Privacy Policy
The short version. To sell you a file we need your email address and your country. That is essentially it. Your card never touches our servers, we run no advertising trackers, and we do not sell or share customer data with anyone.
1. Who is responsible
[COMPANY LEGAL NAME], trading as OrganicTraffic, of [REGISTERED ADDRESS], is the controller of personal data described in this policy. Contact: hello@organictraffic.io.
This policy covers data about you, our customer. It does not cover the business contact data contained in the files we sell — that is addressed on our compliance page.
2. What we collect
| Data | Why | Lawful basis |
|---|---|---|
| Email address | To deliver your file and send your receipt | Performance of a contract |
| Billing country | To apply the correct tax treatment | Legal obligation |
| Order contents and any notes you add | To build the right file | Performance of a contract |
| Payment confirmation (last 4 digits, brand, status) | Reconciliation and refunds | Legal obligation |
| Name and message, if you use the contact form | To answer you | Legitimate interest |
| Aggregate, non-identifying request logs | Security, abuse prevention and uptime | Legitimate interest |
We do not collect or store your card number, CVC or expiry date. Those are submitted directly to Stripe on Stripe's own infrastructure.
3. Cookies and tracking
This site sets no advertising or third-party analytics cookies. Your cart is kept in your browser's own local storage — it never reaches us until you press pay, and clearing your browser data deletes it. Because we set no non-essential cookies, there is no consent banner to click through.
4. Who we share it with
Only the processors required to run the service:
- Stripe — payment processing. Receives your email and billing details.
- Cloudflare — hosting and content delivery. Processes request metadata.
- Our email provider — to deliver receipts and your file.
We do not sell, rent or trade customer data. We do not share it for anyone else's marketing.
5. How long we keep it
- Order and invoice records: 7 years, as required by tax law.
- Delivered files: 90 days, so we can re-issue a lost download link, then deleted.
- Contact form messages: 24 months.
- Server logs: 30 days.
6. Your rights
Depending on where you live you may have the right to access, correct, delete, restrict or port your personal data, to object to processing based on legitimate interest, and to withdraw consent at any time. Under GDPR you also have the right to complain to your supervisory authority.
To exercise any of these, email hello@organictraffic.io. We respond within 30 days and there is no charge. Note that we may need to keep invoice records even after a deletion request, because tax law requires it.
7. International transfers
Our processors may handle data outside your country, including in the United States. Where that happens, transfers are covered by Standard Contractual Clauses or an equivalent approved mechanism.
8. Security
The site is served over TLS. Payment data is handled entirely by a PCI-DSS Level 1 processor. Access to order records is restricted to people who need it to fulfil or support orders. If a breach affecting your data occurs, we will notify you and the relevant authority within the legally required timeframe.
9. Children
This is a business-to-business service and is not directed at anyone under 18. We do not knowingly collect data from children.
10. Changes
Material changes will be reflected in the “last updated” date above and, where the change affects you meaningfully, notified by email.