1. Who is responsible
BuiltByOtte, Gouden Boers 16, 8607 KE Sneek, the Netherlands (Chamber of Commerce 99276216), is responsible for the personal data processed through builtbyotte.com. Questions or requests: contact@builtbyotte.com. We follow the EU General Data Protection Regulation (GDPR).
2. Data we collect
- Account: name, e-mail address, password (stored only as a secure hash) and when you confirmed your e-mail address.
- Orders: the resources you bought, prices, currency, discounts and coupon codes, VAT, payment status, Stripe payment references and when you agreed to immediate delivery. Stripe may ask for your billing address to calculate VAT.
- Licenses and downloads: which licenses you hold, and for every download the date and time, version, IP address and browser type. Downloaded files contain identifiers linked to your license.
- Security: technical data such as IP address and browser signals, used by Cloudflare to protect the website and by our login, sign-up and coupon forms to block bots.
- Support: messages you send us by e-mail or Discord.
- Reviews: if you review a resource you own, your first name, rating, review text and the date are shown publicly on that resource's page and may be featured on our homepage.
- Website statistics: which pages are viewed, in what order, for how long and how far you scroll, the website that referred you, your approximate country (as detected by Cloudflare), browser, operating system and device type, and whether the visit led to creating an account, adding something to the cart or ordering. This works without cookies and without storing your IP address: visits are counted with an anonymous code, derived from your IP address and browser, that changes every day.
We never receive your full card details; Stripe handles those.
3. Why we use it
- Creating your account, processing orders and delivering downloads and updates: performance of a contract (Art. 6(1)(b) GDPR).
- Keeping order and VAT records: legal obligation (Art. 6(1)(c) GDPR).
- Preventing fraud and license abuse, securing the website and blocking bots: legitimate interest (Art. 6(1)(f) GDPR).
- Answering support questions: performance of a contract and legitimate interest.
- Improving the website with anonymous statistics: legitimate interest.
We don't send marketing without your consent, and we never sell your data.
4. Who receives your data
- Stripe (Stripe Payments Europe, Ireland): payments, receipts and invoices.
- Cloudflare (United States): content delivery, security and bot protection on our forms.
- Apple iCloud Mail: sending account, login and order e-mails.
- Discord (United States): support conversations, and a private sale notification to us containing the buyer's name and the resource bought.
All our systems, including the website, its database, download files and website statistics, run on our own infrastructure in Friesland, the Netherlands. No hosting company or other third party has access to that infrastructure, its databases or its files; only the providers listed above receive the specific data described for them. Website statistics are not shared.
BuiltByBit and sourceXchange only receive your data if you buy from us on their platforms; they are then responsible for it under their own policies.
5. Cookies and local storage
We only use what the website needs to work, so no consent banner is required:
- a session cookie that keeps your cart, currency and login (it expires after 2 hours of inactivity);
- a security cookie that protects forms against forgery;
- a "keep me logged in" cookie, only when you tick that box;
- your light or dark theme choice, stored in your browser and never sent to us.
Your currency is suggested from the country Cloudflare detects for your connection; we don't store that country.
6. How long we keep it
- Account and licenses: as long as your account exists.
- Orders, invoices and payment records: 7 years, as Dutch tax law requires, also after your account is closed.
- Download records: 12 months.
- Website statistics: 25 months.
- Server and security logs: 30 days.
- Support messages: up to 2 years after the conversation.
- Reviews: until you ask us to remove them.
7. Transfers outside the EU
Some providers above process data in the United States. Where that happens, the transfer is covered by the EU–US Data Privacy Framework or by Standard Contractual Clauses approved by the European Commission.
8. Your rights
You can ask to see, correct, delete or export your data, and object to or restrict how we use it. E-mail contact@builtbyotte.com from the address linked to your account; we reply within one month. Deleting your account ends your licenses; order records we must keep for tax purposes are kept for the legal period.
You can also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the authority in your own country.
9. Security
The website only works over HTTPS, passwords are stored as hashes, login attempts are rate-limited and forms are protected against bots. We host everything on our own infrastructure in Friesland, the Netherlands, and access to it is limited to us.
10. Children
Our services are not meant for anyone under 16. If we learn that we hold data of a child without permission, we delete it.
11. Changes
We may update this policy. The current version is always at builtbyotte.com/privacy, and we tell account holders about important changes.