Privacy Policy for Buyers

Last updated 12 October 2026

Moonbase is a platform that software makers use to sell their products, with Moonbase as the seller. This policy explains what personal data Moonbase processes when you buy from a store that uses Moonbase, use your account with that store, or download and activate what you bought, why, and what rights you have.

Merchants, who sell through Moonbase, and affiliates, who promote their products, have policies of their own: for merchants and for affiliates.

Who we are

"Moonbase", "we" and "us" mean Moonbase AS, a Norwegian company (registration number 931 730 258, Utsikten 6, 3718 Skien, Norway), and, for some sales in the United States, its subsidiary Moonbase LLC (30 N Gould St, STE R, Sheridan, WY 82801, United States).

You can reach us about anything in this policy at privacy@moonbase.sh.

Our two roles

Under data protection law, the "controller" decides why and how personal data is used, and a "processor" uses it on a controller's behalf. Moonbase is both, for different data:

• We are the controller of what we need as the seller: the record of your purchase, your payment and the evidence we keep for tax and consumer law. The seller on your receipt (Moonbase AS, or Moonbase LLC) is the controller of the purchase.
• We are a processor for the merchant for everything else we hold about a store's customers: your customer account with the store, your licenses and device activations, downloads, the emails the store sends you, the groups the store puts customers in, analytics, and the data the store sends to tools it connects. The merchant is the controller of that data, apart from a few purposes of our own described under "What we process for the merchant", and its own privacy policy applies to it.

If you are not sure who to ask, write to us and we will help, or pass your request on to the merchant.

Where your data comes from

Most of the data we process comes from you. The rest comes from:

• The store you buy from, which may import you as a customer or send us data about you through the tools it connects.
• Payment providers, which tell us the result of your payment and their fraud checks.
• Public VAT registers, which confirm the VAT number you give us when you buy as a business.
• Your device, which sends us your IP address, approximate location and browser details automatically when you use our services.

You need to give us the details asked for at checkout to buy. Anything else is up to you.

What we process as the seller

• Your name, email address, billing address, phone number if the store asks for it, and business name and tax or VAT number if you buy as a business.
• What you bought, the price, discounts, the tax charged, the currency and the seller.
• Your payment: the payment method and its details, such as a card's brand, country, last four digits and expiry, or your PayPal email address and name, and the payment provider's references. Our payment providers handle your full card details: we never see or store them.
• The IP address and approximate location (country, region, city, postal code and coordinates) of the device you bought from, which we keep as evidence of where you are for tax purposes, and to prevent fraud.
• If you are a consumer in the EU or EEA, your consent to immediate delivery and acknowledgement that you lose your right of withdrawal, with the time, your country and IP address.
• Refunds, chargebacks and your messages to us about your order.
• Where you came from, such as the referring site and campaign parameters in the link you used.

We use this to take your order and payment, deliver your purchase, send your receipt, handle refunds and disputes, calculate and pay sales tax and keep the accounts the law requires (legal bases: performing our contract with you, GDPR Article 6(1)(b), and complying with legal obligations, Article 6(1)(c)). We also use it to prevent fraud and abuse of our checkout and to defend legal claims (our legitimate interests, Article 6(1)(f)). Our payment providers screen payments for fraud using information about your payment and your device. We share the details of your purchase with the merchant whose product you bought, so it can support you and keep its own records.

If you subscribe, we keep your payment method with our payment provider so that renewals can be charged, until the subscription ends.

What we process for the merchant

• Your customer account with the store: your name, email address, address and other contact details, your business name and tax number if you gave them, your password (stored only as a hash), when you signed in, your communication preferences, details the store adds about you, and accounts you connect, such as iLok.
• Your licenses, trials and the devices you activate them on: the device's name (often its computer name), an identifier derived from the device, its operating system, browser and app version, other details the store's app sends, and the IP address and approximate location of each license check.
• Your downloads and redeemed vouchers.
• The emails the store sends you through us, in its name, including whether and when they were opened and which links were clicked.
• The groups and segments the store puts you in, which can decide the prices and offers you see, and analytics about your activity.
• Data the store sends to tools it has connected, such as email marketing services, license services like iLok, its own servers, or advertising and analytics tags on its own website.

The merchant decides how this data is used and how long it is kept, and is responsible for it, including for any consent it needs for marketing. Ask the merchant to access, correct or delete it, or to stop its marketing. You can also unsubscribe from marketing emails with the link in each one. If you contact us, we will refer you, or pass your request on, to the merchant.

We also use this data for a few purposes of our own, as a controller: to keep our services and payments secure, to detect and prevent fraud and abuse, and to work out the fees we charge the merchant (our legitimate interests, Article 6(1)(f)). We do not use it to market to you.

If a store closes

When a merchant stops selling through Moonbase, its store closes. You can no longer sign in to it, download from it or activate licenses on new devices through it. Licenses you have already activated are switched to work offline on that device the next time they are checked. We delete the data we processed for the merchant 30 days after the store closes, except the identifiers of licenses and activations that were revoked, deleted or have expired, which we keep so that we can keep honouring the others. We keep the records of your purchases for as long as the law requires, as described under "How long we keep data", and you can still contact us about them.

When you visit a store

When you visit a store, checkout or customer portal that uses Moonbase, our servers and our hosting provider record technical information such as your IP address, approximate location, browser, and the pages requested, to deliver the site, keep it secure and prevent abuse (Article 6(1)(f)). We keep these logs for up to 90 days. Cookies and similar technologies are described below.

Automated decisions

Our payment providers screen payments for fraud automatically and may decline a payment they consider risky. A merchant can also set prices and offers for groups of customers based on rules it chooses.

Who we share data with

We do not sell personal data. We share it only as described in this policy:

• The merchant whose product you bought, for your purchase and the data we process for it.
• Payment and tax partners: Stripe (payments and tax calculation), Adyen (for some payments, where relevant), PayPal (when you pay with PayPal, which handles your payment as a controller under its own privacy statement), Numeral (US sales tax) and the banks involved in a payment.
• Service providers that work for us under contract: Amazon Web Services (hosting, storage and email sending), Google (data warehouse and address autocomplete), Cloudflare (download delivery and bot protection), Tinybird (analytics), Typesense (customer search for merchants), Sentry (error monitoring), PostHog (product analytics of the merchant dashboard, which can show your details), Gravatar (profile pictures shown next to customers in the merchant dashboard, looked up from a hash of your email address), and Tripletex (accounting).
• Tools the merchant connects, on the merchant's instructions, as described above.
• Moonbase AS and Moonbase LLC, between themselves.
• Authorities, courts, auditors and advisers, where the law requires it or to establish or defend legal claims.
• A buyer of our business, if all or part of Moonbase is sold or merged, under this policy.

Where your data is processed

We store our data with Amazon Web Services in the EU (Ireland), and our data warehouse with Google in the EU (Belgium). Some of our service providers, such as Stripe, Google and Cloudflare, are based in the United States or process data there, and sales by Moonbase LLC are processed in the United States. When personal data leaves the European Economic Area, we rely on an adequacy decision of the European Commission, such as the EU-US Data Privacy Framework, or on the European Commission's standard contractual clauses. Contact us for a copy of the safeguards.

How long we keep data

We may keep data longer where we need it for a legal claim, an investigation or a dispute that is still open.

How we protect data

Data is encrypted in transit and at rest, access to it is limited to the staff who need it, changes to it are recorded, passwords are stored only as hashes, and the most sensitive identifiers are encrypted with separately managed keys. No system is perfectly secure; if a breach puts you at high risk, we will tell you.

Your rights

You have the right to:

• get a copy of the personal data we hold about you;
• have inaccurate or incomplete data corrected;
• have your data deleted, where we no longer need it or have no other legal basis to keep it;
• restrict our use of your data, or object to it, where we rely on our legitimate interests;
• receive data you gave us in a portable format, or have it sent to someone else;
• withdraw a consent you have given, at any time, without affecting what was done before; and
• ask a person to review an automated decision.

For data we hold as controller, write to privacy@moonbase.sh. For data we process for a merchant, contact the merchant first; we will help it respond. We answer within one month, free of charge, and may ask you to confirm your identity first. We cannot delete the records the law requires us to keep, such as the records of your purchases.

You can complain to the Norwegian Data Protection Authority (Datatilsynet, www.datatilsynet.no), or to the data protection authority where you live or work. We would appreciate the chance to deal with your concern first.

Cookies and similar technologies

Cookies and browser storage let a site remember things between pages and visits. We use:

• Sign-in: a cookie that keeps you signed in to a store's customer portal for up to 14 days after your last visit, and, where a store uses our storefront on its own website, your sign-in and account details kept in that website's browser storage. These are needed for the service you ask for.
• Shopping: browser storage that keeps your cart, the store's catalogue and the campaign link you arrived through. This is needed for the store to work.
• Preferences: browser storage that remembers choices such as a dismissed promotion or a display setting.
• Payments: our payment providers set cookies and collect information about your device to process your payment and prevent fraud: Stripe on a store's pages and at checkout, Adyen at checkout for the payments it handles, and PayPal when you pay with PayPal. These are needed to pay.
• Bot protection: on stores that ask for it, Cloudflare Turnstile checks that you are a person when you create an account or place an order that costs nothing. It can receive your IP address and may set its own cookies.
• Error monitoring: Sentry records errors and how fast pages load, and, in a small share (1%) of visits to stores and checkouts and in visits where something goes wrong, a replay of the page with all text and images hidden, so we can fix problems. It does not set cookies.
• Address autocomplete: Google Maps, to complete your address as you type at checkout. It can receive your IP address and may set its own cookies.

A store may also run its own analytics and advertising tags on its own website, including tags our storefront passes your email address to when you sign in or create an account. When you buy through our storefront on a store's website, the details of your order, including your name, email address and billing address, are made available to that website. The store is responsible for its website and tags, under its own policy. You can block or delete cookies in your browser, but signing in and paying may then stop working.

If you live in the United States

We do not sell personal information, and we do not share it for cross-context behavioral advertising. Depending on the state you live in, you may have the right to know what personal information we collect and how we use it, and to access, correct or delete it. Write to privacy@moonbase.sh to use these rights; we will not treat you differently for doing so. Tags a store runs on its own website are that store's responsibility.

Children

Our services are not directed at children under 16.

Changes to this policy

We update this policy when what we do changes, and show the date of the latest version at the top.