Privacy draft

Describe which technical data is collected before payment and what the public purchase page does.

• Request logs, IP address, timestamp, user agent, locale, and security-related technical data.
• Product, price, tax configuration, and redirect information needed to create the checkout session.
• No account is created in this scenario, but the purchase still produces personal data and transaction references.

Document Stripe or another provider as a recipient or processor/controller according to the exact service setup.

• Explain which payment, billing, and fraud-prevention data is sent to the provider.
• Link the provider privacy notice and data processing terms you actually use.
• State whether billing country, VAT data, invoices, and refund handling are done through the provider.

Even without a login, later service systems will usually process identifiers and technical telemetry.

• Licensing or activation service: license ID, entitlement scope, activation count, installation or device fingerprint if used.
• Update delivery: entitled product, version, channel, checksum requests, and download history.
• Desktop app: public key and pseudonymous support identifier are acceptable; secret keys must never ship in the binary.

• Separate tax and accounting retention from purely technical delivery logs.
• State how customers can request information, correction, deletion, or restriction.
• Add a section for international transfers if the payment or infrastructure provider processes outside the EU/EEA.