Privacy Policy

This site is run by KDR Studio, based in Finland. For anything in this policy, including requests about your data, contact viperkdrgamer@gmail.com.

KDR Studio is the data controller for the personal data described here.

• Email address — to create your account, log you in, and send confirmation and password-reset links.
• Username and profile — display name, bio, skills, avatar, Discord handle, links, and whether you are open for commissions. All of this is public by design.
• Works and uploaded files — projects, images, video, attachments and cover images you upload.
• Roblox animation data — the rig and baked keyframe JSON sent by the AnimExporter plugin. It describes geometry and motion; it is not personal data in itself, but it is stored under your account.
• IP addresses — seen by the hosting provider in request logs, and used for rate limiting on the plugin upload and report endpoints so they cannot be abused.
• Authentication cookies — needed to keep you signed in. Nothing else is stored in cookies.
• Consent records — which version of these documents you accepted and when. No IP is stored with them.
• Reports — if you report content, the reason, details and any contact address you provide.
• Payment links — the links, price ranges and notes you add under “Get paid”. They are public. Bank details are never stored. Clicks on them are counted as a plain number per link: nothing about who clicked is kept.
• Payments on this site (only when a creator uses them) — for a creator: their Stripe account id, whether it can take payments, and that they confirmed being 18 or over. For a payer: the email address they give, the amount, currency, what it was for, and the payment's status, refunds and disputes. Card and bank details go straight to Stripe and never reach us.

There is no analytics, no advertising, no tracking pixels, and no third-party scripts that profile you.

• Running your account and showing your portfolio — performance of a contract (GDPR Article 6(1)(b)). Without this data there is no account to provide.
• Security, rate limiting and preventing abuse — legitimate interests (Article 6(1)(f)): keeping the site usable and stopping spam, scraping and upload abuse.
• Handling reports and copyright complaints — legitimate interests, and compliance with a legal obligation (Article 6(1)(c)) where the EU Digital Services Act applies.
• Consent records — consent (Article 6(1)(a)), kept as evidence that it was given.
• Payments — performance of a contract with the creator and payer, and legal obligations for accounting and fraud prevention (Article 6(1)(b) and (c)).

• Supabase — database, authentication and file storage, hosted in EU (Frankfurt, Germany).
• Vercel — application hosting and request logs.
• Stripe — processes payments made on this site and the identity and bank checks for creators who connect a Stripe account. We share with Stripe the payer's email, the amount and the creator being paid. For that identity checking and for the card and bank details you give it directly, Stripe is a controller in its own right, under the Stripe Privacy Policy.
• Email delivery — confirmation and password-reset emails are currently sent through Supabase's built-in mail service. If a dedicated email provider is added later, this policy will be updated to name it.

Transfers outside the EU. Your data is stored in the EU, but Supabase Inc., Vercel Inc. and Stripe, Inc. are US companies (Stripe serves EU users through Stripe Payments Europe, Ltd. in Ireland), and support or administrative access from outside the EU is possible. Those transfers rely on the European Commission's Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.

• Account data, works and files — until you delete them, or delete your account. Deleting your account removes your profile, works, blocks, animations and every file you uploaded.
• Rate-limiting records — automatically purged after 24 hours.
• Payment records — kept as long as accounting and tax law requires, even after the creator deletes their account, because they are the record of a sale. Payment links and click counts are deleted with your account.
• Request logs — kept by the hosting provider under their own retention policy, typically no longer than 30 days.
• Backups — the database provider keeps short-term backups. Deleted data can persist in those for a short period before they roll over.
• Reports and moderation records — kept after the reported content is removed, because they are the record of why a decision was made. Your identity is unlinked if you delete your account.

Under the GDPR you can:

• Access your data — Settings → My data → Download my data gives you everything as one JSON file, immediately.
• Correct it — edit your profile and works at any time in Settings.
• Delete it — delete individual works, blocks, files and animations, or your whole account, in Settings.
• Port it — the same JSON export is structured and machine-readable.
• Restrict or object to processing based on legitimate interests.
• Withdraw consent where processing is based on it.

Most of this you can do yourself without asking. For anything else, email viperkdrgamer@gmail.com. You will get an answer within 30 days.

If you think your data has been handled wrongly, you can complain to the Finnish supervisory authority, the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto). You may also complain to the authority in your own EU country.

Only essential cookies are used, and only to keep you signed in. There is no analytics, advertising or tracking, and nothing is shared with third parties for those purposes.

That is why there is no cookie banner: consent is not required for cookies that are strictly necessary to provide a service you asked for. If that ever changes, you will be asked first.

You must be at least 13 to use this site — the digital consent age in Finland. Accounts believed to belong to younger users are removed. If you think a child has created an account, email viperkdrgamer@gmail.com.

When this policy changes materially, the version number above is increased and signed-in users are asked to read and accept the new version before continuing. Minor corrections update the date only.