Last updated: September 20, 2026

1. Data Controller The data controller responsible for your personal information is:

Business name: Sandwhich Contact email: [email protected] If you are located in the EU/EEA and have data protection questions, you may contact us at the email above. We will respond to your inquiry and, where required, assist in routing your request to the appropriate contact.

2. Scope This Privacy Policy applies to Sandwhich and related checkout, account, support, and fulfillment workflows that link to or reference this policy. For details about our use of cookies and tracking technologies, please also see our Cookie Policy.
3. Information We Collect We may collect the following categories of information:

Account information: email address, account identifiers, and related sign-in/session data used to authenticate you. Order and customer information: items purchased, pricing, currency, order status, refunds, transaction references, delivery status, and customer records. Payment information: checkout and payment metadata, payment status, and processor reference IDs. Full card details and similar sensitive payment credentials are processed by our payment partners rather than stored directly by Sandwhich. For cryptocurrency payments, we may receive wallet address fragments, payment status, and transaction hashes. Support and communications: messages you send to us, including support requests, refund requests, screenshots, logs, and related correspondence. Usage and device data: IP address, browser type, device information, timestamps, session activity, and similar diagnostic and security information collected by our platform provider to operate the site and screen for fraud. Affiliate and referral data: referral codes and related attribution data used to track partner referrals. 4. How We Use Information We use personal information to:

provide and operate the site and related services; create and secure accounts and authenticate returning users; process purchases, confirm payments, and deliver digital products; maintain order history, customer records, and refund workflows; detect fraud, abuse, payment risk, or security incidents; respond to support requests and troubleshoot technical issues; maintain site performance, security, and stability; attribute referrals, discounts, and affiliate activity; send transactional emails related to your orders and account; and comply with legal obligations, including anti-money-laundering requirements where applicable, and enforce our policies. 5. Legal Bases for Processing (GDPR) If you are located in the EU/EEA/UK, we process your personal information on the following legal bases:

Contract performance (GDPR Art. 6(1)(b)): to create your account, process orders, deliver products, handle refunds, and provide support. Legitimate interests (GDPR Art. 6(1)(f)): to detect and prevent fraud, secure the platform, improve site performance, and enforce our terms. We balance these interests against your rights and freedoms. Legal obligation (GDPR Art. 6(1)(c)): to comply with tax, accounting, anti-money-laundering, and other legal requirements. 6. Cookies and Browser Storage We use only essential cookies, local storage, and session storage — the kind required to keep you signed in, protect the checkout against fraud, remember your cart and affiliate referral, and make the site function. We do not use third-party analytics services, advertising pixels, or cross-site tracking technologies on the site.

Because these cookies are strictly necessary for the site to work, they do not require consent and cannot be disabled without breaking core functionality. You can still clear them at any time through your browser settings. For details on the specific cookies used, see our Cookie Policy.

7. Service Providers and Payment Processors We share information with the service providers and payment processors listed below, only as reasonably necessary to run the Services, process transactions, deliver products, or protect the platform. Each provider acts as our data processor or, where it determines its own purposes for processing, as an independent controller, and is bound by its own privacy practices. The list below is current as of the "last updated" date at the top of this policy and may change as our stack evolves.

(a) Platform, hosting, storefront, order processing, and cryptocurrency payments — SellAuth (sellauth.com).

SellAuth hosts and operates our storefront and checkout, account sign-in and sessions, order and customer database, product delivery, transactional emails (order confirmations, delivery notices, and support correspondence), built-in fraud screening, sales reporting for our own use, and our gateway for cryptocurrency payments. When you use the site or place an order, SellAuth receives and processes: your email address and account/session data; product selections, order amounts, pricing, currency, delivery metadata (for example, the destination for a key, file, or credential), affiliate or referral codes, and transaction status; usage and device data such as IP address, browser type, and timestamps; and — for fraud screening — VPN or proxy signals, disposable-email signals, device fingerprints, and similar risk data. For cryptocurrency payments, SellAuth additionally receives the selected cryptocurrency, the receiving wallet address, payment status, and transaction hashes. SellAuth's processing is governed by its own privacy practices, available at sellauth.com.

(b) Card payments — Square (Block, Inc.).

We use Square to process credit and debit card payments. Square receives transaction amount, currency, processing and chargeback metadata, billing address, payment-method identifier (such as the last four digits of a card and the card brand), and risk-screening data including IP address, device fingerprint, and behavioral signals. Full card numbers, CVV codes, and similar sensitive credentials are tokenized within Square's PCI-compliant environment — we do not receive or store them. Square's processing is governed by its own privacy practices, available at squareup.com.

(c) PayPal — PayPal Holdings, Inc.

Where you select PayPal at checkout, your payment is processed by PayPal under its own User Agreement and Privacy Statement. PayPal receives the transaction amount, currency, your PayPal account identifier, the merchant reference for your order, and any other data you authorize PayPal to share with us under your PayPal account settings. We may receive back from PayPal a transaction reference, payment status, the payer email address, the payer name, the shipping address (if provided), and dispute or claim metadata where applicable. PayPal's processing is governed by its own privacy statement, available at paypal.com.

(d) Other service providers.

Discord, Inc., where you choose to interact with us through our Discord server for support, community, or order-linked roles. Discord receives whatever you post or send there under its own privacy policy.

We do not sell your personal information. We may disclose information when required to comply with law, respond to lawful requests, protect our rights or users, investigate fraud, defend a chargeback or payment dispute (see our Terms of Service and Refund Policy), or support a merger, sale, financing, or asset transfer.

8. International Data Transfers Our service providers may process or store information in countries other than your own, including the United States. When personal information is transferred from the EU/EEA/UK to a country without an adequacy decision, we rely on appropriate safeguards, such as:

the EU-US Data Privacy Framework (where the provider is certified); Standard Contractual Clauses (SCCs) approved by the European Commission; or other transfer mechanisms permitted under GDPR Chapter V. You may contact us to request information about the specific safeguards applied to transfers of your data.

9. Data Retention We retain information for as long as reasonably necessary for the purposes described in this policy. Specific retention criteria include:

Account data: retained for the duration of your account and for up to 12 months after account deletion to handle disputes and comply with legal obligations. Order and transaction records: retained for up to 7 years to meet tax, accounting, and legal record-keeping requirements. Support correspondence: retained for up to 24 months after the last interaction, or longer if related to an ongoing dispute. Server and security logs: retained by SellAuth in accordance with its own retention practices. Affiliate and referral data: cookie-based data expires as described in our Cookie Policy; server-side records are retained as part of order records. 10. Security We use reasonable administrative, technical, and organizational measures to protect personal information, including encryption in transit, access controls, and regular security reviews. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

11. Your Rights and Choices Depending on where you live, you may have the following rights regarding your personal information:

Access: request a copy of the personal information we hold about you. Correction: request correction of inaccurate or incomplete data. Deletion: request deletion of your personal information, subject to legal retention requirements. Portability: request a machine-readable copy of data you provided to us. Objection: object to processing based on legitimate interests. Restriction: request restriction of processing in certain circumstances. Consent withdrawal: withdraw consent at any time where we rely on consent (this does not affect prior processing). To exercise any of these rights, email [email protected] from the address associated with your account or order, and include enough detail for us to verify and process your request. We will respond to verified requests within 30 days. If a request is complex, we may extend this by up to two additional months and will notify you of the extension.

EU/EEA/UK residents: You also have the right to lodge a complaint with your local data protection authority. A list of EU data protection authorities is available at edpb.europa.eu. UK residents may contact the Information Commissioner's Office (ICO).

12. California Privacy Rights (CCPA/CPRA) If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) provide you with additional rights:

Right to know: what personal information we collect, the sources, purposes, and third parties with whom it is shared. Right to delete: request deletion of personal information we collected from you. Right to correct: request correction of inaccurate personal information. Right to opt-out of sale/sharing: we do not sell your personal information, and we do not share it for cross-context behavioral advertising. Because we do not engage in either activity, there is nothing to opt out of. Right to non-discrimination: we will not discriminate against you for exercising your privacy rights. Categories of personal information collected: identifiers (email, IP address), commercial information (order history, transaction details), and internet activity (session and security data).

To exercise your CCPA/CPRA rights, email [email protected] with the subject line "California Privacy Request."

13. Marketing Communications Sandwhich may send transactional emails related to your orders, account activity, and support requests. These are not marketing emails and are necessary for service delivery.

If we ever send promotional or marketing emails, we will do so only with your consent where required by law, and every marketing email will include a clear unsubscribe link. You can opt out of marketing emails at any time by clicking the unsubscribe link or emailing [email protected].

14. Children's Privacy The Services are not directed to persons under 18, and we do not knowingly collect personal information from persons under 18. If you believe a minor has provided personal information to us, please contact us so we can review and delete it where appropriate.
15. Changes to This Policy We may update this Privacy Policy from time to time by posting a revised version on this page. For material changes, we will make reasonable efforts to notify you at least 30 days before the changes take effect, using the email address associated with your account or through a prominent notice on the site. The updated version becomes effective when posted unless a later date is stated.
16. Contact Privacy requests, data subject rights requests, and formal complaints must be sent by email to [email protected] so that we can verify your identity and maintain a written record as required by applicable data protection law. For general, non-privacy questions, you may also open a support ticket in our Discord server at https://discord.gg/Pq4hSdaF5S, where our support team typically responds faster.