Privacy Policy.

At McEXE, we take your privacy seriously. This policy explains what data we collect, why we collect it, how we store it, and what rights you have over your own information.

We aim to follow the principle of data minimization: we only collect what we need to run the Services, and we keep it only as long as necessary. We do not sell your data, ever.

Depending on how you use the Services, we may collect:

• Account data: your full name, username, email address, phone number, gender, and a hashed version of your password. We never store passwords in plain text.
• Profile data: your avatar image and any social links you choose to add (Twitter, GitHub, Discord, website).
• Order data: products you purchased, order totals, order status, and the contact information you provide at checkout.
• Support data: the content of tickets you open, including messages and any files you attach.
• Technical data: your IP address, browser user agent, and general access logs generated by our web server.
• Payment data: we do not store card numbers or bank details. All payment information is handled directly by our payment gateway.

We use the data we collect to:

• Create and secure your account.
• Process orders and deliver purchased products.
• Respond to support tickets and provide customer service.
• Send transactional emails related to your account (never marketing without consent).
• Detect and prevent fraud, abuse and security incidents.
• Improve the Services based on aggregate, anonymized usage patterns.

We do not use your data for profiling, targeted advertising, or sale to third parties.

We use cookies strictly for essential functionality. These include:

• Session cookies — to keep you signed in while you navigate the site.
• CSRF tokens — to protect forms from cross-site request forgery.
• Preference cookies — to remember settings like "remember me" on login.

We do not use advertising cookies, tracking pixels, or third-party analytics that profile you across other websites. If we ever add analytics in the future, this policy will be updated first.

Your data is stored on secured servers. We protect it with:

• Strong password hashing using modern algorithms (Argon2id).
• Encrypted connections (HTTPS) for all traffic.
• Session cookies marked HttpOnly and SameSite to prevent theft.
• Rate limiting and login lockouts to protect against brute-force attacks.
• Access controls so that only authorized team members can see your information.

While we take these measures seriously, no system is 100% secure. We encourage you to use a strong, unique password and to enable two-factor authentication where available.

We do not sell or rent your personal information. We only share data with:

• Payment gateways — to process your transactions. The gateway receives only the data required to complete the payment.
• Hosting providers — the servers that run the Services physically store your data.
• Legal authorities — only when required by law, court order, or to protect the rights and safety of our users.

In all cases, third parties are bound by their own terms and only receive the minimum data necessary.

We keep your data for as long as your account is active. If you delete your account:

• Profile data, orders and support tickets are permanently removed within 30 days.
• Server logs are rotated and deleted automatically within 90 days.
• Anonymized, aggregated statistics may be kept indefinitely.

Some data may be retained longer if required by law (for example, financial records for tax purposes).

You have the right to:

• Access — request a copy of the personal data we hold about you.
• Correct — update or fix any inaccurate information from your settings panel.
• Delete — request deletion of your account and associated data.
• Export — receive your data in a portable format.
• Object — ask us to stop processing your data in specific ways.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

The Services are not directed to children under 13. We do not knowingly collect personal information from anyone under 13. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

We may update this policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. For significant changes, we may also notify you by email or through a notice on the website.

We encourage you to review this page periodically.

If you have any questions about this Privacy Policy or how your data is handled, please contact us:

• Email: [email protected]
• Contact page: mcexe.ir/contact