Privacy Policy

This translation is provided for convenience. If it differs from the English version, the English version applies.

This Privacy Policy explains which personal data whitemodz collects when you use whitemodz.com (the “Site”), why we collect it, who we share it with and what choices you have. It covers the store, customer accounts, live chat and our Creator and Reseller programs.

Who is responsible

The Site is operated by whitemodz, which is responsible for the personal data described in this policy. You can reach us at info@whitemodz.com.

What we collect

When you place an order

Your email address, and your first and last name if you enter them.
The products you order, prices, discount codes and store credit used, and the payment method.
The IP address the order is placed from.
For a gift: the recipient's email address and name, and your gift message.
For a PayPal payment: the PayPal email address you tell us you paid from, and the payer's name, email address, amount and note from the PayPal payment notification.
For a crypto payment: the transaction ID (TXID) you submit.
For products redeemed on the vendor's own platform: the username of your account there (for example on NeverLose), which you enter when redeeming.

If you check out without signing in, we automatically create an account for your email address, so that you can later sign in with a sign-in link and find your orders. We email you when this happens. If you bought from whitemodz on our previous store platform, your past orders (email address, name and order details) may have been imported so that they appear in your account.

When you have an account

Your name, email address and password. We store the password only as a one-way hash (bcrypt), never in readable form.
If you turn it on: your two-factor authentication secret and recovery codes.
If you sign in with Google: your email address and name. If you connect Discord: your Discord user ID and username.
The IP address you signed up from, and the IP address and time of your most recent visit.
Your referral code, who referred you (if anyone), and your store credit balance and transactions.

You can change your name and password on your account page.

When you contact us

Live chat: your name and email address if you give them, your messages, images you upload and the rating you give the chat. While you are typing, our support team can see a preview of your unsent message, so they can start preparing an answer. If you ask for a transcript, we email it to you.
Contact form: your name, email address, subject, message and IP address.

Other things you can send us

Product reviews: your name, which is shown with your review, your email address, the rating and the review text.
Restock alerts: your email address and the product you are waiting for.
Newsletter: your email address, where you signed up and the IP address the sign-up came from.
Push notifications: the subscription details your browser gives us and your browser's user agent.
Job applications: your name, email address, Discord username, country, time zone, portfolio or audience details and your message.
Review rewards: the forum username you give us, your email address and your IP address.

Creator and Reseller programs

Your application details, such as your channel or store name, links, audience size and message.
The payout details you provide, such as a bank account (IBAN) or a crypto wallet, and your payout requests.
The sales attributed to you. To credit visits that arrive through a creator link, we store a one-way hash of the visitor's IP address rather than the address itself.
For resellers: orders placed through your store, including your customers' email addresses and the products they bought.
For creators who link YouTube: see “Google sign-in and YouTube” below.

Collected automatically

Visit analytics: IP address, the pages you visit, the page that referred you, your device type and browser, and an approximate location (country, region, city and time zone) and network provider worked out from your IP address.
Security: temporary counts of failed sign-in attempts, and email addresses, IP addresses or PayPal addresses that we have blocked because of abuse.
Emails we send: a copy of each email is kept in our outbox log.

Cookies and browser storage

We set four cookies of our own:

wm.sid — keeps you signed in and holds your session (30 days).
wm_2fa_device — marks this browser as one that has already passed a security code check on your account, so that a lock caused by someone else's wrong attempts does not lock you out (180 days).
wm_creator — remembers which creator link brought you to the Site, so the creator is credited for your purchase (30 days).
wm_v — a random visitor ID for our own visit analytics (about 13 months).

We also keep some things in your browser's local storage on your device: your cart, wishlist and recently viewed products, your language, a coupon code you entered, banners and prompts you have dismissed, and a chat token that lets you return to your live-chat conversation.

Services embedded in the Site can set cookies of their own — for example Stripe on the payment page, Cloudflare Turnstile on forms protected against bots, and YouTube or Streamable where a product video is shown.

How we use your data

To process and deliver your orders, including sending license keys, receipts and order updates by email.
To run your account: sign-in, two-factor authentication, store credit and referrals.
To give support by live chat, email and Discord.
To prevent fraud and abuse, keep the Site secure, and handle payment disputes and chargebacks.
To run the Creator and Reseller programs: attributing sales, calculating commissions and paying out.
To send emails related to your purchases and activity, such as restock alerts you asked for, reminders about unfinished orders or expiring products, review requests, and messages about the programs you take part in.
To send marketing emails, such as our newsletter or a one-time discount for returning customers.
To understand how the Site is used and to improve it.

Where the GDPR or similar laws apply, we rely on these legal bases: performing our contract with you (orders, accounts and programs); our legitimate interests (security, fraud prevention, handling disputes, analytics and service emails); complying with legal obligations (for example accounting); and your consent (for example the newsletter and push notifications), which you can withdraw at any time.

We do not sell personal data. We share it only with the service providers that help us run the Site, and only as much as each of them needs:

Stripe — card payments, fraud screening and payment disputes. Stripe receives your email address and order number; your card details go directly to Stripe and never reach our servers. If you dispute a payment, we send Stripe — and through it your bank — evidence about the order, such as delivery records, the IP address and relevant support messages.
PayPal and Make.com — PayPal payment notifications reach us through Make.com, so that payments can be matched to orders.
Our email provider — delivers the emails we send you, which means it processes your email address and the content of those emails.
Google — Google sign-in and YouTube (see below). Fonts on our pages are loaded from Google Fonts, which means Google receives your IP address.
Discord — Discord sign-in and account linking. When you connect Discord, you are also added to our Discord server and may be given a customer role there. Our team receives order and support notifications in a private Discord channel; these can include your email address and order details.
Telegram — if we switch it on, the same staff notifications can also be delivered through Telegram.
Cloudflare — Turnstile protects sign-in, registration and other forms against bots. If the Site is served through Cloudflare's network, Cloudflare also handles your connection to it and passes on the approximate location we use for visit analytics.
ipwho.is — works out an approximate location from IP addresses for our visit analytics when Cloudflare has not provided one.
Anthropic — if we switch on AI assistance for support, the text of a live-chat conversation and basic order context (product names, order status and dates — never license keys) is sent to Anthropic to draft replies, summaries and tags for our support team. A member of our team always reviews a draft before anything is sent.
Cloud storage — if we enable offsite backups, encrypted copies of our database are stored with an S3-compatible storage provider.
Browser push services — if you allow notifications, they are delivered through your browser maker's push service.
Product vendors — for products redeemed on a vendor's platform, the account username you give us is sent to that vendor.

We may also disclose personal data where the law requires it, in response to valid requests from public authorities, to protect our rights, our customers or the public, or as part of a merger, acquisition or sale of assets. In that last case, we will tell you before your data becomes subject to a different privacy policy.

Google sign-in and YouTube (Creator Program)

whitemodz offers two optional Google features: signing in with a Google account and, for Creator Program members, linking a YouTube channel to the creator dashboard. The Creator Program uses YouTube API Services, so by linking your channel you also agree to the YouTube Terms of Service. How Google itself handles your data is described in the Google Privacy Policy.

Data we access

Google sign-in (openid, email and profile scopes): your email address and name.
YouTube channel linking (read-only youtube.readonly scope): your channel's name, ID and avatar; its subscriber, view and video counts; the titles, thumbnails and public statistics (views, likes and comments) of your recent public uploads; and the refresh token Google issues for the connection.

We keep only public videos. We do not keep private or unlisted videos, and we don't access comments, messages, watch history or data about any YouTube user other than the channel you link. We cannot upload, change or delete anything on YouTube.

How we use it

Sign-in data (email address and name) is used only to create your whitemodz account and sign you in.
YouTube data is used only to show your own channel and video statistics in your creator dashboard, and to confirm promotional videos you agreed to publish. To recognise those videos we read their titles and descriptions; descriptions are not stored. The refresh token is used only to update these statistics, roughly every 6 hours, without asking you to sign in again.

We do not use Google user data for advertising, for profiling or to train AI or machine-learning models, and we do not combine it with data about other people.

Sharing

Google user data is visible only to you and to the whitemodz staff who run the Creator Program. We do not sell it or pass it to third parties such as advertisers, analytics providers or data brokers. The only exceptions are encrypted database backups, if enabled (see “Cloud storage” above), and disclosures required by law.

Protection

Google user data is encrypted in transit (HTTPS/TLS) between your browser, our servers and Google's APIs. Refresh tokens and cached statistics are stored on our server in an access-controlled database; they are never shown to browsers, other users or third parties.

Retention and deletion

YouTube data is kept only while your channel is linked. Choosing Unlink in the creator dashboard immediately deletes the stored refresh token, the channel statistics and the cached videos, and asks Google to revoke our access. You can also revoke our access at any time in your Google account settings; when Google tells us that access has been revoked or has expired, we unlink the channel and delete the stored YouTube data. Sign-in data stays with your whitemodz account, as described under “How long we keep data”.

whitemodz's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How long we keep data

Accounts: for as long as your account exists. When you ask us to delete it, we delete or anonymise your data, except records we have to keep.
Orders and payments: for as long as we need them for accounting, tax, fraud prevention and payment disputes.
Visit analytics: deleted after 60 days by default.
Outbox email copies: only the 500 most recent emails are kept.
Live chat: kept so that our team can refer back to earlier conversations, until you ask us to delete them.
Sign-in links: expire after 15 minutes.

Your rights and choices

Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal data, to object to or restrict certain uses of it, and to withdraw your consent. Accounts cannot yet be deleted from the account page: email info@whitemodz.com from the address on your account and we will handle your request. We may need to keep some information where the law requires it or where we have another lawful reason to do so. You also have the right to complain to your local data protection authority.

You can leave the newsletter with the unsubscribe link in each newsletter email. To stop other reminder or marketing emails, contact us. Push notifications can be switched off at any time in your browser settings.

International transfers

Some of our providers — including Stripe, Google, Discord and Anthropic — process data in the United States and other countries whose data protection laws may differ from those where you live. When your data is transferred, we rely on the transfer safeguards these providers offer, such as standard contractual clauses.

Security

We protect personal data with measures including HTTPS, password hashing, optional two-factor authentication, restricted staff access and access-controlled backups, which are encrypted whenever a copy is stored offsite. Still, no method of sending data over the internet or storing it electronically is completely secure, so we cannot guarantee absolute security.

Children

The Site is not intended for anyone under the age of 13, and we do not knowingly collect personal data from children under 13. If you are a parent or guardian and believe your child has given us personal data, please contact us. If we learn that we have collected personal data from a child under 13 without verified parental consent, we will take steps to delete it from our servers. Where we rely on consent and your country requires a parent's consent, we may ask for it before collecting and using the information.

Links to other websites

The Site contains links to websites that we do not operate. If you follow a third-party link, you will leave our Site, and we have no control over — and accept no responsibility for — the content, privacy policies or practices of other sites or services. We recommend reading the privacy policy of every site you visit.

Changes to this policy

We may update this Privacy Policy from time to time. We will publish the new version on this page, update the “Last updated” date at the top, and tell you by email and/or with a clear notice on the Site before the change takes effect. Changes apply from the moment they are published here, so please check this page now and then.

Contact us

If you have a question about this Privacy Policy or about your personal data, email us at info@whitemodz.com.