1. Controller
Data controller: PrankShit Unlimited Ltd., trading as PrankShit, 42 Meme Harbour, Prank Bay, PBK 4040, Malta, Malta.
Privacy requests: privacy@prankshit.com.
2. Data we process
Account data may include email, display name, locale, verification status and security metadata.
Order data includes purchased products, totals, promo codes, payment-provider identifiers and fulfillment records. Full payment-card data is handled by Stripe and is not stored by PrankShit.
Unlock security data may include hashed device tokens, usage events, generator identifiers, violation history and hashed network/security identifiers.
Affiliate data may include affiliate code, commission records, social links, suggestions and the PayPal email supplied for payouts.
Product reviews may include your rating, comment and display name; only reviews from verified paid purchasers are publishable after moderation.
Download records include entitlement identifiers, quota/count, expiry and a hash of the private download token.
3. Purposes and legal bases
Data is used to perform contracts, deliver digital products, manage accounts, prevent abuse and fraud, process payouts, answer support requests and comply with legal obligations.
Depending on the processing, the legal basis may be performance of a contract, compliance with a legal obligation, legitimate interests in security/abuse prevention, or consent where required.
4. Recipients and processors
Relevant providers may include Stripe for payment processing, PayPal for affiliate payouts, Hostinger for hosting, the configured SMTP/email provider, and Google reCAPTCHA where the security feature is enabled.
Each provider processes data under its own terms and applicable data-protection obligations.
5. International transfers
Some service providers may process data outside your country. Where required, appropriate legal transfer mechanisms must be used by the relevant controller or processor.
6. Retention
Account data is retained while the account is active and may be retained afterwards where necessary for security, dispute handling or legal obligations.
Order, payment and accounting records are retained for the period required by applicable law.
You can delete your account from the dashboard. Account/profile/security data is erased or anonymised where possible; transaction, accounting, contractual or anti-fraud records may be retained where a legal or overriding retention requirement applies.
Operational security records are periodically cleaned according to configured retention rules; some records may be kept longer when needed to investigate abuse or legal claims.
7. Your rights
Subject to applicable law, you may request access, rectification, deletion, restriction, portability or objection, and may withdraw consent where processing relies on consent.
To exercise rights, contact privacy@prankshit.com. You may also lodge a complaint with the competent data-protection authority.
8. Security
PrankShit uses measures including password hashing, CSRF protection, secure sessions, server-side payment webhooks, hashed device/download identifiers, encrypted email-outbox payloads and restricted private storage.