Privacy
Privacy and data protection policy
Effective 13 August 2026. This policy applies to the Taatuf Studio website and direct store.
Taatuf Studio is an online digital-product business operated from Pakistan. For personal data processed through this website, Taatuf Studio is normally the data controller. Paddle separately controls information it needs as the authorised reseller and merchant of record. Contact us at support@taatufstudio.com.
Information we collect
- Identity and contact data, such as your name and email address.
- Order data, including products, price, currency, Paddle references, refund state, and entitlement history.
- Account data if you voluntarily register, including authentication identifiers and verified email status.
- Support communications and information you choose to include in a request.
- Technical and security data, such as IP-derived security hashes, browser information, timestamps, and download events.
- Consent and preference records where optional analytics or marketing is introduced.
We do not receive or store full payment-card numbers. Paddle processes payment and billing information.
Purposes and lawful bases
| Purpose | Typical lawful basis |
|---|---|
| Prepare and fulfil orders, deliver files, recover purchases, and provide support | Contract |
| Keep accounting, tax, refund, and transaction records | Legal obligation |
| Prevent fraud, secure downloads, diagnose failures, and defend legal claims | Legitimate interests and legal obligation |
| Operate optional customer accounts | Contract and legitimate interests |
| Send optional marketing or use non-essential cookies | Consent, where required |
We do not sell personal data or use purchase data for unrelated advertising without an appropriate legal basis.
Who receives information
- Paddle, which processes checkout, payment, tax, invoicing, fraud checks, refunds, and buyer support.
- Supabase, which hosts store records, authentication data, and private delivery files.
- Vercel, which hosts and secures the website and server functions.
- Resend, which sends transactional delivery, recovery, and support email.
- Professional advisers, regulators, courts, or law enforcement where disclosure is lawful and necessary.
Each provider may process data in countries other than yours. We use provider contractual protections and other lawful transfer mechanisms where required.
Retention
- Order, payment-reference, refund, and accounting records: generally up to seven years, or longer where legally required.
- Active entitlements: for the supported life of the product or until revoked under the licence, refund, or legal requirements.
- Access tokens: until expiry or revocation; raw tokens are not stored.
- Security and download logs: generally up to 12 months unless needed for an investigation or legal claim.
- Support requests: generally up to 24 months after resolution.
- Abandoned purchase intents: generally up to 90 days.
These periods may be shortened or extended when necessary to meet law, resolve disputes, or prevent fraud.
Your data-protection rights
Depending on your location and the lawful basis, you may request access, correction, deletion, restriction, portability, or object to processing. You may withdraw consent at any time without affecting earlier lawful processing. We may need to verify your identity and may retain records where law requires it.
Email your request to support@taatufstudio.com. You may also complain to the data-protection authority where you live, work, or believe an infringement occurred.
Security and automated decisions
We use access controls, row-level database security, server-only credentials, payment-webhook verification, hashed access tokens, short-lived signed downloads, and audit records. No internet system is risk-free. We do not currently make decisions producing legal or similarly significant effects solely through automated profiling.
Children and changes
The store is not directed to children under 16, and we do not knowingly collect their data. We update this notice when processing or legal requirements materially change and publish the new effective date here.
Questions or legal requests: support@taatufstudio.com