Privacy Policy

Controller

The data controller is 브이엘엑스 (VLX), represented by Kim Eungyu (김은규), at 2F, Unit S4, 609-7 Gyeongsu-daero, Paldal-gu, Suwon-si, Gyeonggi-do, Republic of Korea (경기도 수원시 팔달구 경수대로 609-7, 2층 S4호, 지동). Privacy requests: gromode.official@gmail.com. Customer support is handled primarily at gromode.official@gmail.com. This policy applies to visitors and purchasers using the GROMODE storefront and protected download pages.

Data we process

• Order data: the contact email entered before checkout, PayPal buyer name and email when provided, PayPal order and capture IDs, payment status, country, currency, amount, consent record, and timestamps.
• Delivery data: protected entitlement identifier, delivered file metadata, expiry, download count, and last download timestamp.
• First-party analytics: random session ID, page path, campaign source or referring hostname, and page-view, CTA, checkout-start, and purchase-complete events.
• Administrator security audit: a one-way-hashed administrator identifier and request fingerprint, action, protected target, and timestamp. Raw passwords, access tokens, payment secrets, and raw IP addresses are not written to this audit table.
• Support data: name, email, PayPal order ID, message, and attachments you choose to send.
• Hosting security logs: request metadata such as IP address, device/browser details, timestamps, and security events processed by the hosting infrastructure.

GROMODE does not receive or store full card or bank-account details; PayPal processes those details.

Why we use data

We use data to perform the purchase contract, verify payments, deliver files, prevent fraud and abuse, respond to requests, maintain security, meet accounting and legal duties, and understand the store’s aggregate purchase funnel. We do not sell personal information or use the V1 storefront for behavioral advertising.

Processors and international transfers

PayPal handles payments. The site uses OpenAI Sites and Cloudflare-based hosting, database, private object storage, authentication, and infrastructure logging. Support email is handled by the provider connected to the published support address. Payment and buyer details may be processed internationally by PayPal. Hosting, database, private object storage, authentication, and security logging use OpenAI Sites and Cloudflare infrastructure under the providers' applicable safeguards.

Cookies and local storage

The storefront uses necessary storage for a random analytics session and secure order completion. PayPal may set its own necessary payment cookies under its policy. Advertising pixels and cross-site behavioral marketing cookies are disabled in V1. If optional tools are added later, a consent control will be provided where required.

Retention

Order and transaction records: Contract, payment, cancellation, and digital-delivery records are retained for 5 years; consumer complaint and dispute records for 3 years; advertising-display records for 6 months. Tax and foreign-transaction evidence may be retained for up to 7 years where applicable, unless a longer legal hold is required.. First-party analytics: First-party event-level analytics are retained for up to 12 months, then deleted or de-identified into aggregate statistics.; the application automatically removes event-level analytics after 12 months. Infrastructure and security logs: Administrator access and action audit records are retained for 1 year; access-right change records for 3 years; API rate-limit buckets for 48 hours. Hosting-provider request logs follow the applicable plan and settings. Incident or legal-hold records may be retained longer when required.. Administrator audit records are kept for one year; any future access-right change records are classified separately and kept for three years. Support and dispute records are kept only as long as reasonably needed, subject to legal holds and mandatory retention. Download access expires after 24 hours, although order and fraud-prevention records may remain. Data is deleted or de-identified when the applicable retention period ends unless continued retention is legally required.

Your rights

Depending on location, you may request access, correction, deletion, restriction, portability, or an explanation of processing, and may object or withdraw consent where processing relies on consent. You may also complain to a competent authority. Send a request to gromode.official@gmail.com. Procedure: Email gromode.official@gmail.com from the purchase email where possible, describe the request, and include the PayPal order ID only when relevant. Limited identity verification may be requested; no site account is required.. Response target: Acknowledgment within 3 business days and a substantive response within the applicable legal deadline.. Any legally shorter deadline controls, and we will explain any available appeal route.

If a state privacy law such as the California Consumer Privacy Act applies, applicable rights can include disclosure, correction, deletion, portability, non-discrimination, appeal, and required opt-out or Global Privacy Control treatment. GROMODE does not sell personal information and does not use the V1 storefront for cross-context behavioral advertising.

Security

Controls include encrypted transport, server-side payment verification, owner-only administration, secret storage outside source code, private file storage, expiring entitlements, download limits, and administrator access auditing. Audit identifiers are one-way hashed, are visible only within the protected owner dashboard, and never include raw secrets or tokens. No system can guarantee absolute security; report suspected misuse to gromode.official@gmail.com.

Updates

We will date material changes and retain prior versions where legally required. A change that materially affects a buyer’s rights will be announced through an appropriate notice before it takes effect.