification)
Delete your account and data, subject to our legal retention obligations (erasure)
Export your data in a portable format (portability)
Object to how we're processing it (objection)

Changes to this policy

If we make a material change, we'll update the date at the top of this page. Continued use of the store after a change means you accept the updated policy.