Privacy Notice

TOSSELL WEB SOLUTIONS LTD, company number 15047802, trading as Stompset, is the controller of personal data used to operate this website and service. Its registered office is 82 Heol Isaf, Radyr, Cardiff, Wales, CF15 8EA. It is registered with the Information Commissioner's Office under registration reference ZB732523. Privacy questions and rights requests can be sent to hello@stompset.com.

• Account data, including your email address, authentication details, account identifier, and optional Google profile information.
• Creator data, including storefront details, profile links, product content, uploads, payout onboarding status, and support messages.
• Purchase data, including buyer email, product, release, price, currency, order status, Stripe identifiers, and download history. Stompset does not receive your full payment card number.
• Reviews and moderation data, including ratings, review text, reports, and related actions.
• Usage and technical data, including product views, purchases, downloads, IP address and request logs used for security, diagnostics, and service operation.

We receive data directly from you, automatically when you use the service, and from providers involved in your chosen activity. These may include Google when you use Google sign-in, Stripe when you pay or connect a payout account, and creators when they respond to an order or support issue.

• To create accounts, publish storefronts, process orders, provide downloads and updates, and manage subscriptions and payouts where necessary to perform our contract with you.
• To prevent fraud, secure the service, diagnose faults, understand aggregate product activity, moderate content, and improve Stompset where necessary for our legitimate interests and those of our users.
• To maintain financial, transaction, and compliance records where necessary to meet legal obligations.
• To send service messages about purchases, releases, account security, and material service changes. We will seek consent where the law requires it for optional marketing.

We use service providers to operate Stompset, including:

• Creators receive the buyer email and order details needed to support purchases of their products and maintain their customer records.
• Supabase for authentication, database services, and file storage;
• Stripe for checkout, subscriptions, fraud checks, and payouts;
• Vercel for website hosting, delivery, and operational logs;
• Brevo for transactional email delivery; and
• Google when you choose Google authentication.

We may also share data with professional advisers, regulators, law enforcement, or a party involved in a business reorganisation where there is a lawful reason. We do not sell personal data.

Some providers may process data outside the United Kingdom. Where required, we rely on an applicable adequacy decision or contractual and organisational safeguards designed to protect the transferred data. Contact us if you would like more information about safeguards relevant to your data.

We keep personal data only for as long as needed for the purposes in this notice. Account and storefront data is generally kept while an account is active. Purchase, payout, tax, fraud-prevention, and dispute records may be kept longer to meet legal, accounting, and enforcement needs. Security logs and unsuccessful uploads are retained for shorter operational periods unless they are needed to investigate an issue.

We consider the data's sensitivity, the reason it was collected, legal limitation periods, and whether it can be deleted or anonymised when setting retention periods.

Depending on the circumstances, you may have rights to access, correct, erase, restrict, or receive a copy of your personal data, and to object to certain processing. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing.

Contact us to exercise a right. We may need to verify your identity. You can also complain to the UK Information Commissioner's Office. We would appreciate the opportunity to address your concern first.

Stompset uses authentication and security cookies needed to provide requested account features. See our Cookie Notice for details. We use access controls, signed downloads, and other technical and organisational measures designed to protect personal data, but no online system can guarantee absolute security.

We may update this notice when our service, providers, or legal duties change. We will show the new effective date and version here and give additional notice where a change materially affects registered users.