PRIVACY POLICY

Data Controller: Kadmium (Emil Fredrik Sjöstedt, Enskild firma, Sweden) 

Contact Email: legal@kadmium.dev 

Website: https://www.kadmium.dev

Kadmium ("we", "our", or "us") respects your privacy and is committed to protecting your personal data in compliance with the General Data Protection Regulation (GDPR) and applicable data protection laws. This Privacy Policy explains how we collect, use, and handle data across our website, technical consulting services, software products, developer tools, and video games.

1. INFORMATION WE COLLECT

1.1 Purchases, B2B Invoicing & Service Retainers (Stripe & Gumroad):

• Direct B2B Sales & Consulting (Stripe & Wise): For direct B2B transactions, architecture audits, retainers, and enterprise licensing processed via Stripe or bank transfer, we collect business contact details, full legal/company name, billing address, business email, VAT/Tax ID, and transaction history. Payment card details are processed directly and securely by Stripe; Kadmium never stores or has access to full payment card credentials.

• Digital Merchant Sales (Gumroad & Epic Games / Fab): Self-serve digital downloads may be managed by Gumroad, Inc. (acting as Merchant of Record) or third-party marketplaces. We receive order metadata (such as name, email, country, and product ID) to manage license entitlements, tax records, and customer support.

1.2 Consulting & Repository Access Data: For B2B engineering and audit clients, we may temporarily access or process repository code, engine logs, or project artifacts provided under non-disclosure agreements (NDAs) solely to perform contracted engineering services.

1.3 License Key Activation & Technical Verification: For compiled software tools, launchers, or applications requiring authorization, our licensing verification systems (including Kadmium Aegis) process license keys, basic API handshakes, and hashed machine identifiers (device fingerprints) strictly to authenticate your license tier, enforce seat limits, and prevent unauthorized distribution.

1.4 Customer Inquiries & Technical Support: When you submit bug reports, feature feedback, or licensing requests via our official support channels (e.g., support@kadmium.dev), we collect your email address, name, and any technical logs, screenshots, or information provided in your inquiry.

1.5 In-Game Diagnostics, Tool Analytics & Web Cookies:

• Diagnostics & Crash Logs: Our games, launcher, and developer applications may collect aggregated, non-identifiable telemetry and crash data (e.g., framerates, crash stack traces, engine events, OS build, graphics hardware). We do not collect Personally Identifiable Information (PII) through these diagnostics.

• Website Analytics & Cookies: Our website may use essential cookies and aggregated web analytics (such as Google Analytics) to monitor traffic patterns and maintain website security. You can manage or disable non-essential cookies through your browser settings.

2. LEGAL BASIS FOR PROCESSING (GDPR)

• Contract Performance (Art. 6(1)(b) GDPR): Processing is necessary to fulfill orders, deliver technical consulting services, issue download links, validate license keys, process invoices, and provide customer support.

• Legitimate Interests (Art. 6(1)(f) GDPR): Processing is necessary to inspect anonymized crash logs, resolve engine bugs, prevent software piracy/abuse, and maintain the security and functionality of our software ecosystem.

• Legal Obligation (Art. 6(1)(c) GDPR): Processing is necessary to maintain tax records, corporate VAT IDs, and transaction invoices in compliance with Swedish statutory accounting legislation (Bokföringslagen).

3. THIRD-PARTY SERVICES & SUB-PROCESSORS

We share data only with trusted third-party service providers acting as sub-processors or independent data controllers to deliver our services:

• Stripe, Inc.: Payment gateway, B2B invoicing engine, tax calculation, and fraud prevention processor.

• Wise Payments Limited: Business banking infrastructure, multi-currency processing, and global B2B wire transfers.

• Gumroad, Inc.: Merchant of Record handling consumer billing, digital product checkout, and VAT compliance for digital sales.

• Google LLC (Google Workspace, Google Analytics): Cloud infrastructure for domain email, file storage, and web analytics telemetry.

• Epic Games / Fab: Third-party marketplace operator for Unreal Engine assets and plugins (governed independently by Epic Games’ privacy policy).

4. INTERNATIONAL DATA TRANSFERS

Certain sub-processors (such as Stripe, Gumroad, and Google LLC) are based outside the European Economic Area (EEA), primarily in the United States. Where personal data is transferred outside the EEA, we ensure appropriate safeguards are in place, such as transfers relying on the EU-U.S. Data Privacy Framework or standard contractual clauses (SCCs) approved by the European Commission.

5. DATA SECURITY & RETENTION

5.1 Security Measures: We implement appropriate technical and organizational measures (including encrypted transport protocols, access controls, and hashed identifiers) to protect personal data against unauthorized access, loss, or alteration.

5.2 Retention Periods:

• Support Communications & Client Artifacts: Retained only as long as necessary to fulfill technical services, resolve inquiries, and maintain service history.

• Accounting & Transaction Metadata: Invoices, tax records, corporate VAT numbers, and transaction details are retained for seven (7) years in strict compliance with Swedish accounting legislation (Bokföringslagen).

• Diagnostics & Crash Logs: Anonymized metrics and technical traces are automatically aggregated or purged according to standard operational schedules.

6. YOUR RIGHTS UNDER GDPR

If you reside in the European Union (EU) or European Economic Area (EEA), you possess the following statutory rights under the GDPR:

• Access & Portability: The right to request access to the personal data we hold about you and receive a copy in a structured format.

• Rectification & Erasure: The right to request correction of inaccurate data or deletion of your customer support records.

• Restriction & Objection: The right to request that we restrict processing or object to processing based on legitimate interests.

• Complaint to Supervisory Authority: The right to lodge a complaint with a supervisory authority, specifically the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten – IMY, https://www.imy.se).

Please note: Because crash dumps, hardware telemetry, and device hashes are non-identifiable and cannot be tied back to an individual person, we cannot isolate or erase telemetry data on a per-user basis.

7. CHILDREN'S PRIVACY

Our products, software tools, and video games are not directed to children under thirteen (13) years of age (or under 16 in certain EU jurisdictions). We do not knowingly collect personal data from children. If you believe a child has provided us with personal information, please contact us immediately so we can delete the data.

8. CONTACT & DATA REQUESTS

To exercise your GDPR rights or submit inquiries regarding this Privacy Policy, please contact our Data Controller directly:

• Data Protection & Legal Inquiries: legal@kadmium.dev

• General Customer Support: support@kadmium.dev

• Direct Contact: Emil Fredrik Sjöstedt (emil@kadmium.dev)