Privacy Policy

Information We Collect

GreyStudio collects the information needed to operate its actual account, commerce, order, contract, support, giveaway, staff, and security systems.

• Discord user ID, username, display name, avatar URL where used, and email where provided.
• Account creation records, authenticated sessions, IP address, user agent, device and recent-session details.
• Products, licenses, purchases, custom orders, contracts, signatures, payment metadata, delivery and file-access events.
• Support tickets, transcripts, giveaway entries and wins, staff records where applicable, notifications, audit events, fraud reports, appeals, and security investigations.

How Information Is Used

GreyStudio uses information to authenticate accounts, manage users, execute contracts, deliver products, enforce licenses, provide support, prevent fraud, handle disputes, secure systems, comply with law, and send service communications.

• Access is limited according to role and operational need.
• GreyStudio does not sell personal data to advertisers or data brokers.
• Automated status or access checks do not replace individual review where applicable law or material account action requires it.

Discord Authentication

Discord OAuth2 provides the identity used to sign into GreyStudio and connect website activity to the intended Discord account.

• Depending on the approved scope, Discord may provide an ID, username, display name, avatar, and email.
• GreyStudio does not receive your Discord password.
• Contracts signed through an authenticated account record the Discord ID used at signing, subject to account-compromise review.

Cookies and Sessions

Essential cookies maintain authentication, request security, and protected account features. Session records may include device, IP, location estimate, user agent, timestamps, and revocation state.

• Essential cookies are not used as advertising trackers.
• Disabling them may prevent protected features from working.
• Users can review and revoke available sessions from Profile Center.

Payments and Contracts

GreyStudio stores transaction and contract metadata needed for payment status, accounting, delivery, dispute response, fraud prevention, and legal records.

• Payment providers handle card, wallet, Robux, and provider credentials under their own policies; GreyStudio does not receive full card credentials.
• A customer-facing signed contract shows the signer name and signing time. GreyStudio separately retains restricted technical evidence: authenticated account context, consent and policy versions, the server-received time, trusted proxy IP when available, user agent, derived browser, device and operating-system families, a request correlation reference, evidence-schema version, document hash, and immutable snapshot.
• Technical signature evidence is visible only to authorised staff for security, audit and dispute handling; it is not printed into the customer-facing contract.
• Payment and signed-contract records may remain after account closure when justified by legal, accounting, dispute, or enforcement requirements.

Review Deployments

Where your commission is a website or application, Grey Studio may publish the completed work to a third-party hosting provider so that you can open and test it before final delivery.

• The deployed build contains the project itself. Any personal information it contains is information you supplied for the project, or content you asked Grey Studio to include.
• The hosting provider processes the deployed files under its own terms and privacy practices in order to serve the site.
• Grey Studio records the review address, when it was published, who published it, and any approval or change request you submit against it. That record is retained as part of the order history.
• Grey Studio does not send your account profile, payment details or saved card information to the hosting provider.

Saved Cards and Payment Tokens

Where you choose to save a card for future Custom Order payments, GreyStudio retains an encrypted payment token issued by the payment provider together with limited descriptive details. GreyStudio never receives or stores your full card number, security code (CVV/CVC) or PIN.

• Retained where you save a card, or where needed to complete the payment you started: an encrypted provider payment token, the last four digits of the card, the expiry month and year, the issuing bank's name and code, and the payment status.
• The payment token is encrypted at rest using authenticated encryption with a key held outside the database. It is never sent to your browser, never written to logs, and never included in audit records.
• Saved cards are used only for Custom Order and commission payments. They are not available to the store, cloud hosting, subscriptions or any other GreyStudio product.
• A card entered by someone paying on your behalf through a shared payment link belongs to that person. It is never saved to your account and can be used only for that single payment request.
• You may remove a saved card at any time from Profile Center. GreyStudio marks it revoked and never uses it again. Where the provider offers no deletion operation, GreyStudio will say that the card was removed from GreyStudio rather than claim it was deleted at the provider.
• Card details are entered only on the payment provider's own secure page, under their privacy policy.

Third-Party Services

GreyStudio controls information stored in its website, database, bot, support, order, contract, and administrative systems. Third parties control information processed in their own services.

• Integrations may include Discord OAuth2, Roblox, Payhip, Parcel, payment providers, hosting and database providers, Cloudflare where enabled, and email providers where enabled.
• External checkout, Discord, Roblox, documentation, and other links are governed by the third party’s own terms and privacy practices.
• Only data reasonably necessary for the integration or requested service should be transferred.

Data Retention

GreyStudio limits retention to documented operational, legal, security, contract, payment, support, and dispute purposes. Data is not retained indefinitely merely in case it becomes useful.

Security

GreyStudio uses reasonable safeguards including Discord OAuth, server-side authorization, role controls, restricted secrets, controlled file routes, validation, database constraints, immutable signed snapshots, hashes, backups, and audit records.

• No online service can guarantee absolute security.
• Protect Discord, Roblox, email, and GreyStudio sessions and promptly report suspected compromise.
• GreyStudio may pause access or delivery while a verified security review is conducted.

Privacy Requests

Depending on applicable law, users may request access, correction, deletion, restriction, objection, or export. Requests are reviewed individually and are not categorically refused because an account is blacklisted, suspended, or terminated.

• GreyStudio may verify identity and account authority before disclosing or changing records.
• The right to deletion is not absolute. Limited records may be retained for legal compliance, contracts, payments, tax, fraud, chargebacks, security, licenses, audits, or legal claims.
• When full deletion is not available, GreyStudio should explain the reason, remove unnecessary data, restrict retained data, anonymize where practical, and retain only for a documented period.

Contact

Use the authenticated Privacy Request page or official Support channel for privacy questions and rights requests.

• Provide enough account or order context for GreyStudio to locate the relevant records.
• Do not submit passwords, tokens, payment credentials, or unrelated sensitive information.
• A record of the request and response may be retained for compliance.