Privacy Policy

Controller

The controller responsible for the processing of personal data within the meaning of the General Data Protection Regulation (GDPR) is:

Address

c/o Postflex #10142
Emsdettener Str. 10
48268 Greven
Germany

Email

Kurexaisupport13@proton.me

Website

www.kurexai.shop

General principles

2.1 Data minimization

We process personal data only where necessary to provide our services, fulfill legal obligations, or on the basis of consent. Access to our website and use of the software are generally possible without providing personal data — except for information strictly required for contract processing.

2.2 Pseudonymous license keys

Our software licenses are designed to operate via a pseudonymous license key. Personal data is not transmitted to third parties via the license.

2.3 No profiling

We do not engage in cross-site tracking, personalized advertising, or profiling within the meaning of Art. 22 GDPR.

Hosting & server logs

Our website is hosted with an EU-based hosting provider (GDPR-compliant, ISO 27001 certified). When you access the website, the following data is automatically recorded in server logs:

• IP address (anonymized after 24 hours, stored with truncation of the last octets)
• Date and time of access
• Page or resource accessed
• HTTP status code & volume of data transferred
• Referrer (if present)
• User agent (browser identifier)

Purpose: Provision of the web server, security monitoring, defense against attacks (in particular DDoS, brute force).
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a functional and secure web server).
Retention period: Maximum 14 days, then automatic deletion.

Cookies & local storage

We use exclusively technically necessary cookies and local storage entries required for the operation of the website and shop. These are consent-free pursuant to Section 25(2) No. 2 TTDSG.

We do not use tracking cookies, advertising cookies, Google Analytics, Meta Pixel, or third-party trackers on this website.

Order processing

5.1 Data collected

When you place an order, we collect:

• Email address (for license delivery & order confirmation)
• Discord username (optional, to activate the support channel)
• Payment information (processed exclusively by the payment service provider)
• Billing address (only where tax law requires invoicing for orders >€250)
• Order timestamp & confirmed terms version

Purpose: Performance of the contract and pre-contractual measures (Art. 6(1)(b) GDPR), fulfillment of statutory retention obligations (Art. 6(1)(c) GDPR in conjunction with Sections 147 AO, 257 HGB).

Retention period: 10 years for tax-relevant data (statutory requirement), then automatic deletion. Non-tax-relevant data is deleted 24 months after the end of the license.

5.2 Data minimization

We do not require a full legal name for the order process. A complete billing address is only required for orders over €250 under tax law.

Payment service providers

We use the following providers to process payments. When you select a payment method, the required data is transmitted directly to the respective provider. We do not store complete credit card, PayPal, or crypto wallet data ourselves.

Legal basis: Art. 6(1)(b) GDPR (contract performance).

Discord integration

If you provide a Discord username during the order process, we transmit it to our Discord server bot to automatically invite you to the customer channel. This transmission occurs only after your express input.

Discord Inc. is a US provider. Data transfers to the USA are based on the EU-US Data Privacy Framework (DPF). Discord's privacy policy is available at discord.com/privacy.

Legal basis: Art. 6(1)(b) GDPR (contract performance) and Art. 6(1)(a) GDPR (consent by providing the Discord tag).

Software telemetry

For license validation and update delivery, the Kurex software transmits the following data to our servers:

• License key (pseudonymous, no personal reference)
• Software version & AI model used
• Hardware fingerprint (hash value, to prevent license sharing)
• Operating system version

We do not collect information about:

• which games you play
• screen content or screenshots
• inputs, mouse movements, or game results
• other software installed on your system

Processing is carried out for contract performance (Art. 6(1)(b) GDPR) and to protect legitimate interests against license abuse (Art. 6(1)(f) GDPR).

Support & communication

If you contact us by email or via Discord, we store your inquiry including all personal data arising from it for the purpose of handling your request.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures / contract performance) or Art. 6(1)(f) GDPR (legitimate interest in efficient customer support).

Retention period: Until final resolution, then a maximum of 24 months for quality assurance.

Retention periods

Your rights as a data subject

You have the following rights vis-à-vis us as controller at any time:

• Access to the personal data we process (Art. 15 GDPR)
• Rectification of inaccurate or incomplete data (Art. 16 GDPR)
• Erasure of your data ("right to be forgotten", Art. 17 GDPR), insofar as no statutory retention obligations apply
• Restriction of processing (Art. 18 GDPR)
• Data portability — receipt of your data in a structured, commonly used, machine-readable format (Art. 20 GDPR)
• Objection to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR)
• Withdrawal of consent given, with effect for the future (Art. 7(3) GDPR)

To exercise your rights, an email to Kurexaisupport13@proton.me is sufficient. We respond within the statutory period of one month.

Right to lodge a complaint

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your residence, place of work, or place of the alleged infringement, if you believe that the processing of personal data concerning you violates the GDPR (Art. 77 GDPR).

A list of data protection supervisory authorities is available at bfdi.bund.de.