Collect what the service needs. Explain why.

This policy covers the public store and customer vault. It separates purchase fulfilment from optional profiling and direct marketing.

Information we collect

For fulfilment, we receive checkout email, purchaser name when supplied, product, amount, currency and Stripe transaction identifiers. Stripe handles payment-card details.

When you sign in, we receive the identity provider, provider account identifier, verified email and, when supplied, display name.

Optional profile: business name and website, role, industry, team size, country, state or region, security program stage, compliance priorities, current tools and services, primary goal, purchase timeline, support preference and referral source.
Separate choices for marketing and customer research.
Operational records: entitlement, purchase, webhook status, download time, product and a bounded user-agent value.
Support messages and the information you choose to provide in them.

Why we use it

We use purchase and identity data to grant, protect and restore access; optional profile data to improve support and product relevance; and operational records to diagnose missing purchases, prevent duplicate fulfilment and investigate abuse.

We use information for direct marketing only where you have chosen it or where applicable law otherwise permits it, and provide a simple way to opt out.

Cookies

The Customer Vault uses essential, secure cookies to maintain sign-in, protect OAuth transactions and remember that its cookie notice was acknowledged. These cookies are not used for advertising or cross-site tracking.

The Customer Vault does not currently set analytics or advertising cookies. If that changes, this policy and the cookie controls will be updated before optional cookies are enabled.

Security and retention

Access decisions happen server-side. Product files are not exposed as public asset URLs, and session and download responses use restrictive security controls.

We keep purchase and entitlement records for as long as needed to provide continuing access and meet accounting, legal and dispute obligations. Optional profile and consent data is retained until updated, withdrawn or no longer reasonably needed.

Access, correction and choices

You can update profile and consent choices in the customer vault. To ask for access, correction or deletion where available, email shoutout@lil.business from the account email.