Studfoundry
Demo mode. The sample sellers, listings and reviews on show aren't real.

Privacy policy

Version 1.2 · Last updated 14 November 2026

Who we are

Studfoundry is run by an individual based in the United Kingdom, who is the controller of your personal data under UK data protection law. "We", "us" and "our" mean that person running Studfoundry. You can reach us about anything in this policy using our contact form.

What we collect and why

  • Your account: username, email address, date of birth, your password (stored only as a one-way argon2id hash), when you joined, the versions of our terms and privacy policy you agreed to and when, and your settings. We need these to run your account (contract). We ask for your date of birth to keep under-13s off the site and to protect younger members (legal obligation and legitimate interests).
  • Signing in safely: sign-in sessions, one-time email codes, the browsers you've confirmed (with their browser name and version), and your IP address while we check for too many sign-in attempts. We record an IP address in our security log only when a limit is hit. This keeps accounts secure (legitimate interests).
  • Your store, if you sell: store name, handle, bio, the country you live in, whether you sell as a business or private individual, your 18+ and rights confirmations with when you gave them, copyright strikes, and whether selling is suspended. We need these to let you sell and to keep the marketplace honest (contract and legitimate interests).
  • What you upload: asset files, images, video links, live preview data and a fingerprint (hash) of each file. We need these to list and deliver your assets, and hashes to stop removed content coming back (contract and legitimate interests).
  • What you get: your orders, library, wishlist and cart. Each order records the item, seller, licence, price, and the wording you agreed to when you gave up your right to cancel. Paid orders also record your billing country and the country you connected from, because VAT rules make us keep two pieces of evidence of where each buyer is. The law requires us to keep order records (legal obligation). When you start a paid checkout we also note the IP address it came from, for 180 days, to deal with fraud and payment disputes (legitimate interests).
  • Payment disputes: if a payment is charged back without the buyer contacting us first, we close the account and keep the network address the purchase came from on a block list until our team lifts it. To check whether someone contacted us, we keep a note that a report or message was sent (not what it said) for about 13 months (legitimate interests: protecting sellers from fraud).
  • Live preview views: which account viewed which preview, and the hidden mark placed in that copy, so a leaked preview can be traced (legitimate interests: protecting sellers' work).
  • Reviews, reports, appeals and messages you send: the content and when you sent it, who sent a report, and the email address you give if you contact us or report illegal content without an account. We use these to moderate the site, handle appeals and reply to you (legitimate interests and legal obligation).
  • Copyright notices: the name, email, postal address, phone number and signature of the person sending a notice, their description of the work, and any counter-notice from the seller. We need these to handle notices properly (legal obligation and legitimate interests). Sellers only see the description of the work and, if the sender had an account, their username.
  • Age checks: if a sign-up is refused for age, we set a random token in that browser and keep a one-way hash of it, so the same person can't simply try again with a different year (legal obligation and legitimate interests). We don't keep the email address that was entered.
  • Marketing emails: only if you opt in, and only if you're 18 or over (consent). You can unsubscribe from any marketing email or in your settings.
  • Your country: our network provider tells us which country a visit comes from. We use it to pick the currency prices are shown in. We only store it when you pay for something, on the order, as VAT evidence.

Children and teenagers

You must be 13 or over to have an account. For members under 18, we:

  • show their reviews as "Studfoundry member" unless they choose otherwise;
  • don't send marketing emails, even if asked;
  • don't let them sell, so we never collect store details from them.

We don't build profiles of anyone, show adverts, use analytics or tracking tools, or track your location.

Who we share it with

  • Our hosting provider, which runs the servers Studfoundry is stored on.
  • Cloudflare, which sits in front of the site to keep it fast and protect it from attacks. It handles every request, including your IP address.
  • MXroute, which delivers the emails we send.
  • Our payment provider, once paid assets are available, to take payments and pay sellers. It runs its own checks on sellers and has its own privacy policy.
  • Other members, but only what's public: your username on reviews (if shown), and a seller's store details and listings.
  • The other side of a copyright dispute, as described above, and a seller's counter-notice statement with the person who sent the notice.
  • The police, courts or regulators, when the law requires it or to protect someone from serious harm.

We never sell your data. Some of these providers may handle data outside the UK. When they do, we rely on UK adequacy regulations or the UK's approved data transfer agreements to make sure it's protected to the same standard.

How long we keep it

  • Account and store details: until you delete your account.
  • Orders: at least six years from the order, and ten years for sales to buyers in the EU, because tax and consumer law require it. If you delete your account, the order record stays but is no longer linked to your email or any other details.
  • Security log entries, live preview views, and reports and appeals once they're closed: about 30 days.
  • Copyright notices and counter-notices: for as long as the strike they relate to is on record. Strikes don't expire.
  • Age-check browser tokens: two years.
  • Sign-in sessions and confirmed browsers: 30 days. One-time codes: 15 minutes.
  • Reviews you wrote stay up after you delete your account, shown as "Deleted account".

Your rights

Under UK data protection law you can:

  • get a copy of your data: download it any time from your account settings;
  • have your data deleted: delete your account from your settings;
  • have inaccurate data corrected;
  • object to how we use your data, or ask us to restrict it;
  • take your data elsewhere (the download is in a standard format);
  • withdraw consent to marketing at any time.

For anything you can't do from your settings, contact us using our contact form. We'll reply within one month. If you're unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

Automated checks

Some checks run automatically. Listings that mention things that can't be sold are held for a person on our team to look at; they're never rejected by the system alone. A store is suspended automatically when it reaches the strike limit, but every strike comes from a decision made by a person. You can appeal any decision.

Keeping it safe

Passwords are hashed with argon2id, the site only works over encrypted connections, staff access is limited by role and every staff action is logged. If a breach puts your data at risk, we'll tell the Information Commissioner's Office within 72 hours where the law requires it, and tell you if it's likely to affect you.

Cookies

We only use cookies that the site needs to work. See our cookie policy.

Changes to this policy

When we change this policy in a way that matters, we'll ask you to read and accept the new version the next time you visit.