Skip to content
TAIO

Legal

Privacy Policy

How TAIO® collects, uses and protects personal data, under the EU General Data Protection Regulation (GDPR) and Portuguese Law 58/2019.
Draft — not legal advice. This text is a starting template for a store run from Portugal and selling to consumers in the EU. It must be reviewed by a qualified professional before launch. Fields in brackets still need to be completed in Admin → Settings.

1. Who is responsible

The data controller is [Owner's legal name or company], [Registered address in Portugal], NIF/VAT [NIF / VAT number]. Contact for any privacy matter: [Contact email].

2. What we collect and why

  • Discord account data — your Discord user ID, username, display name and avatar, received when you log in with Discord. We request only the identify scope: we do not receive your email address, servers, friends or messages. Purpose: creating and running your account. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
  • Orders and payments — what you bought, prices, discount codes, the payment provider's transaction references and, if the provider shares it, the email address used for the receipt. We never see or store your full card or PayPal credentials. Purpose: delivering products, receipts, refunds and accounting. Legal basis: contract and legal obligation (Art. 6(1)(b) and (c)).
  • Library and download records — which files you downloaded and when, with a truncated, salted hash of your IP address. Purpose: securing paid files and preventing abuse. Legal basis: legitimate interest (Art. 6(1)(f)).
  • Content you create — reviews, favorites, profile bio and visibility choices, support messages.
  • Session and security data — login sessions (browser type and a hashed IP), and audit records of administrative actions.
  • Newsletter — only if you opt in: your email address and the time and wording of your consent. Legal basis: consent (Art. 6(1)(a)), which you can withdraw at any time.

We do not use advertising trackers, sell personal data, or build marketing profiles.

3. Who we share data with

Only with service providers needed to run the store, each bound by a data processing agreement:

  • Discord (login) — Discord Inc., USA.
  • Stripe and/or PayPal (payments) — act as independent controllers for payment data.
  • [Hosting provider and region], [Database provider], [File storage provider], [Email provider].

Where a provider is outside the European Economic Area, transfers rely on the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses.

4. How long we keep data

  • Account data: while your account exists. Deletion requests are processed within one month.
  • Orders, invoices and payment records: 10 years, as required by Portuguese tax and accounting law. They are kept in anonymised form after account deletion.
  • Sessions: up to 30 days of inactivity. Download logs: [e.g. 24 months].
  • Newsletter: until you unsubscribe.

5. Your rights

You can access, correct, export, restrict or delete your data, object to processing based on legitimate interest, and withdraw consent. Most of this is self-service in Account: download a copy of your data, end sessions, change visibility, or request deletion. For anything else, contact [Contact email].

You may also complain to the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD), at www.cnpd.pt.

6. Cookies

We use only cookies needed for the site to work. See the Cookie Policy.

7. Security

Connections are encrypted (HTTPS). Session tokens are stored only as one-way hashes. Paid files are kept in private storage and delivered through short-lived signed links checked against your ownership.

8. Children

TAIO is not directed at children under 13, the minimum age for a Discord account. Under Portuguese law, consent-based processing for users under 13 requires parental authorisation.

9. Changes

We will announce material changes on this page and, where appropriate, by notification in your account.

Last updated: 27 October 2026