Privacy Policy

1. Scope

This policy explains how AgentCharacters ("we") handles personal data when you browse this website, create or access an account, buy a one-time digital character license, use a purchased character, or contact support.

2. Information We Handle

Depending on how you use AgentCharacters, we handle:

• Account and support data: your email address, authentication-provider account identifier and profile fields the provider returns, and information you include in support messages.
• Purchase and access data: order and payment identifiers, the character or collection purchased, amount, currency, payment or refund status, and information needed to provide access to your license. Dodo Payments collects and processes payment-card and billing data. We do not store raw card numbers or card security codes on our servers.
• Essential technical data: Supabase authentication session information, your consent choice, and technical request or security data that our hosting and service providers process, such as IP address, user agent, and timestamps.
• Analytics and advertising data, when you consent: Google Analytics and Google Ads identifiers, client and session identifiers, pages and product interactions, device and browser information, landing page and referrer, UTM campaign parameters, and advertising click identifiers such as GCLID, GBRAID, and WBRAID. We may preserve these attribution values through checkout and associate them with a verified purchase.

3. How and Why We Use Data

We use the information described above to:

• authenticate users and maintain account sessions;
• create checkout sessions, confirm purchases and refunds, and provide access;
• answer support requests and protect the website against abuse or fraud;
• meet accounting, tax, security, and other legal obligations;
• understand website and product performance when analytics consent is granted; and
• attribute advertising, measure conversions, create remarketing audiences, and exclude purchasers from acquisition advertising when advertising consent is granted.

Where applicable, essential account, purchase, security, and compliance processing is based on providing the service you request, complying with law, and our legitimate interests in operating and protecting the service. Google analytics and advertising processing that requires consent is based on your choice.

4. Cookies and Your Choices

Supabase authentication cookies are essential for signing in and keeping your account session secure. They are not used for advertising and cannot be disabled through the analytics consent control if you choose to use account features.

Google Consent Mode starts with analytics storage, advertising storage, advertising user data, and advertising personalization denied. We enable the categories you accept only after you make a choice. In denied mode, Google tags do not read or write analytics or advertising cookies, and we do not send hashed user-provided data. Depending on the tag configuration, Google may receive limited cookieless technical or consent-status signals.

We store your choice on your device so it persists between visits. You can reject optional processing or withdraw a previous choice at any time using the Privacy choices control on the website. A new choice applies to future processing and does not undo processing that occurred while an earlier choice was active.

5. Enhanced Conversion Measurement

If you consent to advertising measurement and complete a verified purchase, we may normalize your email address and transform it with SHA-256 hashing before sending the hashed value to Google for Enhanced Conversions. Google may use the hash to improve conversion attribution by matching it to information associated with a signed-in Google account. We do not send raw email addresses in page URLs or ordinary analytics events.

6. Service Providers and Recipients

We use the following providers for the stated purposes:

• Supabase for authentication, account data, purchase-access records, and database services;
• Dodo Payments as payment provider and Merchant of Record for checkout, payment, tax, fraud, and refund processing;
• Vercel for website hosting, delivery, and operational request logs;
• Google for Google sign-in when you choose it, and, subject to your consent choice, Google Analytics, Google Ads, attribution, remarketing, and conversion measurement; and
• GitHub for sign-in when you choose it.

These providers process data under their own terms and privacy notices and may process it in countries other than yours. We do not sell personal data for money. Google Ads audience and measurement activity may be treated as targeted advertising or "sharing" under some privacy laws; you can reject or withdraw it through Privacy choices.

7. Retention and Security

We keep information only for as long as reasonably needed for the purposes described above, including providing licenses, resolving disputes, securing the service, and meeting accounting, tax, or other legal obligations. The period varies by data type and applicable requirements. Service providers also apply the retention settings and obligations described in their own notices.

We use technical and organizational safeguards appropriate to the nature of the information, but no online service can guarantee absolute security.

8. Your Privacy Rights

Depending on where you live, you may have rights to access, correct, delete, restrict, object to, or receive a copy of your personal data, withdraw consent, or complain to a data-protection authority. Some purchase records may need to be retained when law requires it. Contact us to make a request. We may need to verify your identity before acting on it.

9. Changes to This Policy

We may update this policy when our practices or legal obligations change. We will post the revised version here and update the date below.

10. Contact and Operator

For privacy questions or requests, email support@agentcharacters.com.

Required before launch: add the legal name and postal address of the person or entity responsible for operating AgentCharacters. Those details are not available in this repository and have not been invented here.