Privacy Policy

1. Data Controller & Scope

This Privacy Policy applies to personal data collected by Noventra Media (“NoventraStock”, “we”, “us”, or “our”) as the Data Controller in accordance with global data protection regulations, including the European General Data Protection Regulation (EU GDPR / UK GDPR) and the California Consumer Privacy Act (CCPA / CPRA).

2. Personal Information We Collect

We only collect information strictly required to deliver our stock footage catalog, process orders, issue valid commercial license certificates, and safeguard account security:

• Account & Profile Data: Full name, email address, password hash (encrypted via Argon2/Bcrypt by Supabase Auth), optional company name, and country when you register or sign in with Google OAuth.
• Transaction & Order History: Billing records, purchased item IDs, licensed resolutions (4K / HD), credit balance history, and signed PDF license certificates. (Note: We do not store raw credit card numbers or banking credentials on our servers; payments are handled directly by PayPal).
• Technical & Security Logs: IP address, user-agent, session tokens, and request timestamps strictly utilized for rate-limiting, anti-fraud payment verification, and server security.
• Support Communications: Inquiries, tickets, or license verification requests submitted via our contact form or support email.

3. Legal Bases for Data Processing (GDPR Art. 6)

We process your personal information only when lawful grounds exist:

• Contract Performance: To create your user account, execute checkout transactions, process PayPal payments, and deliver signed license certificates for downloaded footage.
• Legitimate Interests: To detect and prevent fraudulent transactions, protect our digital video assets from scraping or pirated distribution, and monitor website stability.
• Legal & Tax Obligations: To comply with statutory financial reporting, corporate tax laws, and digital sales record retention.

4. Third-Party Service Providers

We partner only with industry-standard, security-audited infrastructure providers to operate the Platform:

• Payment Gateways: PayPal (Europe) S.à.r.l. / PayPal Inc. for secure checkout processing.
• Database & Authentication: Supabase Inc. (SOC2 Type II certified cloud database and authentication provider).
• Edge Network & Security: Cloudflare Inc. (DDoS mitigation, SSL encryption, and edge routing).
• Analytics: Google Analytics (with IP anonymization enabled to analyze aggregated site traffic without tracking individual identities).

5. Data Retention & Deletion Schedule

We retain account data for as long as your NoventraStock account remains active so that you can re-download your purchased video licenses at any time. If you request account closure, we purge your personal profile data within 30 days, retaining only necessary transaction receipts required by statutory tax and corporate accounting laws (typically 7 years).

6. Your Privacy Rights (GDPR & CCPA / CPRA)

Regardless of your country of residence, NoventraStock extends comprehensive privacy protections to all registered users:

• Right of Access & Portability: Request a digital export of the personal information we hold about you.
• Right of Rectification: Update inaccurate or outdated profile details directly from your Dashboard.
• Right to Erasure (“Right to be Forgotten”): Request the permanent deletion of your account and personal identifiers.
• Right to Restrict or Object: Opt-out of marketing communications or non-essential analytics tracking.
• Non-Discrimination: We will never discriminate against you or deny services for exercising your privacy rights.