Privacy Policy

1. Who we are

Asterion.pub ("we", "us", "our", or the "Operator") is the controller responsible for the personal data processed through the Asterion.pub website and services (the "Services"). This Privacy Policy explains what information we collect, why we collect it, how we use and protect it, and the choices you have.

By registering for, accessing, or using the Services, you agree to the processing of your information as described in this Policy. If you do not agree, please do not use the Services.

2. Information we collect

We collect only the data necessary to operate the Services securely:

• Account data — your username and email address.
• Security data — your IP address and request metadata (used for authentication, rate limiting, fraud prevention, and audit logging).
• Device / licensing data — a hardware identifier (HWID) used to bind a licence to a device, and the browser/operating-system information sent by your browser.
• Payment data — the minimum order metadata needed to fulfil a purchase. Payments are handled by our third-party payment processors; we never receive or store your card, bank, or crypto-wallet credentials.
• Optional connections — if you choose to link your Discord account, we store your Discord identifier to grant roles and subscriber access.

3. How we use your information

We use your information to: create and maintain your account; provide, operate, and improve the Services; process and confirm payments; prevent fraud, abuse, and unauthorised access; send important service and security notifications; and comply with our legal obligations. We may also use aggregated, anonymised data to understand how the Services are used and to improve them.

We do not use your data for third-party advertising, and we do not sell your personal data.

4. Legal grounds for processing

We process your personal data where it is necessary to perform our contract with you (providing the Services you purchase), where we have a legitimate interest (such as securing the platform and preventing fraud), where you have given consent (such as connecting Discord or receiving optional messages), and where we are required to do so by applicable law. You may withdraw consent at any time where processing is based on consent.

5. Cookies

We use a single, secure, HTTP-only session cookie that is strictly necessary to keep you signed in. We do not use advertising, profiling, or third-party tracking cookies. Because our cookie is essential to the operation of the Services, disabling it will prevent you from signing in.

6. Who we share data with

We do not sell your personal data. We share the minimum data necessary only with the service providers required to operate the Services:

• Payment processors — to process and confirm your payments.
• Bunny.net — content delivery and media hosting for the website and downloadable assets.
• Discord — only if you choose to connect your account, to sync roles and subscriber access.
• Authorities — where we are legally required to disclose information in response to a valid legal request.

7. International processing

Our service providers may process data on servers located in different countries. Where data is transferred across borders, we take reasonable steps to ensure it remains protected by appropriate safeguards and is handled in accordance with this Policy and applicable data-protection law.

8. Data retention

We retain account data for as long as your account is active. Security and audit logs are retained for a limited period (typically up to 90 days) for fraud prevention and security purposes. When data is no longer needed, or when you delete your account, we delete or anonymise it, unless we are required to retain it by law.

9. Data security

We take appropriate legal, organisational, and technical measures to protect your data from unauthorised or accidental access, alteration, disclosure, or destruction. These include bcrypt password hashing, HTTPS-only transport, strict session cookies, access controls, rate limiting, and security-event logging.

No method of transmission or storage is completely secure. You are responsible for keeping your credentials confidential; we are not liable for losses arising from your failure to do so or from access others gain using your credentials.

10. Your rights

Subject to applicable law, you may request access to, correction of, a copy of, or deletion of your personal data, and you may object to or restrict certain processing. You may withdraw consent where processing is based on it. To exercise any of these rights, contact us through our support ticket system or at legal@asterion.pub. You also have the right to delete your account, which will trigger deletion or anonymisation of the associated data.

11. Children

The Services are not directed to individuals who are under the age of majority in their jurisdiction, and we do not knowingly collect personal data from them. If you believe a minor has provided us with personal data, please contact us so we can remove it.

12. Changes to this Policy

We may update this Policy from time to time. Changes take effect once the updated version is published on the Services. We encourage you to review this Policy periodically. Your continued use of the Services after a change constitutes acceptance of the updated Policy.

13. Contact

For any privacy questions or requests, contact us through our support ticket system or at legal@asterion.pub.