Privacy Policy

This Privacy Policy explains how Skiz Creations, a business registered in the Republic of Lebanon that operates the "Cornerstone" brand and this website ("Skiz Creations", "we", "us", "our"), collects, uses, discloses, and protects personal information when you visit saascornerstone.com (the "Site") or purchase our software products (the "Services").

We sell worldwide, to business purchasers, except in jurisdictions subject to comprehensive international sanctions. This Policy applies to everyone who uses the Site or buys the Services, wherever you are. Where the EU or UK General Data Protection Regulation applies to our processing, Skiz Creations is the controller, and section 11 sets out the additional rights and disclosures those laws require.

1. Summary

The short version, in plain language:

• We collect only what is needed to sell, deliver, and support a software licence.
• We never see or store your card number. Payments are handled entirely by NetCommerce, our payment processor.
• We do not sell your personal information.
• Ad measurement depends on where you are. We use Meta's Pixel and Conversions API to measure our ads on Facebook and Instagram, and — if a partner's referral link brought you here — we remember that referral so we can pay them. In the EU, the EEA, the UK and Switzerland this happens only if you accept marketing cookies. Everywhere else it is on by default and you can opt out at any time: with “Opt out” in the cookie notice, with “Do Not Sell or Share My Personal Information” at the bottom of every page, or by sending a Global Privacy Control signal. See section 6.
• We also count visits to our own pages ourselves (section 2.2, “Site analytics”). That data stays on our server, is never shared or sold, and contains no IP address and nothing you type.
• Passwords are stored only as salted cryptographic hashes; we cannot read them.

2. Information we collect

2.1 Information you give us

• Account information: first and last name, email address, and a password (stored only as a salted hash).
• Billing information: billing name, email, phone number, country, street address, city, state, and postal code. Optionally a company name and VAT or tax identification number, where you supply one for invoicing.
• Order information: the products purchased, price, currency, order number, payment method selected, order status, and the version of our terms you accepted together with the time of acceptance.
• Delivery information: for products delivered through a private source-code repository, the email address (and, where you provide one, the account username) used to grant you access.
• Correspondence: the contents of messages you send us, including support and refund requests.

2.2 Information collected automatically

• Session records: when you sign in we record your IP address and browser user-agent string alongside the session, so that access can be reviewed and revoked and so we can detect account misuse.
• Security and audit records: we log security-relevant events — sign-in, failed sign-in, email verification, password reset, and order creation — with the associated IP address and timestamp.
• Abuse-prevention counters: short-lived counters keyed to an IP address and/or email address, used to rate-limit sign-in attempts, account creation, password resets, and verification codes.
• Server logs: our hosting provider processes standard request metadata (IP address, timestamp, requested URL, user agent) to deliver and secure the Site.
• Site analytics (first-party, never shared): which pages and page sections you view, how far you scroll, how long the page stays open, which buttons you click, whether you play the demo video, how far you get through checkout (and which field, if any, was rejected — never what you typed), page load time, the ad campaign and ad that brought you (utm parameters and whether a Meta click id was present), the referring website's domain, your country (from your IP address, which we do not store), device type, browser and screen width. Linked by a random session identifier and, outside the EU, EEA, UK and Switzerland or with your consent there, a random visitor identifier that lasts one year. We use it only to understand and improve how the Site works.
• Advertising measurement (section 6 explains when): the pages you view, products you view, adding to cart, starting checkout, entering payment details, completed purchases (order value and currency), account sign-ups, giveaway entries, affiliate applications and clicks on our contact email links; together with your IP address, browser user-agent and Meta's _fbp and _fbc cookie identifiers. For purchases, sign-ups and giveaway entries we also send Meta your email address, phone number, name, city, state, postal code, country and account identifier — each irreversibly hashed (SHA-256) before it leaves our server, so Meta can match it only to an account it already knows. See section 5.2.
• Partner referrals (section 6 explains when): if you arrive through an affiliate partner's referral link and ad measurement is on for you, we record which partner referred you, the page you landed on and the page that linked to us, with your IP address and browser user-agent stored only as salted one-way hashes, never in readable form. If you then buy within 30 days, the order is credited to that partner. A partner's coupon code entered at checkout credits them in every case.

2.3 Information we do not collect

• Payment card data. Card numbers, expiry dates, and security codes are entered with, and processed by, NetCommerce. They never reach our servers and we never store them.
• Sensitive personal information as defined under United States state privacy laws — including government identifiers, precise geolocation, biometric or health data, racial or ethnic origin, religious beliefs, union membership, sexual orientation, or the contents of your communications with third parties. We do not collect, process, or infer any of it.
• Behavioural data beyond the above. We operate no analytics platform and no session-replay tooling, and we do not ourselves build profiles of you. Advertising measurement happens only as described in 2.2 and only with your consent.

3. How we use personal information

We use personal information only for the following purposes:

• To create and administer your account and to authenticate you.
• To verify that an email address belongs to you before an order is placed, using a time-limited numeric code.
• To process, fulfil, and deliver your order, including granting access to purchased software.
• To send transactional email necessary to the Service — verification codes, password resets, order confirmations, and delivery or download notices.
• To provide customer support and handle refund or warranty requests.
• To keep accounting and tax records, issue invoices, and comply with legal obligations applicable to us.
• To secure the Service — detecting and preventing fraud, credential stuffing, abuse of verification codes, licence abuse, and unauthorised access.
• To enforce our terms and to establish, exercise, or defend legal claims.
• To understand how visitors use the Site and where checkout fails, using our own first-party site analytics (section 2.2), so we can fix it.
• Where ad measurement is on for you (section 6): to measure how well our advertising on Meta's platforms works and to show our ads to relevant audiences, using the Meta Pixel and the Meta Conversions API (section 5.2).
• Where ad measurement is on for you: to credit, and pay a commission to, the affiliate partner whose referral link brought you to the Site. Partners see the order number, the order value their commission is based on, and the commission; they do not receive your name, contact details or what you bought.

We do not use your personal information for automated decision-making producing legal or similarly significant effects, and we do not use it to train machine-learning models.

4. Selling and sharing personal information

We do not sell personal information and have not done so in the preceding twelve months. We receive no money for disclosing your information.

Where ad measurement is on for you (section 6), we disclose the advertising-measurement information listed in section 2.2 to Meta for advertising measurement and ad delivery. Some United States state privacy laws, including California's, treat this as “sharing” personal information for cross-context behavioural advertising. You can opt out at any time with the “Do Not Sell or Share My Personal Information” link at the bottom of every page, with “Opt out” in the cookie notice, or by choosing “Decline” in “Cookie settings”; a Global Privacy Control signal from your browser is honoured automatically as an opt-out (section 12). Our first-party site analytics are never sold or shared. We do not knowingly share the personal information of anyone under 16.

5. When we disclose personal information

We disclose personal information only to the categories of recipients below, and only to the extent necessary for the stated purpose.

5.1 Service providers

These providers process personal information on our behalf, under contract, and are not permitted to use it for their own purposes:

• Contabo GmbH (Germany) — provides the server on which the Site, its database, its file storage and our outgoing mail server run. All information you submit to the Site is stored on that server.
• Cloudflare, Inc. (United States) — domain name service, content delivery and network security (protection against attacks and abuse). Every request between your browser and the Site passes through Cloudflare, which therefore processes your IP address and the request data, and may receive technical error reports from your browser about failed connections. Cloudflare does not add analytics or any other content to our pages.
• Email — transactional email (verification codes, receipts, delivery notices) is sent from our own mail server on the Contabo server above; no third-party email service receives it. It is then carried by your own email provider.
• GitHub, Inc. (United States) — where you purchase a product delivered through a private repository, we transmit your email address to GitHub so that it can issue you an access invitation.
• NetCommerce S.A.L. (Lebanon) — our payment processor. Receives the payment and billing information required to authorise and settle your transaction, including your card details, which you enter directly with them. It processes that information as an independent controller under its own privacy policy. We receive back only a transaction reference and an authorisation status.

5.2 Advertising partner

Meta Platforms Ireland Limited (for people in the EEA, the UK and Switzerland) and Meta Platforms, Inc. (United States, for everyone else). Where ad measurement is on for you (section 6), your browser loads the Meta Pixel from Meta's servers and reports the events listed in section 2.2 to Meta, and our server reports the same events to Meta through its Conversions API. Under Meta's Business Tools Terms, Meta processes this information to measure our ads and deliver ads, and uses it for its own purposes as described in Meta's Privacy Policy. For people in the EEA, the UK and Switzerland, we and Meta are joint controllers for the collection and transmission of this data under Meta's Controller Addendum; Meta is responsible for its subsequent processing. You can also control how Meta uses this data in your Facebook or Instagram ad settings.

5.3 No other third-party content

All fonts, stylesheets, scripts, and images are served from our own domain. Unless ad measurement is on for you, loading a page on the Site causes your browser to contact no third party. Card payment pages additionally load NetCommerce's payment fields.

5.4 Legal and business transfers

• Legal compliance: we may disclose information where required by applicable law, regulation, legal process, or an enforceable governmental request, or where necessary to protect the rights, safety, or property of ourselves, our customers, or the public.
• Professional advisers: our accountants, auditors, and legal advisers, under a duty of confidentiality.
• Business transfer: if we are involved in a merger, acquisition, financing, reorganisation, or sale of assets, personal information may be transferred as part of that transaction. We will give notice before your information becomes subject to a materially different privacy policy.

6. Cookies and local storage

What we ask depends on where you are, judged from the country of your IP address:

• In the EU, the EEA, the UK and Switzerland (and whenever we cannot tell where you are), we ask on your first visit whether you accept marketing cookies. Accept and Decline are equally easy, the Site works the same either way, and no marketing cookie is set and nothing is sent to Meta until you accept.
• Everywhere else, ad measurement is on by default and a small notice says so. You can switch it off at any time with “Opt out” in that notice, with “Do Not Sell or Share My Personal Information” at the bottom of every page, or by sending a Global Privacy Control signal.

You can change your choice at any time from “Cookie settings” at the bottom of every page. Opting out or declining stops the Meta Pixel and the Conversions API for your browser and deletes Meta's cookies and the referral cookie.

Cookies set whatever you choose (strictly necessary):

• cs_session — keeps you signed in. It contains an opaque random token and no personal information. It is flagged HttpOnly (unreadable by scripts), Secure (sent only over HTTPS), and SameSite=Lax, and expires 30 days after issue or when you sign out.
• cs_aff — only for affiliate partners: keeps a partner signed in to their affiliate dashboard. Same protections as cs_session; expires 30 days after issue or on sign-out.
• cs_consent — remembers your cookie choice so we don't ask on every page. Expires after one year, when we ask again.
• cs_sid — a random identifier for this browsing session, used by our first-party site analytics. Deleted when you close your browser.
• cs_utm — the ad campaign and ad that brought you here this session, so a purchase can be credited to the right ad. Deleted when you close your browser.

Cookies set only where ad measurement is on for you (by default outside the EU, EEA, UK and Switzerland; there, only if you accept):

• _fbp — Meta's browser identifier, used to measure our ads. Set by the Meta Pixel; expires after 90 days.
• _fbc — records the Meta ad you clicked to reach us, when you arrive from one. Set by our server or the Meta Pixel; expires after 90 days.
• cs_vid — a random visitor identifier for our first-party site analytics, so a return visit is counted as the same visitor. Expires after one year; opting out deletes it.
• aff — set only if you arrived through an affiliate partner's referral link: identifies the partner and the referral so a purchase within 30 days can be credited to them. Flagged HttpOnly, Secure and SameSite=Lax; expires after 30 days. Opting out or declining deletes it.

We additionally store two items in your browser's local storage. These never leave your device and are not transmitted to us:

• cornerstone_guest_cart — the product identifiers in your cart before you sign in, so your cart survives a page reload.
• cornerstone-theme — your light or dark display preference.
• cs_notice_seen — that you dismissed the cookie notice, so it is not shown again.

You may delete cookies and local storage at any time through your browser settings. Deleting the session cookie signs you out.

7. International transfer of personal information

Skiz Creations is established in Lebanon, and our personnel access personal information from Lebanon. The Site's server is provided by Contabo GmbH, a German company. Cloudflare, GitHub and (only with your consent) Meta are established in the United States — Meta in Ireland for people in the EEA, the UK and Switzerland — and operate globally distributed infrastructure; your information may therefore also be processed in the United States and in other countries where those providers maintain facilities. NetCommerce processes card payments in Lebanon.

Privacy laws in Lebanon differ from those where you live, and Lebanon is not the subject of an adequacy decision by the European Commission, the United Kingdom, or any comparable authority. By purchasing from us, you understand that your personal information will be transferred to and processed in Lebanon. Where you are in the EEA, the United Kingdom or Switzerland, we rely on Article 49(1)(b) of the GDPR — the transfer is necessary to perform the contract you have entered into with us — and we transfer only what is needed to sell, deliver and support the licence you bought. We apply the protections described in this Policy wherever your information is processed, and we impose contractual confidentiality and security obligations on our service providers.

8. How long we keep personal information

We retain personal information only as long as needed for the purpose it was collected, or as required by law:

• Account records — while your account is open, and thereafter as required to preserve your licence entitlement and our records.
• Order, invoice, and tax records — for the period required by applicable accounting and tax law, which may be up to ten years, including after an account is closed.
• Sign-in sessions — 30 days from issue, or until you sign out or revoke them.
• Email verification codes — 5 minutes.
• Password reset links — 1 hour, and invalidated as soon as any reset completes.
• Email verification links — 24 hours.
• Incomplete checkouts — deleted within 1 hour of expiry. If you never confirm your email address, no account and no order is created.
• Download links — 14 days from issue.
• Security and audit logs — 24 months, for fraud prevention and payment dispute resolution, then automatically deleted.
• Rate-limiting counters — automatically purged; none retained beyond 24 hours.
• Advertising attribution for a purchase (only with consent: the browser identifiers needed to report the purchase to Meta) — deleted after 30 days. Meta retains what it receives under its own policy.
• Site analytics (first-party, section 2.2) — 13 months, then automatically deleted.

9. Security

We apply the following measures, among others:

• All traffic to and from the Site is encrypted in transit using TLS.
• Passwords are stored only as PBKDF2-HMAC-SHA-256 hashes with a unique random salt per account. We cannot recover or read your password.
• Session tokens, verification links, verification codes, and download links are stored only as cryptographic hashes, never in their original form.
• Card data is never transmitted to, or stored on, our systems.
• Rate limiting and lock-outs protect against password guessing, verification-code guessing, and automated abuse.
• Administrative functions are protected by a separate secret credential.
• Security-relevant events are recorded in an audit log.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a breach of security affecting your personal information, we will notify you and the relevant authorities as required by applicable law.

10. Your privacy rights

The rights below come from a patchwork of laws that reach different people — US state privacy statutes, the EU and UK GDPR, Canada's PIPEDA, Brazil's LGPD and others. Rather than making you work out which one covers you, we extend all of them to every customer as a matter of policy, whether or not a particular law binds us in your case.

• Right to know / access — to confirm whether we process your personal information and to obtain the categories and specific pieces we hold, the sources, the purposes, and the categories of recipients.
• Right to delete — to request deletion of the personal information we hold about you, subject to exceptions such as completing a transaction, security, and legal or tax record-keeping obligations.
• Right to correct — to have inaccurate personal information corrected. Most details can be corrected directly in your account.
• Right to data portability — to obtain a copy of your personal information in a portable, machine-readable format.
• Right to opt out of the sale or sharing of personal information and of targeted advertising. We do not sell personal information; sharing with Meta for advertising happens only if you accept marketing cookies, and you can opt out at any time by choosing “Decline” in “Cookie settings” or by enabling Global Privacy Control in your browser. We do not carry out profiling with legal or similarly significant effects.
• Right to limit use of sensitive personal information — we do not collect sensitive personal information.
• Right to non-discrimination — we will not deny you service, charge a different price, or provide a lesser quality of service because you exercised a privacy right.

10.1 How to exercise your rights

Email contact@saascornerstone.com with the subject line "Privacy request", telling us which right you wish to exercise. To protect your information we will verify your request — normally by confirming control of the email address on the account, and for requests concerning specific pieces of information, by asking you to sign in.

We will acknowledge your request within 10 business days and respond substantively within 45 calendar days. Where reasonably necessary we may extend this once by a further 45 days and will tell you if we do. There is no charge unless a request is manifestly unfounded or excessive.

10.2 Authorised agents

You may use an authorised agent to submit a request on your behalf. We will require written proof of the agent's authority and may ask you to verify your own identity directly.

10.3 Appeals

If we decline your request you may appeal by replying to our decision with the subject line "Privacy appeal". We will respond within 45 days with a written explanation. If your appeal is denied, you may contact the Attorney General of your state.

10.4 California "Shine the Light"

California Civil Code § 1798.83 permits California residents to request information about disclosure of personal information to third parties for their direct marketing purposes. We make no such disclosures.

11. Additional information for the EEA, the UK and Switzerland

Where the EU GDPR, the UK GDPR, or the Swiss FADP applies to our processing of your personal information, this section applies in addition to the rest of this Policy. The controller is Skiz Creations, contactable at the address in section 16.

Our lawful bases for processing are:

• Performance of a contract (Article 6(1)(b)) — to take your order, take payment, deliver the licence and the software, provide support, and honour the refund and warranty terms.
• Legal obligation (Article 6(1)(c)) — to keep the accounting and tax records we are required to keep.
• Consent (Article 6(1)(a), and the ePrivacy rules on cookies) — for the Meta Pixel, the Conversions API and Meta's cookies (sections 2.2 and 5.2), and for the partner-referral cookie and referral record (section 2.2). You can withdraw it at any time from “Cookie settings”.
• Legitimate interests (Article 6(1)(f)) — to keep the Site secure, prevent fraud and abuse, and understand in aggregate how the Site is used. We have weighed these against your interests and rights and limited what we collect accordingly.

You have the rights set out in section 10, and in addition the right to object to processing carried out on the basis of legitimate interests, the right to restrict processing, and the right to data portability. Where we rely on consent you may withdraw it at any time, without affecting processing already carried out.

You also have the right to complain to your supervisory authority — in the EEA, the data protection authority where you live or work; in the United Kingdom, the Information Commissioner's Office; in Switzerland, the Federal Data Protection and Information Commissioner. We would ask you to raise it with us first so we have the chance to put it right.

We do not make decisions producing legal or similarly significant effects about you by automated means alone, and we do not ourselves carry out profiling. If you accept marketing cookies, Meta may use the data it receives in its own advertising systems, as described in its privacy policy.

12. Do Not Track and Global Privacy Control

We honour Global Privacy Control. If your browser sends a GPC signal, we treat it as a refusal of marketing cookies and an opt-out of sharing: the Meta Pixel never loads, no event is reported to Meta from our server, no referral cookie is set, and we do not ask you. Do Not Track has no agreed standard meaning, so we do not respond to it separately; choosing “Decline” has the same effect.

13. Children's privacy

The Services are intended for business and professional use and are not directed to children. We do not knowingly collect personal information from anyone under 16 years of age. If you believe a child has provided us with personal information, contact us and we will delete it.

14. Third-party links

The Site and our emails may link to third-party websites, including code-hosting platforms. We are not responsible for the privacy practices of those sites, and this Policy does not apply to them. Review their policies before providing personal information.

15. Changes to this Policy

We may update this Policy from time to time. When we do, we will revise the date at the top of this page. If we make a material change to how we handle personal information we will give prominent notice on the Site and, where the change affects an active customer, by email before it takes effect. Continued use of the Services after a change takes effect constitutes acceptance of the revised Policy.

16. Contact us

Skiz Creations is the controller responsible for your personal information. "Cornerstone" is our brand name, not a separate legal entity, so any communication from "Cornerstone" is from Skiz Creations. For any privacy question, request, or complaint:

• Email: contact@saascornerstone.com
• Controller: Skiz Creations, a business registered in the Republic of Lebanon, trading as Cornerstone

See also our Terms of Sale and Refund Policy.