Your data, your terms.

Macan Sell ("we," "us," "our") operates the website at macansell.com and the related platform (the "Service"). This Privacy Policy applies to everyone who uses the Service: sellers who sign up to list digital products, buyers who pay for those products, and anyone who simply visits a public page.

By using the Service, you agree to the collection and use of information as described here. If you don't agree, please don't use the Service.

We collect information you give us, plus a small amount that's automatic.

Account data (sellers). Email address, password (stored as a one-way bcrypt hash), username, store name and description, optional logo file, and the cryptocurrency wallet addresses you list for payouts.

Order data (buyers). The email address you provide at checkout, the optional Discord user ID, the products you bought, the order amount, and the payment method/network. We do not see or touch your private keys, seed phrases, or wallet credentials.

Discord OAuth. If a seller connects Discord, we store the access and refresh tokens (encrypted at rest using AES-GCM), the seller's chosen guild ID and role ID, and the buyer's public Discord user ID provided at checkout — only enough to assign the role you paid for.

Automatic technical data. Server logs that include IP address, user-agent, and timestamps for security and abuse detection. Cookie data necessary to keep you logged in (see Cookies).

We use the data above to:

• Operate the Service: log you in, render your storefront, route payments, deliver products.
• Send transactional emails (verification, password reset, order delivery, account security alerts).
• Detect and prevent fraud, abuse, and Terms violations.
• Provide aggregate analytics to sellers about their own store.
• Improve the Service — bug fixing, performance, new features.

We do not use your data to train machine-learning models, profile you for advertising, or sell it to third parties.

We rely on a short list of vetted vendors to run the Service. They process data on our behalf under contracts that prohibit them from using it for any other purpose:

• Resend — sends our transactional email.
• CryptoCloud — processes cryptocurrency invoices for plan subscriptions.
• Hostinger — hosts the application servers.
• Discord — when you connect a server, we use Discord's API to assign roles.

We may also disclose information when legally required (e.g. court order), to enforce our Terms, or to protect the rights, property, or safety of users and the public.

We use a single first-party cookie, mac_session, to keep you logged in. It's HttpOnly, SameSite=Lax, and only sent over HTTPS in production. We don't use third-party advertising cookies, pixels, or cross-site trackers.

We take reasonable steps to protect your data: passwords are hashed with bcrypt, OAuth tokens are encrypted at rest with AES-GCM, sessions are signed JWTs, traffic is served over TLS, and product files for paid orders are stored outside the public web root and only retrievable through one-time signed URLs.

That said, no method of transmission or storage is 100% secure. We can't guarantee absolute security and recommend you use a unique, strong password and enable Discord 2FA on connected accounts.

We retain account data for as long as your account exists. If you delete your account, we anonymize or delete your personal data within 30 days, except where we're legally required to keep certain records (financial statements, fraud logs).

Order records are retained for at least 7 years to satisfy bookkeeping and tax-audit obligations, with personal data minimized.

Depending on where you live, you may have the right to:

• Access the data we hold about you.
• Correct it if it's wrong.
• Delete it (subject to legal-retention exceptions above).
• Export it in a portable format.
• Opt out of marketing communications (we send virtually none, but the option is there).

Email privacy@macansell.com with your request and we'll respond within 30 days.

Macan Sell is operated from servers located in Europe. By using the Service, you understand that your data may be transferred to, stored, and processed outside your country of residence. Where applicable, transfers rely on the European Commission's Standard Contractual Clauses or equivalent safeguards.

The Service is not intended for children under 16. We don't knowingly collect data from anyone under 16. If you believe a minor has signed up, contact us and we'll delete the account.

We may update this Privacy Policy from time to time. Material changes will be communicated by email and on this page at least 14 days before they take effect. Continued use of the Service after the effective date means you accept the updated policy.

Questions about this policy? Email privacy@macansell.com or write to us through the contact form.