Privacy Policy

QuantumDev Labs ("the Studio," "we," "us") operates quantumdevlabs.dev (the "Site") and sells digital downloads through it. This policy explains what personal data we touch, why, and what rights you have over it. We have deliberately kept the data footprint small.

1. The short version

• The Site itself collects nothing about you. No analytics, no cookies (apart from a single localStorage entry for your dark/light theme preference), no tracking pixels, no advertising.
• When you buy an Artifact, Lemon Squeezy handles checkout as the Merchant of Record. They collect your payment information and billing email; we receive only the order summary and the email address used to deliver the file.
• Hosting is on Cloudflare Pages. Cloudflare logs request metadata (IP, user agent, timestamps) for security and abuse-prevention purposes per their standard policy.
• We don't sell, rent, or share your personal data with third parties. We don't profile you. We don't market to you unless you explicitly opt in.

2. What we collect, when

Buying an Artifact

Lemon Squeezy collects your name, email, billing address, and payment details to process the transaction and meet tax-collection obligations. They send us an order webhook containing your email and the order metadata so we can deliver the file. We store this in our transactional-email logs for record-keeping, customer support, and refund processing. We do not see your payment-card data, your full billing address, or anything Lemon Squeezy doesn't forward to us.

Emailing us directly

If you email [email protected], we keep the email thread for as long as the conversation is active and for a reasonable record-keeping window after. We don't add you to any mailing list from a support email.

Browsing the Site

The Site is a static site served by Cloudflare Pages. Cloudflare receives standard HTTP request metadata (your IP, user agent, request URL, timestamp) and uses it for caching, DDoS mitigation, and security. We do not run any analytics, A/B testing, heatmaps, or behaviour tracking on top of that. The only client-side state is a qdl-theme localStorage entry that remembers your dark-or-light preference; it's set only when you click the theme toggle and never leaves your browser.

3. Lawful bases for processing (GDPR)

• Performance of a contract: processing your order email and delivering the Artifact you bought.
• Legitimate interest: keeping minimal records of orders for accounting, fraud-prevention, and customer support.
• Legal obligation: tax-related record retention. Most of this falls on Lemon Squeezy as Merchant of Record.
• Consent: the localStorage theme preference, set only by your explicit action.

4. Subprocessors

The third parties we rely on to run the Site:

Service	What it processes	Purpose
Lemon Squeezy	Name, email, billing address, payment details	Checkout · tax · receipts (Merchant of Record)
Cloudflare Pages	Request metadata (IP, headers, timestamps)	Hosting · CDN · DDoS mitigation
Google Fonts	IP and user-agent on font request	Loading the site's typefaces
Transactional email sender (TBD)	Your order email + the order summary	Delivering the Artifact ZIP

Each of these has its own privacy policy. We choose providers that offer GDPR-compliant data processing agreements where applicable.

5. International data transfers

Lemon Squeezy is US-based; Cloudflare operates a global edge network. If you're in the EU/UK/Switzerland, your data may be processed outside your jurisdiction. We rely on each provider's standard contractual clauses (or equivalent) to keep these transfers compliant.

6. Retention

We keep order summary records (email, order ID, product purchased, date) for as long as required by tax/accounting rules in our operating jurisdiction, then delete them. Support email threads are retained for up to two years from the last reply. Lemon Squeezy retains payment data per their own policy.

7. Your rights

Under GDPR (EU/UK/EEA)

You have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion ("right to be forgotten"), subject to legal-retention requirements
• Restrict processing
• Data portability — receive your data in a machine-readable format
• Object to processing based on legitimate interest
• Withdraw consent (e.g. clear your qdl-theme localStorage entry)
• Lodge a complaint with your local supervisory authority

To exercise any of these, email [email protected] with the email address you used to buy. We respond within 30 days.

Under CCPA/CPRA (California)

If you're a California resident, you have the right to:

• Know what personal information we collect and how we use it (this page)
• Request deletion of your personal information
• Opt out of the "sale" or "sharing" of personal information — note that we don't sell or share personal data with third parties for cross-context behavioural advertising, so there's nothing to opt out of
• Non-discrimination for exercising any of these rights

8. Children

We don't market to or knowingly collect data from anyone under 16. The product is sold to professional developers and businesses. If you believe a child has bought from us, email us and we'll process a refund and delete the record.

9. Security

The Site is served only over HTTPS. Lemon Squeezy is PCI-DSS compliant for payment processing. We use 2FA on the accounts that touch buyer data (Lemon Squeezy admin, email, hosting). No system is 100% secure; if a breach affects buyer data, we'll notify affected buyers without undue delay and within timelines required by applicable law.

10. Changes to this policy

We may update this policy. The "Last updated" date at the top reflects the most recent change. For material changes, we'll post a notice on the homepage and notify buyers by email if the change affects how their data is handled.

11. Contact

Privacy questions, data-subject requests, or anything else: [email protected]. Studio jurisdiction: Israel.