Privacy Policy

1. Introduction

Welcome to Stenzila! We are committed to protecting your personal information and your right to privacy. This policy explains what information we collect, how we use it, and your rights when you use our web dashboard and platform.

2. Information We Collect

• Account Data: When a university club registers, we collect names, email addresses, and university affiliations.
• Authentication Data (Google API): If you sign in via Google, we access limited public profile information (Name, Email) to authenticate your session securely.
• Financial & Campaign Data: We process payment slips (e.g., LKR 1,500 registration receipts) and track webhook transaction metrics from our external stores.
• Customer Transaction Data: When an individual makes a purchase through a club's live campaign page, our webhooks securely collect their name, email address, the number of items purchased, specific item sizes, and the amount paid for pre-orders.
• Campaign Assets: Raw design files and mockups uploaded via Firebase Storage.

3. How We Use Your Information

We use your information strictly to provide and improve the Stenzila platform. This includes:

• Authenticating your account and managing sessions.
• Generating your live merchandise campaign links.
• Updating your dashboard with real-time sales metrics.
• Communicating with you regarding campaign approvals and payouts.

4. Google API Services Limited Use Disclosure

Stenzila's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We do not use Google user data for personalized advertising or commercial profiling.
• We do not sell or transfer your data to third-party data brokers.
• Human access to your data is strictly prohibited unless explicitly authorized by you for support purposes, or required for security and legal compliance.

5. Data Storage and Security

Your data is securely hosted on Google Cloud (Firebase). We use industry-standard encryption (AES-256 for data at rest and TLS 1.3 for data in transit) to protect your design assets, payment slips, and campaign data.

6. Data Retention and Deletion

We retain account data for as long as your club remains active. If you wish to terminate your account and delete your data, please contact us. Upon request, all OAuth tokens and associated profile data will be permanently deleted within 30 days.

7. Customer Data Access & Sharing

Customer transaction data collected from campaign webhooks is strictly siloed and compartmentalized. Access to this specific buyer data (names, emails, item specifics, and payment amounts) is restricted exclusively to Stenzila platform administrators and the authorized representatives of the specific club running the campaign. Stenzila does not sell this data to data brokers, nor do we share one club's customer data with any other club on the platform.

8. General Data Protection Regulation (GDPR) Compliance

For users, club representatives, or customers residing within the European Economic Area (EEA), Stenzila complies with the GDPR framework. You hold the following rights regarding your data:

• Right of Access & Portability: Request copies of your personal data and extract it in a machine-readable format.
• Right to Rectification: Request that we correct any information you believe is inaccurate.
• Right to Erasure: Request that we erase your personal data under certain conditions.
• Right to Restrict Processing: Object to or restrict our processing of your personal data.
• Legal Basis: We process data based on Consent, Contract Performance, and Legitimate Interests.

9. Integration of Third-Party Applications

• Google Authentication (OAuth): We utilize Google OAuth for secure sign-ins. Google shares authentication data (verified email, name) with our platform. Stenzila does not collect or store your Google account password.
• Firebase & Google Cloud: Session data, accounts, and assets are transmitted to and stored on Firebase.
• WooCommerce Webhooks: Secure webhooks from external e-commerce sites transmit transactional metrics to our platform.