Privacy Policy
At CourseForge Studio and App Steals, privacy is fundamental to our software engineering ethos. This Privacy Policy details our data collection, processing, and protection protocols, fully adhering to international standards including the European Union General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).
1. Data Controller Identification
The Data Controller responsible for the processing of your personal information across CourseForge Studio and App Steals is:
Data Controller: Duy Vo
Official Privacy Email: [email protected]
Jurisdiction: Ho Chi Minh City, Vietnam
2. Information We Collect
We collect only the minimal data strictly necessary to provision and maintain your software license:
- Identity & Account Data: Your name and email address provided during checkout or registration.
- Authentication Credentials: Password hashes protected using irreversible cryptographic algorithms (bcrypt, cost factor 10). We never store raw plain-text passwords.
- Transaction Metadata: Order reference IDs, transaction timestamps, and license tier statuses received from merchant networks (WarriorPlus, Stripe, PayPal).
- System Preferences: Selected language, dark/light theme choices, and local workspace configurations stored in your local browser storage.
3. Zero Credit Card Storage Policy
We never store, transmit, or have access to your raw credit card numbers, debit card details, or banking passwords. All payments are processed directly by certified third-party merchant processors (Stripe, PayPal, and WarriorPlus) complying with PCI-DSS Level 1 data security standards.
4. How We Use Collected Data
Collected data is strictly utilized for the following legitimate purposes:
- Fulfilling orders and provisioning software access permissions.
- Sending critical transactional updates (receipts, password resets, product releases).
- Providing prompt technical assistance and processing refund requests via our support helpdesk.
- Preventing fraudulent access and securing platform infrastructure.
5. Third-Party Sub-processors
We engage reputable industry sub-processors to power essential infrastructure:
| Entity | Role / Purpose | Data Transferred | Privacy Framework |
|---|---|---|---|
| WarriorPlus LLC | Digital marketplace & affiliate checkout | Customer email, order ID, product tier | US Standard Data Protection |
| Stripe, Inc. | Payment gateway & fraud prevention | Tokenized payment credentials, billing address | PCI-DSS Level 1 • DPF EU-US |
| PayPal Holdings, Inc. | Alternative payment processing & IPN | Payer email, transaction transaction hash | PCI-DSS Level 1 • Global Compliance |
| Vercel / VPS Hosting | Edge runtime & server hosting | Encrypted database backups, server logs | SOC2 Type II • ISO 27001 |
7. GDPR & European Privacy Rights
Under the General Data Protection Regulation (GDPR), individuals located in the European Economic Area (EEA) and United Kingdom hold comprehensive privacy rights:
Right of Access & Portability
Request a machine-readable copy of your personal data stored within our systems.
Right to Erasure (Forgotten)
Request complete deletion of your account and personal identifiers from our database.
Right to Rectification
Update or correct inaccurate email addresses or user profile attributes.
Right to Object & Restrict
Restrict processing of your records for non-essential administrative purposes.
8. California Privacy Rights (CCPA / CPRA)
Under the California Consumer Privacy Act (CCPA) as amended by the CPRA, California residents are entitled to know what personal categories are collected and to request non-discrimination for exercising their statutory rights.
Notice of No Sale of Personal Information:
CourseForge Studio does not sell, rent, or share personal information with third parties for monetary or valuable commercial consideration.
9. Data Security & Encryption Standards
We implement rigorous technical safeguards including:
- End-to-end Transport Layer Security (TLS 1.3 / SSL 256-bit) across all web app requests.
- Database encryption at rest and isolated relational containers.
- Signed JSON Web Tokens (JWT) with secure HTTP-only cookies preventing XSS and CSRF tampering.
10. Data Retention Schedules
We retain account and transaction records for the duration of your active license in order to provide continuous software updates and prove license ownership. Upon receipt of a verified deletion request, customer records are permanently expunged within 30 days, save for transaction tax receipts mandated by financial audit legislation.
11. Contacting the Data Privacy Officer
To exercise your GDPR/CCPA rights, request data exports, or report privacy inquiries, submit a written notice to:
Privacy Officer: Duy Vo
Email: [email protected]
Turnaround Time: Requests are verified and fulfilled within 30 calendar days at zero fee.