PRIVACY POLICY
EpicStash · https://epicstash.eu
Effective date: 27 October 2026 · Version 2.1 (replaces the version of 22 August 2026)
SUMMARY
- What do you collect?: The data needed to take your order, deliver it, support you and prevent fraud.
- Do you sell data?: No.
- Do you use advertising trackers?: No. Only the cookies needed to keep you logged in and the site secure.
- Who sees my data?: Payment, delivery and infrastructure providers that run the store (Section 5).
- How long do you keep it?: Order records while the warranty and claim period runs; support records for 12 months; logs for 90 days.
- What are my rights?: Access, correction, erasure, restriction, portability, objection, and a complaint to a regulator (Section 8).
- Who do I contact?: support@epicstash.eu
1. WHO IS RESPONSIBLE FOR YOUR DATA
1.1 The controller of your personal data is the operator of EpicStash (https://epicstash.eu).
1.2 You can reach us for any privacy matter at support@epicstash.eu, or by opening a ticket on our Discord server (https://discord.gg/ZgNjMhb4ak).
1.3 This policy explains how we process personal data under the EU General Data Protection Regulation (Regulation 2016/679, "GDPR").
2. WHAT WE COLLECT, WHY, AND ON WHAT LEGAL BASIS
- E-mail address, Discord ID, account and authentication data - Purpose: Creating your account, giving access to your orders, contacting you about them. Legal basis (GDPR): Contract, Art. 6(1)(b).
- Order history, delivered products, delivery logs - Purpose: Delivering your order, warranty and replacements. Legal basis (GDPR): Contract, Art. 6(1)(b).
- Payment records: transaction ID, payment status, crypto transaction hashes and addresses - Purpose: Verifying payments, issuing refunds. Legal basis (GDPR): Contract, Art. 6(1)(b).
- IP address, browser and device data, session cookies - Purpose: Securing the site, blocking abuse and attacks, keeping you logged in. Legal basis (GDPR): Legitimate interest, Art. 6(1)(f).
- Fraud-screening data: signals from payment processors, order patterns, verification documents you provide - Purpose: Preventing payment fraud and abuse. Legal basis (GDPR): Legitimate interest, Art. 6(1)(f).
- Support tickets, Discord messages, evidence you send - Purpose: Handling claims, resolving disputes. Legal basis (GDPR): Contract, Art. 6(1)(b); legitimate interest, Art. 6(1)(f).
- Reviews and feedback you choose to publish - Purpose: Showing customer feedback. Legal basis (GDPR): Consent, Art. 6(1)(a).
2.1 We do not ask for more than we need. We never ask you to send card numbers to us. Card details are processed by the payment provider.
2.2 If you do not provide data we need for an order (for example, an e-mail address), we cannot complete it.
3. FRAUD PREVENTION AND AUTOMATED CHECKS
3.1 To protect you and us from payment fraud, card and crypto payments pass through automated risk checks run by our payment processors. If a check flags an order, we may ask you for additional verification, such as proof of payment or confirmation of ownership of the payment method.
3.2 A flagged order is reviewed by a person. We make no decision that has legal or similarly significant effect on you based only on automated processing. If an order is cancelled, you are refunded under our Refund & Replacement Policy.
4. COOKIES AND LOCAL STORAGE
4.1 We use only the cookies and local storage strictly necessary for logging in, keeping your cart and securing the site. These do not need your consent.
4.2 We do not use advertising, analytics-for-profit or cross-site tracking scripts. If that changes, we will ask for your consent first.
5. WHO RECEIVES YOUR DATA
We do not sell or rent personal data. We share it only as needed with the following categories of recipients, who act on our behalf or under their own legal obligations:
- Payment providers - Examples: Card and wallet payment processors, cryptocurrency payment services. Purpose: Processing and verifying payments.
- Order and delivery tools - Examples: Store software and automated webhooks. Purpose: Order processing and Delivery.
- Communication platforms - Examples: Discord. Purpose: Support tickets and community.
- Infrastructure and security - Examples: CDN, hosting and anti-DDoS providers. Purpose: Running and protecting the site.
- Fraud-prevention services - Examples: Risk and fraud databases. Purpose: Preventing chargeback abuse and fraud.
- Authorities and advisers - Examples: Courts, authorities and legal advisers. Purpose: Where the law requires or to defend legal claims.
6. TRANSFERS OUTSIDE THE EU/EEA
6.1 Some of the providers above are based in, or process data in, countries outside the EU/EEA, in particular the United States.
6.2 Where this happens, the transfer relies on a valid transfer mechanism under GDPR Chapter V: an adequacy decision (including the EU–US Data Privacy Framework for certified providers), or Standard Contractual Clauses. You can ask us for details at support@epicstash.eu.
7. HOW LONG WE KEEP DATA
- Account and order records: While your account is active, and for the period in which a warranty or statutory claim can still be made
- Support tickets and evidence: 12 months after the ticket is closed, unless a dispute is still open
- Server and security logs: 90 days, then deleted or anonymised
When a retention period ends, we delete or anonymise the data.
8. YOUR RIGHTS
You have the following rights. To use any of them, write to support@epicstash.eu. We answer within one month.
- Access to your personal data and a copy of it.
- Rectification of inaccurate or incomplete data.
- Erasure, unless we must keep the data by law or to defend a legal claim.
- Restriction of processing in the cases the law provides.
- Portability of data you gave us, in a structured, commonly used, machine-readable format.
- Objection to processing based on our legitimate interest.
- Withdrawal of consent at any time, where processing relies on consent. This does not affect processing before the withdrawal.
- Complaint to a supervisory authority. You may complain to the authority in the country where you live or work. In Hungary, this is the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH), https://www.naih.hu.
We may need to verify your identity before we act on a request, so that your data does not reach someone else.
9. SECURITY
9.1 We protect data with technical and organisational measures appropriate to the risk, including encrypted connections, access limited to those who need it, and use of reputable providers.
9.2 No system is perfectly secure. If a breach is likely to put your rights at risk, we notify you and the competent authority as GDPR requires.
10. AGE
EpicStash is not intended for people under 18. If you think a minor has given us personal data, tell us and we will delete it.
11. CHANGES
We may update this policy. The effective date and version number are at the top. If a change materially affects how we use your data, we tell you through your order page, by e-mail or on Discord before it takes effect.
12. CONTACT
- E-mail: support@epicstash.eu
- Discord: https://discord.gg/ZgNjMhb4ak (open a ticket)