Privacy Notice

1. Who We Are

This Privacy Notice explains how Exilitay Graphics (referred to as “we,” “us,” or “our”) collects, uses, and protects your personal data. Exilitay Graphics is the trading name of Sussex Finance Ltd, a private limited company registered in England and Wales with its registered office at 92 Osborne Road, Southsea, Hampshire, PO5 3LU, United Kingdom. Sussex Finance Ltd (trading as Exilitay Graphics) is the data controller for personal data processed through exilitay.net. Our business website is exilitay.net. We also have a Patreon page at patreon.com/cw/Exilitay.

Our contact and correspondence details are in Section 9. Use of our website and purchases are also governed by our Terms & Conditions, which include further legal operator information. This site is not directed at children under 13, and we do not knowingly collect personal data from children.

2. What Information We Collect

We collect certain personal data from you when you create an account, sign in, interact with our website, or purchase a membership. The information we collect may include:

• Account Information: Your username, email address, and account preferences when you register or manage your profile.
• Contact Information: Your first name, last name (if provided), and email address.
• Billing / invoice details: Limited address details used to issue membership invoices, which may include your postcode (or ZIP code) and country. We may also show a street address or city on an invoice if that information is supplied by you or by your payment provider for billing purposes.
• Payment Information: Details related to your transactions (for example payment status, amount, currency, payment method type such as card or wallet, and billing country). Checkout on exilitay.net is processed safely and securely by Stripe. Stripe may also offer digital wallets such as Apple Pay or Google Pay on supported devices and browsers. We do not store your full payment card number, CVV/CVC, wallet credentials, bank account details, or other sensitive payment credentials on our servers. Card and wallet data is handled by Stripe and (where you pay with a wallet) Apple or Google under their own privacy policies.
• Technical Data: Information like your IP address, browser type, device type, and how you interact with our website, including the pages you visit. We collect this data through analytics services and essential site cookies.
• IP geolocation (for currency only): To show prices in a suitable currency, we use IP geolocation (an IP-to-country lookup). When you visit, a country-level estimate is derived from your IP address at that moment and used solely to pre-select GBP, USD, or EUR. This is not precise or GPS-level tracking. We do not store your IP address for this purpose, we do not keep a location history, and we do not save that lookup to your account. We may keep only a preference cookie of the currency being shown (GBP, USD, or EUR) so prices stay consistent during your visit. You can override the suggested currency at any time using the currency selector on the home page and on the registration / checkout page. Because the estimate is based on your internet connection, using a VPN or proxy can change the currency we suggest. (Separately, our hosting provider may keep standard server and security logs, which can include IP addresses, as described under SiteGround in Section 5.)
• Discord Account Linking (optional): If you choose to connect your Discord account from My Account, we receive and store your Discord user ID and Discord username (or display name) so we can link your Exilitay membership to your Discord profile. We do not receive your Discord password. Connection is handled through Discord OAuth via our social-login provider (miniOrange).
• Subscription and Access Records: Your membership tier, subscription status, renewal and cancellation dates, and payment history related to your account. These records are managed through Paid Member Subscriptions on our website, with billing processed by Stripe.
• Community Download Records: When you click a download link on our community hub while logged in, we record your account, the content item you accessed, and the date and time of that download. We also keep aggregate download counts per release. Our hosting provider may separately maintain standard web server and security logs (which can include technical identifiers such as IP address) when files are requested.
• Patreon Membership Data (if applicable): If you subscribe through Patreon, Patreon collects and processes your payment and membership information under its own privacy policy. We may receive limited membership information from Patreon (such as your name, email, and tier status) to provide access to benefits where Patreon and exilitay.net are linked.

3. How and Why We Use Your Information

We use the data we collect for the following reasons:

• To Process Orders: To deliver the digital products you have purchased and manage your subscriptions.
• To Issue Invoices and Payment Records: To generate downloadable invoices and payment history in My Account, and to attach or email invoices where appropriate. Invoice “Provided to” details may include your first name, last name (if entered), email address, postcode, and country. Access to those invoice documents is limited to you (via your logged-in account or a secure invoice download link) and to Exilitay Graphics for account administration, customer support, accounting, and legal/tax compliance. We do not sell this information, and we do not use invoice details for marketing.
• To Communicate With You: To send service emails needed to run your account and membership (detailed below). These are not marketing emails.
• To Improve Our Services: We analyze usage data to understand how people use our website and improve the user experience.
• For Legal Reasons: To meet our legal obligations, such as for tax purposes and to comply with privacy laws.
• To Manage Discord Membership Access: If you connect Discord, we use your linked Discord user ID and your active Exilitay subscription tier to assign, update, or remove paid member roles and channel access in our Discord server (for example Standard, Exclusive, or Ultimate). Role changes may happen immediately on upgrade, or at the end of your current billing period on downgrade or cancellation, in line with your website subscription status.
• To Handle Disputes and Protect Our Services: To investigate suspected account sharing, refund or chargeback claims, and other abuse, including by reference to download records, subscription history, and related access logs described in Section 2.

Emails we send

We send transactional and security emails so we can provide your account and subscription. These do not require marketing consent. Depending on how you use the site, they may include:

• Registration and welcome: Confirming that your account has been created and your subscription is active.
• Payment receipts and invoices: Confirmations of charges for your membership, which may include the limited billing details described in Section 2 (name, email, postcode, and country). Stripe may also email you receipts or invoices directly under its own privacy policy.
• Subscription notices: Renewal reminders, failed-payment alerts, cancellation confirmations, and plan-change notices (upgrades, downgrades, or related billing updates).
• Account security: Password-reset links, email-change verification messages, and login two-factor authentication (2FA) codes when you enable or use those features.
• Community / Configs posts: Notifications related to Community and Configs (downloads) posts you interact with on the site (for example replies or updates where those features send email).
• Contact-form replies: Responses when you message us through our contact form at exilitay.net/contact.

We do not currently send newsletters, promotional offers, or other marketing emails. If we introduce marketing emails in future, we will only send them where we have a lawful basis to do so (typically your consent) and you will be able to opt out at any time using the unsubscribe link in those emails or by contacting us.

Service emails above are processed mainly under contract (to provide and administer your account and membership). Password resets, email-change verification, and 2FA codes are also processed under legitimate interests in securing your account and preventing unauthorised access.

We process personal data on the following lawful bases, as applicable: (a) Contract — to provide accounts, subscriptions, downloads, customer support, and related service emails; (b) Legitimate interests — to secure our services (including 2FA and password resets), prevent fraud and misuse, enforce our Terms & Conditions, and improve our website; (c) Consent — for non-essential cookies and analytics where you opt in, and for any future marketing emails if introduced; and (d) Legal obligation — where we must retain or disclose information to comply with applicable law.

4. Discord Account Linking

Linking Discord is optional. You can use exilitay.net and paid downloads without connecting Discord, but connecting is required to receive automatic paid-tier roles in our Discord community.

• What we store: Your Discord user ID, Discord username/display name, connection status, and internal records of which membership role we last synced for your account.
• Disconnect: You may disconnect from My Account at any time. We then remove your paid Discord roles and delete stored Discord link data from your Exilitay account. You may reconnect at any time.
• Account deletion: If you delete your Exilitay account, we remove associated Discord link data from our systems. You should also disconnect or leave the Discord server separately if you no longer wish to participate there.
• Discord's own terms: Use of Discord is also governed by Discord's Terms & Conditions and Discord's Privacy Policy.

5. Who We Share Your Information With

We share your information with trusted third-party services that are essential to running our business. These include:

• Stripe: To process your payments safely and securely and to manage your subscriptions on exilitay.net. Stripe is a PCI DSS-compliant payment processor. Where Stripe shows a digital wallet option (such as Apple Pay or Google Pay), Apple or Google may also process limited payment data needed to complete that wallet payment under their own privacy policies. Stripe may hold card or wallet credentials and richer billing data than we store; Exilitay Graphics only receives the limited payment and billing information needed to run your membership, show payment history, and issue invoices.
• Patreon: If you subscribe through Patreon, membership and billing data is handled under Patreon's own privacy policy.
• Google Analytics: To understand our website traffic and how people use our site (only if you accept analytics cookies).
• Discord: When you connect your account, Discord processes the OAuth authorization request. Our server-side automation then communicates with Discord's API to manage paid member roles on your linked Discord account in our server. Discord processes this according to its own privacy policy.
• miniOrange (social login): We use the miniOrange Social Login plugin to run the Discord OAuth connection flow when you click Connect Discord. miniOrange facilitates the authorization handshake between you, Discord, and our website.
• SiteGround (hosting): Our website is hosted by SiteGround, which processes technical and security data (such as server logs and IP addresses) to operate and protect exilitay.net.

6. Your Rights

Under data protection laws, you have rights regarding your personal data. You have the right to:

• Be informed about how your data is used.
• Access a copy of the data we hold about you.
• Ask us to correct any inaccurate data.
• Request that we delete your data in certain situations.
• Object to us using your data for certain purposes.
• Request restriction of processing in certain situations.
• Request a portable copy of data you provided to us, where applicable.
• Withdraw consent at any time where processing is based on consent (such as analytics cookies), without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, contact us at contact@exilitay.com. We will respond within one month, or inform you if we need longer for complex requests. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint if you believe your data protection rights have been infringed. If you are in the European Economic Area, you may also complain to your local data protection supervisory authority.

United States privacy rights

If you are a resident of certain US states (including California), you may have additional rights under applicable state privacy laws, such as the right to know what personal information we collect, to request deletion or correction, and to opt out of certain processing. We do not sell your personal information for money. To exercise US privacy rights, contact contact@exilitay.com with your request and enough information for us to verify your account.

7. Cookies & Consent

We use cookies and similar technologies to operate our website and to understand how visitors use it. When you first visit our site, you are shown a consent banner where you can choose which categories of cookies to allow.

• Essential Cookies: Required for the site to function (login state, session integrity, cart, and security). These cannot be disabled.
• Analytics Cookies: Used by Google Analytics to measure how visitors use the site so we can improve it. These are only loaded if you accept them.
• Marketing Cookies: Used for measuring the performance of campaigns or external referrals. Off by default.

You can change your preferences at any time by clicking Cookie Settings in the footer of any page. Withdrawing consent will not affect the lawfulness of any processing carried out before you withdrew it.

8. Data Retention and International Transfers

We keep personal data only for as long as necessary for the purposes described in this Privacy Notice, including to provide our services, comply with legal obligations, resolve disputes, and enforce our agreements. Account and subscription records are typically retained for the life of your account and for a reasonable period afterwards for legal, tax, and security purposes. Download and access logs used for security and enforcement are retained for a limited period and then deleted or anonymised when no longer needed.

Some of the service providers listed in Section 5 are located outside the United Kingdom (including in the United States). Where personal data is transferred internationally, we rely on appropriate safeguards permitted by applicable data protection law, such as adequacy regulations, standard contractual clauses, or equivalent protections offered by those providers.

9. How to Contact Us

If you have any questions about this Privacy Notice or would like to exercise any of your rights, please contact us:

• Email: contact@exilitay.com
• Web: https://exilitay.net/contact
• Discord: discord.gg/exilitay

Sussex Finance Ltd
trading as Exilitay Graphics
92 Osborne Road
Southsea, Hampshire
PO5 3LU
United Kingdom

Registered office · Company No. 15495313 · trading as Exilitay Graphics