Privacy Policy

1. Introduction

Welcome to OriginsBot ("we", "us", "our"). We are committed to protecting your privacy. This Privacy Policy explains how we collect, use, and share the very limited personal information we handle when you use our software and services (collectively, the "Service").

Our Service is provided by Quay Elements Pty Ltd (ABN 20 694 751 927), a company based in Queensland, Australia. Quay Elements Pty Ltd is the "data controller" for the personal information described in this policy.

2. Information We Collect and Store

We collect and store the following information on our servers:

2.1 Account Information

Email Address: We collect and store your email address when you register for an account or sign up for our beta program.
Subscription Tier: We store your chosen subscription tier (Free, Gathering, or Pro).
Account Status: We store your subscription status (active, cancelled, trial, etc.) and relevant dates (signup date, approval date, expiry dates).

2.2 Device Information

Device Identifier: A unique identifier (UUID) generated by the software on your device to enforce our one-device-per-account policy.
Device Name: A human-readable name for your device (e.g., "John's MacBook Pro") to help you identify which device is registered to your account.
Last Seen Timestamp: The last time your device communicated with our servers to validate your subscription.

2.3 Payment Information (Collected by Dodo Payments, Not Stored by Us)

Important: We do not collect, process, or store your payment information directly. All payment processing is handled by our payment processor, Dodo Payments. However, we can access certain transaction information through our payment processor's dashboard and APIs for customer support, refund processing, and subscription management purposes:

Last 4 Digits of Payment Card: May be visible to us through our payment processor to help verify transactions and assist with customer support inquiries.
Name: If you provide your name during checkout, we may view it through our payment processor to process refunds and respond to support requests.
Billing Address: If you provide a billing address during checkout, we may view it through our payment processor for tax compliance and fraud prevention purposes.
Transaction Details: Transaction IDs, invoice numbers, payment method type (e.g., Visa, Mastercard), payment dates, and billing periods may be accessible to us through our payment processor.

This payment information remains stored on our payment processor's secure systems and is governed by their privacy policy. We only access this information when necessary for customer support, dispute resolution, or legal compliance.

Information We DO NOT Collect

To be perfectly clear, we DO NOT collect, store, or have access to:

Your full credit card, debit card, or bank account numbers.
Your card security codes (CVV/CVC).
Any information about your game accounts, in-game activities, usernames, or passwords.
Your computer usage patterns, browsing history, or other applications on your device.
The software operates entirely locally on your device and does not monitor or transmit your personal activities.

3. How We Use Your Information

We use the information we collect for the following purposes:

3.1 Email Address

Account Management: To create and manage your account, verify your identity, and link your subscription to your email.
Subscription Validation: To verify your subscription status when you use the software.
Communications: To send you subscription-related notices (payment confirmations, renewal reminders), beta program updates, and important service announcements (critical bug fixes, terms updates).
Customer Support: To respond to your support requests and troubleshoot issues.

3.2 Device Information

License Enforcement: To enforce our one-device-per-account policy and prevent unauthorized sharing of accounts.
Device Management: To show you which device is currently registered to your account and allow you to manage device changes.
Security: To detect and prevent unauthorized use of your account on multiple devices simultaneously.

3.3 Subscription and Payment Information

Access Control: To determine which features of the software you can access based on your subscription tier.
Billing Support: To investigate billing issues, process refunds, and resolve payment disputes.
Fraud Prevention: To detect and prevent fraudulent transactions and chargebacks.
Tax Compliance: To comply with tax reporting requirements in various jurisdictions.

Legal Basis for Processing (GDPR)

Our legal bases for processing your personal information are:

Performance of a Contract: Processing is necessary to provide you with the subscription service you purchased, as described in our Terms and Conditions.
Legitimate Interests: We have a legitimate interest in preventing fraud, enforcing our license terms, and providing customer support.
Legal Obligation: Processing may be required to comply with tax laws, respond to legal requests, or fulfill other legal obligations.

4. Data Sharing and Third Parties

We do not sell, rent, or trade your email address. We only share it with essential third-party service providers (known as "sub-processors") who help us operate our Service.

4.1 Payment Processing (Dodo Payments)

All payments and subscriptions are handled by our third-party payment processor, **Dodo Payments**.

When you purchase a subscription, you are providing your information (such as your name, billing address, and payment details) **directly to Dodo Payments**. We do not receive or store this payment information; we may receive your email address and subscription status to confirm your purchase.

Your use of our payment processor's service is subject to their own terms and privacy policy.

4.2 Subscription Management (Our Infrastructure)

We manage subscription validation and status using our own infrastructure hosted on **Vercel**. Your subscription data (email address, subscription tier, status, and expiry dates) is stored in a **Vercel KV database** (a Redis-compatible key-value store) and processed by our **Vercel serverless functions**.

When you purchase or update a subscription through Dodo Payments, our webhook handlers receive subscription events and store the relevant subscription information in our database. When you use the application, our API endpoints query this database to validate your subscription status and determine which features you can access.

This data is stored securely on Vercel's infrastructure and is only accessible through our authenticated API endpoints. Vercel's processing of your data is governed by their Privacy Policy.

4.3 Legal Compliance

We may disclose your email address if required to do so by law or in the good faith belief that such action is necessary to comply with a legal obligation, protect our rights, or defend against legal liability.

5. Data Retention

We retain your personal information for as long as necessary to provide you with the Service and fulfill the purposes described in this Privacy Policy:

Active Accounts: We retain your email address, device information, and subscription data for as long as your account is active.
Cancelled Subscriptions: If you cancel your subscription but do not delete your account, we will retain your information to allow you to reactivate your subscription in the future.
Deleted Accounts: If you cancel your subscription and request account deletion, we will delete your email address, device information, and subscription data from our active systems within 30 days.
Legal Requirements: We may retain certain information (such as transaction records) in backups or archives for up to 7 years as required for tax, accounting, legal compliance, or fraud prevention purposes.
Payment Information: Payment information stored by our payment processor is subject to their retention policies. See their privacy policy for details.

To request account deletion, please contact us at the email address provided in Section 11.

6. Data Security

We implement reasonable technical and organizational measures to protect your personal information from unauthorized access, use, or disclosure, including:

Data encryption in transit using HTTPS/TLS
Secure database storage with access controls
Regular security updates and monitoring
Limited access to personal information on a need-to-know basis

However, no internet transmission or electronic storage is 100% secure, and we cannot guarantee absolute security. Your payment information is protected by our payment processor's PCI-DSS compliant payment processing system.

7. International Data Transfers

Your personal information may be processed and stored on servers located outside of your country of residence, including in Australia, the United States, or other countries where our service providers (e.g., Vercel, Dodo Payments) operate. By using the Service, you consent to the transfer of your information to these countries, which may have different data protection laws than your own.

For users in the European Economic Area (EEA), we rely on appropriate safeguards, such as Standard Contractual Clauses, for such transfers. Our payment processor maintains compliance with international data protection regulations, including GDPR.

8. Your Data Rights

Depending on your location (especially in the EEA, UK, and California), you may have the following rights regarding your personal information:

Access: The right to request a copy of the personal information we hold about you (email address, device information, subscription data).
Rectification: The right to request that we correct inaccurate information about you.
Erasure (Deletion): The right to request that we delete your personal information. Please note that this will result in the permanent termination of your account and access to paid features.
Portability: The right to receive your personal information in a structured, commonly used, and machine-readable format.
Objection/Restriction: The right to object to or restrict our processing of your personal information (though this will likely prevent us from providing the Service to you).
Withdraw Consent: If we process your information based on your consent, you have the right to withdraw that consent at any time.

For payment-related information: Because our payment processor handles your payment information independently, you may need to contact them directly to exercise certain rights regarding payment data. We can assist you with this process.

To exercise any of these rights, please contact us at the email address provided in Section 11. We will respond to your request within 30 days.

9. Children's Privacy

As stated in our Terms and Conditions, you must be at least 18 years of age (or the age of legal majority in your jurisdiction) to create an account and use our Service.

We do not knowingly collect personal information from anyone under the age of 18. If we become aware that we have inadvertently collected such information, we will take steps to delete it immediately.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last Updated" date at the top. We encourage you to review this page periodically.