volqan

⚠️ LEGAL REVIEW NEEDED

Privacy Policy

Volqan Framework Effective Date: April 5, 2026 Last Updated: April 5, 2026

Data Controller: Sharif / ReadyPixels Contact: sharif@readypixels.com Project URL: https://volqan.link

1. Introduction and Scope

ReadyPixels (“Company,” “we,” “us,” or “our”), operator of the Volqan framework (https://volqan.link) and the Bazarix marketplace (https://bazarix.link), is committed to protecting the privacy of individuals who use our Platform. This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information in connection with your use of:

The Volqan framework and all @volqan/* npm packages;
The Bazarix marketplace and its associated services;
The Volqan documentation site hosted at https://volqan.link;
The License API at https://bazarix.link/api/v1/license;
Any other services operated by ReadyPixels (collectively, the “Platform”).

This Privacy Policy is incorporated into and forms part of our Terms of Service. By using the Platform, you agree to the collection and use of information in accordance with this Privacy Policy.

2. Data Controller and Contact

The entity responsible for the processing of your personal data under this Privacy Policy is:

ReadyPixels / Sharif Email: sharif@readypixels.com Data Subject Requests: sharif@readypixels.com (Subject line: “Privacy Request”)

For questions, concerns, or requests related to this Privacy Policy or your personal data, please contact us at the email address above.

3. Information We Collect

We collect information in the following categories:

3.1 Account and Identity Information

When you create an account on the Platform, we collect:

Email address — used for account authentication, transactional communications, support, and marketing (with consent);
Name — provided at registration, used for account identification and communications;
Username — chosen at registration, used as a public identifier on the Marketplace.

3.2 Installation and License Data

When you install and operate the Volqan framework:

Installation ID — a unique identifier generated automatically upon installation of the Software. This identifier is pseudonymous and is used to associate your installation with your license status, validate Support Plan subscriptions via the License API, and perform telemetry. The Installation ID is stored locally in your deployment and transmitted to the License API only during license validation checks.
License Key — if you have purchased extensions or themes from the Marketplace, the associated license key in the format MKT-[PRODUCT_ID]-[INSTALL_ID]-[EXPIRY_HASH] is stored and transmitted to the License API for validation.
Framework version — the version of Volqan installed, used for compatibility validation and analytics.

3.3 Payment and Billing Information

When you make a purchase or subscribe to a Support Plan:

Stripe Customer ID — a unique identifier assigned to you by our payment processor, Stripe, Inc. We store this identifier to associate your account with your Stripe records, manage subscriptions, and process refunds. We do not store your full credit card number, CVV, or bank account details — all payment card information is transmitted directly to and stored by Stripe.
Transaction history — records of your purchases and subscription payments, including amounts, dates, and Platform Service Fees paid;
Billing address — if provided at checkout, used for tax and invoicing purposes.

3.4 Usage Analytics

We collect pseudonymous analytics data to improve the Platform:

Framework telemetry — aggregated, non-personally identifiable data about feature usage patterns, extension activations, error rates, and performance metrics. Telemetry is tied to the Installation ID and is not linked to your email or identity without your separate consent;
Website analytics — standard web server logs, page views, referral sources, browser type, operating system, and general geographic location (country/region level). We do not use invasive cross-site tracking or behavioral advertising technologies;
API usage — request timestamps, endpoints accessed, and response codes for the License API, used for security monitoring and capacity planning.

3.5 Marketplace Seller Information

If you apply to become a seller on the Bazarix Marketplace, we additionally collect:

Stripe Connect account information — required to facilitate seller payouts via Stripe Connect;
Identity verification data — collected and processed by Stripe as required by Stripe’s KYC and AML obligations. ReadyPixels does not directly store government-issued identity documents;
Seller profile information — your display name, bio, website URL, and portfolio materials you choose to publish on the Marketplace.

3.6 Support and Communications

When you contact us for support:

Support correspondence — including emails, messages, and any attachments you provide;
Diagnostic information — logs, configuration data, or error reports you voluntarily share to facilitate troubleshooting.

3.7 Automatically Collected Technical Data

Log data — IP addresses, access times, browser user agents, referring URLs, and pages visited, retained in server logs;
Cookies and local storage — session cookies for authentication and preference storage. We do not use third-party advertising cookies.

4. How We Use Your Information

We process your personal data for the following purposes and under the following legal bases:

Purpose	Categories of Data	Legal Basis (GDPR)
Account creation and authentication	Email, name, username	Performance of contract
License validation and Attribution Notice control	Installation ID, Stripe Customer ID, License Key	Performance of contract, Legitimate interests
Processing payments and subscriptions	Stripe Customer ID, transaction history, billing address	Performance of contract
Delivering purchased products and services	Email, Installation ID, License Key	Performance of contract
Sending transactional emails (receipts, renewal notices)	Email	Performance of contract
Responding to support requests	Email, support correspondence	Legitimate interests
Platform analytics and product improvement	Installation ID, usage analytics, log data	Legitimate interests
Security monitoring and fraud prevention	IP addresses, log data, API usage	Legitimate interests, Legal obligation
Compliance with legal obligations	All applicable categories	Legal obligation
Sending marketing communications (with consent)	Email	Consent

We do not sell your personal information. We do not share your personal data with third parties for their independent marketing or advertising purposes. We disclose personal data only in the following limited circumstances:

5.1 Service Providers

We share personal data with third-party service providers who process data on our behalf and under our instructions:

Provider	Purpose	Data Shared
Stripe, Inc.	Payment processing, subscription management, Stripe Connect payouts	Email, Stripe Customer ID, transaction data
Supabase	Database hosting (Marketplace)	Account data, transaction records
Vercel	Platform hosting and deployment	Web server logs, request data
Cloudflare	Content delivery, R2 file storage	Files, request data
Algolia	Marketplace search indexing	Listing metadata, search queries
Resend	Transactional email delivery	Email address, email content

All service providers are contractually required to process data only as instructed by us and to maintain appropriate security standards.

5.2 Legal Requirements

We may disclose personal data when required to do so by law, subpoena, court order, or governmental authority, or when we reasonably believe disclosure is necessary to protect the rights, property, or safety of ReadyPixels, our users, or the public.

5.3 Business Transfers

In the event of a merger, acquisition, asset sale, or other business transfer involving ReadyPixels, personal data may be transferred as part of the transaction. We will notify you before your personal data is transferred and becomes subject to a different privacy policy.

5.4 Protection of Rights

We may disclose personal data to enforce our Terms of Service, investigate potential violations, and protect against fraud, including disclosure of information about individuals who have removed the Attribution Notice without a valid Support Plan.

6. Data Retention

We retain personal data for the following periods:

Category	Retention Period
Account data (email, name, username)	Duration of account + 3 years after account deletion
Installation ID and license records	Duration of active license + 3 years
Stripe Customer ID and transaction records	7 years from transaction date (tax and legal compliance)
Payment receipts and invoices	7 years (tax compliance under applicable law)
Support correspondence	3 years from last communication
Web server logs	90 days
License API logs	180 days
Usage analytics (pseudonymous)	2 years, then aggregated or deleted
Marketing consent records	Duration of consent + 5 years

After applicable retention periods expire, personal data is securely deleted or irreversibly anonymized. We may retain data for longer periods where required by applicable law or where necessary to resolve disputes or enforce agreements.

7. Your Privacy Rights

If you are located in the European Economic Area, the United Kingdom, or Switzerland, you have the following rights under the General Data Protection Regulation (“GDPR”) and applicable national implementing legislation:

Right of Access (Art. 15 GDPR): You may request a copy of the personal data we hold about you.
Right to Rectification (Art. 16 GDPR): You may request correction of inaccurate or incomplete personal data.
Right to Erasure (Art. 17 GDPR): You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent (if processing was based on consent), or where processing is otherwise unlawful. Note that certain data may be retained to comply with legal obligations.
Right to Restriction of Processing (Art. 18 GDPR): You may request that we restrict processing of your personal data in certain circumstances.
Right to Data Portability (Art. 20 GDPR): Where processing is based on consent or contract and carried out by automated means, you may request receipt of your personal data in a structured, commonly used, machine-readable format.
Right to Object (Art. 21 GDPR): You may object to processing of your personal data based on legitimate interests. We will cease such processing unless we demonstrate compelling legitimate grounds.
Right to Withdraw Consent: Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.
Right to Lodge a Complaint: You have the right to lodge a complaint with your local data protection supervisory authority.

7.2 Rights Under CCPA/CPRA (California Residents)

If you are a California resident, the California Consumer Privacy Act (“CCPA”) as amended by the California Privacy Rights Act (“CPRA”) grants you the following rights:

Right to Know: You have the right to know what personal information we collect, use, disclose, or sell (we do not sell personal information).
Right to Delete: You have the right to request deletion of personal information we have collected from you, subject to certain exceptions.
Right to Correct: You have the right to request correction of inaccurate personal information.
Right to Opt-Out of Sale/Sharing: We do not sell or share personal information for cross-context behavioral advertising. No opt-out mechanism is required, but you may contact us to confirm our practices.
Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights.
Shine the Light: California Civil Code § 1798.83 permits California residents to request information about disclosure of personal information to third parties for their direct marketing purposes. We do not disclose personal information for such purposes.

Categories of personal information collected (CCPA categories):

Identifiers (email, username, IP address, Installation ID)
Commercial information (purchase history, subscription records)
Internet or other electronic network activity information (usage analytics, log data)
Inferences drawn from the above (license status, subscription tier)

7.3 How to Submit a Privacy Request

To exercise any of the rights described in this Section 7, please submit a request by:

Email: sharif@readypixels.com (Subject line: “Privacy Request — [Right Requested]”)

We will respond to verified requests within:

GDPR: 30 days of receipt (extendable by a further 60 days where necessary, with notice)
CCPA: 45 days of receipt (extendable by a further 45 days where necessary, with notice)

We may require you to verify your identity before processing your request. We will not charge a fee for reasonable requests but may charge a reasonable fee or decline to act on requests that are manifestly unfounded or excessive.

8. No Sale of Personal Data

ReadyPixels does not sell, rent, trade, or otherwise transfer your personal information to third parties for monetary or other consideration. We do not share your personal data with advertisers, data brokers, or any entity for the purpose of profiling, targeted advertising, or commercial exploitation of your information.

9. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, disclosure, alteration, and destruction, including:

Encryption of data in transit using TLS 1.2 or higher;
Encryption of sensitive data at rest;
Access controls limiting data access to authorized personnel with a need to know;
Regular security assessments and vulnerability monitoring;
Incident response procedures for detecting and responding to data breaches.

No method of transmission over the Internet or method of electronic storage is 100% secure. While we use commercially reasonable measures to protect your data, we cannot guarantee absolute security.

10. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:

GDPR: Notify the relevant supervisory authority within 72 hours of becoming aware of the breach, and notify affected data subjects without undue delay where the breach is likely to result in high risk to their rights and freedoms;
CCPA/US law: Notify affected California residents of a breach of their unencrypted personal information in accordance with California Civil Code § 1798.82 and applicable breach notification laws.

11. International Data Transfers

ReadyPixels is operated from the United States. If you are accessing the Platform from outside the United States, your personal data may be transferred to, stored in, and processed in the United States, where data protection laws may differ from those in your jurisdiction.

For transfers of personal data from the European Economic Area, United Kingdom, or Switzerland to the United States, we rely on applicable transfer mechanisms, which may include Standard Contractual Clauses approved by the European Commission, where required. We contractually require our service providers to maintain appropriate safeguards for international data transfers.

12. Children’s Privacy

The Platform is not directed to individuals under the age of sixteen (16). We do not knowingly collect personal information from children under 16. If we become aware that we have collected personal information from a child under 16 without verified parental consent, we will take steps to delete such information. If you believe we have inadvertently collected information from a minor, please contact us at sharif@readypixels.com.

13. Cookies and Tracking Technologies

We use the following types of cookies and similar technologies:

Type	Purpose	Retention
Strictly Necessary Cookies	Session management, authentication state, CSRF protection	Session duration
Preference Cookies	Language and display preferences	1 year
Analytics Cookies (first-party)	Understanding usage patterns for product improvement	2 years

We do not use third-party advertising cookies, cross-site tracking pixels, or behavioral advertising technologies. You may disable cookies through your browser settings, though this may impair the functionality of the Platform.

14. Links to Third-Party Services

The Platform may contain links to third-party websites, services, or resources. This Privacy Policy does not apply to those third-party services. We encourage you to review the privacy policies of any third-party services you access through the Platform.

15. Changes to This Privacy Policy

We reserve the right to modify this Privacy Policy at any time. We will notify you of material changes by posting the updated policy on the Platform and, where required by law, by sending notice to your registered email address. The “Last Updated” date at the top of this policy reflects the date of the most recent revision. Your continued use of the Platform following the effective date of the revised policy constitutes acceptance of the changes.

16. Contact Information

For all privacy-related inquiries, requests, or complaints, please contact:

ReadyPixels / Sharif Email: sharif@readypixels.com Subject Line: Privacy Request Project URL: https://volqan.link

We will endeavor to respond to all legitimate privacy inquiries within the timeframes specified in Section 7.3.

This site is open source. Improve this page.