GT3RS STORYLAP — Privacy Policy

Final approved publication version: 1.0 — 14 August 2026

Status: approved by the attorney according to the Operator's confirmation of 14 August 2026; publishable after Shopify's technical verification and controlled payment activation.

Operator: CIPY CAPITAL INVESTMENT S.R.L., IDNO 1025600037347 Registered office: MD-3901, Str. Piotr Rumeantev 29, Cahul, Republic of Moldova Website: https://gt3rs-storylap.club Privacy and support email: cci.trading.pro@gmail.com Official phone: +37378666668 Effective date: 14.08.2026

1. Purpose of this policy

This Policy explains what personal data we process when a person visits the Website, purchases a digital product, requests support, submits a nickname or interacts with the public GT3RS STORYLAP progress record.

The Operator determines the purposes and means of processing for its own activity. Shopify, Paynet, Cybersource, the acquiring bank, card networks, the digital-delivery application and other providers may have their own policies and legal roles. Exact roles, locations and transfers must be verified against the active contracts before publication.

2. Who the Operator is

CIPY CAPITAL INVESTMENT S.R.L.
IDNO: 1025600037347
Address: MD-3901, Str. Piotr Rumeantev 29, Cahul, Republic of Moldova
Email: cci.trading.pro@gmail.com
Phone: +37378666668

For questions about data, access, correction, deletion, withdrawal of consent, nicknames or complaints, write to the email above. We may request reasonable information to verify identity and protect an account, but never passwords or complete card details.

3. Categories of data we may process

Depending on the action taken, we may process:

• contact and order data: email, name, country, billing or delivery details if requested by checkout, purchased products, amount, currency, order status and order number;
• payment and fraud-prevention data sent to payment providers: transaction identifiers, authorization result, token or technical reference, and metadata needed for fraud prevention and refunds; we do not normally request or store the complete card number, CVV/CVC, PIN or payment password;
• digital-delivery data: link, fulfillment status, sending time, access and download limits;
• nickname, submitted text, publication consent, consent version, date/time, moderation status and withdrawal of consent;
• support messages, complaints, refund requests, chargebacks, proof of delivery and related communications;
• technical and security data: IP address, browser and device type, technical identifiers, logs, visited pages, security events and consent preferences, to the extent permitted by law;
• cookie and similar-technology data according to the category and choice made by the visitor.

Do not put a full name, phone number, email address, home address, identity-document number, VIN, registration number, bank data or another person's data in a nickname. If such data is submitted, we may remove, anonymize or restrict it.

4. Purposes and legal bases

We process data for the following purposes:

1. Website operation and security — to operate pages, prevent abuse, protect checkout and detect incidents; the basis is legitimate interest and, where necessary, consent.
2. Entering into and performing the order — to create the order, confirm payment, deliver the digital product, provide support and manage refunds; the basis is performance of the contract.
3. Payment and fraud prevention — to authorize, reconcile, refund, manage chargebacks and review transactions; the basis is performance of the contract, legal obligation and legitimate interest in preventing fraud.
4. Tax and accounting records — to document sales, payments, refunds and obligations to authorities; the basis is legal obligation.
5. Supporter Wall — to publish a nickname only after separate consent and moderation; the basis is consent. Purchase is not conditional on this consent.
6. Progress and internal reconciliation — to calculate and correct the public project meter, using aggregated or pseudonymized confirmed-sales data without publishing customer data; the basis is project administration and legitimate interest, within the limits of the law.
7. Commercial communications — only after consent or another legal basis permitted by law, with a simple and free unsubscribe method.
8. Analytics and marketing — only after consent where the law requires it. Optional cookies are not necessary for purchase.

We do not sell personal data and do not condition purchase on marketing consent, nickname publication or optional cookies.

5. Shopify, Paynet, Cybersource and other recipients

To operate the store, strictly necessary data may be sent or made available to the following recipients, depending on the active configuration:

• Shopify, for the store, checkout, orders, accounts, security and privacy tools;
• the Shopify Digital Products application, for attaching, sending and administering digital files;
• Paynet Services S.R.L., as payment-service provider under the active commercial contract;
• Cybersource and the technical and financial entities involved in authorization, reconciliation and refund flows under the active integration;
• the acquiring bank and card networks, including Visa and Mastercard, only to the extent necessary to process the transaction;
• email, hosting, security, backup, analytics or marketing providers actually activated in the store;
• the accountant, attorney, technical providers, installers and authorities, only to the extent necessary and permitted by law.

Before final publication, the Operator must complete the internal register with the exact name of every active provider, legal role, data processed, country, retention period, international transfer and policy link. Applications or trackers that are not active must not be listed, and active providers must not be omitted.

6. International transfers

Shopify, payment, email, hosting or active application providers may process data outside the Republic of Moldova or the European Economic Area. In that case, transfers will be made only with the safeguards, legal bases and notices required by applicable law. Exact details are completed after reviewing contracts, subprocessor lists and the regime applicable to EU/EEA customers.

7. Supporter Wall and nicknames

A nickname becomes public only if the person has checked separate consent, payment has been confirmed, the format has passed validation and moderation has approved publication.

We do not publish email, legal name, address, order number, transaction identifier or card data. We may display the nickname and, where separate consent exists, a general area chosen by the person. We do not publish an exact location.

Withdrawal is requested at cci.trading.pro@gmail.com with the subject “Nickname withdrawal”. We will remove or anonymize a nickname from public surfaces controlled by us within a reasonable operational period, with a target of 7 calendar days, except where a security review is required. Internal records may be retained where necessary for accounting, fraud, refund, litigation or legal obligations.

8. Cookies and similar technologies

We use strictly necessary cookies for the cart, checkout, security and remembering the consent preference. Analytics, advertising and marketing cookies are activated only after the relevant choice where the law requires consent.

The banner must offer equivalent choices: Accept all, Reject optional cookies and Cookie settings. Withdrawal must be at least as easy as giving consent. Strictly necessary cookies do not require consent if they are genuinely necessary for the requested service.

The final public inventory will include, for each active vendor: name, cookie/pixel, purpose, duration, category, country, policy link and withdrawal mechanism. Trackers that bypass the consent preference will not be loaded.

9. Data retention

We retain data only as long as necessary for the purpose for which it was collected, order performance, support, refund, chargeback, fraud prevention, accounting, tax obligations and the defence of rights.

Data is retained only for periods established by applicable law and relevant legal/accounting standards for the category of data: the period needed for order performance and support, mandatory periods for accounting, tax, fraud prevention, refund and chargeback, and periods needed to defend rights. After the applicable period expires, data will be deleted, anonymized or restricted, except for backups overwritten in the normal cycle and records that the law requires us to keep.

10. Individual rights

Subject to applicable law, a person may request information, access, correction, deletion, restriction, objection, portability, withdrawal of consent and, where relevant, information about an automated decision.

Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal. Withdrawal does not require the Operator to delete data that it must retain by law and does not automatically erase an order or transaction record.

Requests should be sent to cci.trading.pro@gmail.com. We will respond within the period required by applicable law after a reasonable identity check. A person may complain to the competent authority in their country or the relevant Moldovan authority, including CNPDCP where it is the competent authority.

11. Security and incidents

We apply reasonable technical and organizational measures: limited access, authentication, updates, application controls, logs, separation of public and internal data and incident procedures. No transmission over the internet can be guaranteed to be absolutely secure.

In the event of a relevant incident, the Operator will assess the situation and notify authorities or affected persons where the law requires it.

12. Minors

The Website is not intended for the deliberate collection of data from children. If a parent or legal representative believes that a child has submitted personal data, they should contact the Operator at cci.trading.pro@gmail.com. We will review the situation and delete the data where there is no legal basis to retain it.

13. Changes to this policy

The applicable version is the version published when the relevant data was collected or processed. For material changes, we will publish a new version and effective date. If the law requires an additional notice or new consent, we will request it.

Version: 1.0
Date: 14.08.2026
Email: cci.trading.pro@gmail.com
Phone: +37378666668

Appendix A — Governance and update checks

• the actual inventory of Shopify applications and active pixels;
• the exact email and hosting provider;
• the contractual roles of Paynet/Cybersource/Shopify and the relevant subprocessor list;
• international transfers and applicable safeguards;
• retention periods applied according to applicable law and relevant legal/accounting standards for each category, with periodic internal review;
• the competent authority and final rights wording under applicable law at the publication date;
• official phone number: +37378666668.