Privacy Policy
Effective 2026-05-17
This Privacy Policy describes how AlphaZero Studios LLC (“we”, “us”) collects, uses, discloses, and protects personal information when you use our website, admin, or storefronts powered by our platform.
1. Information we collect
From merchants
- Account info: name, email, business name, billing address, payment method.
- Identity / KYC: when you enable payments, Stripe collects legal name, address, date of birth, last four of SSN/EIN, bank account, and supporting documents. We don't store these directly — they live in your Stripe Connect account.
- Usage data: pages visited, features used, AI prompts, error logs, IP, browser.
We use Plaid Inc. (“Plaid”) to verify your bank account information for payouts. By connecting your account, you grant us and Plaid the right to access and use that information per this Privacy Policy and Plaid's End User Privacy Policy.
From shoppers (acting as a processor on behalf of merchants)
- Order info: name, shipping/billing address, email, phone, items purchased, totals.
- Payment info: handled by Stripe; we receive only a token, brand, and last four.
- Browsing data: session cookies, cart contents, pages viewed on the storefront.
From visitors entering the Virtual World (identity & biometric verification)
Entering our immersive “Virtual World” (the walkable 3D mall and avatar experience) is optional. If you choose to enter it, we ask you to verify your identity first, to confirm you are a real, unique person and to keep the space free of bots and duplicate accounts. Ordinary (non-immersive) shopping does not require this.
- What is collected, and by whom: our verification provider, Stripe Identity (Stripe, Inc.), collects a photo of your government ID and a selfie that includes a biometric facial scan used to match you to the ID. This collection and the biometric matching are performed and stored by Stripe as our service provider — see Stripe's Privacy Policy and Identity documentation.
- What AlphaZero Studios LLC receives and stores: we do not receive or store your ID images, selfie, facial geometry, full date of birth, or ID/document numbers. We store only: (a) a pass/fail verification result; (b) a coarse age-threshold flag (e.g. “over 18/21”); (c) your verified name and address, which you may edit; and (d) a one-way, non-reversible hashed token used solely to detect and prevent one person creating multiple accounts.
- Purpose: confirming you are a real, unique human for Virtual World access, and preventing duplicate or fraudulent accounts. We use it for nothing else.
- Consent: we obtain your informed consent before verification begins. You may decline — you simply won't enter the Virtual World, and can continue to shop normally.
- Retention & destruction: biometric identifiers and images are retained and destroyed by Stripe under its policies and our data-processing terms; AlphaZero Studios LLC never holds them. The verification result and hashed token are kept while your account is active and deleted within 90 days of account deletion, and in any case any biometric-derived data is permanently destroyed when the verification purpose is satisfied or within 3 years of your last interaction with us, whichever occurs first.
- No sale or profit: we do not sell, lease, trade, or otherwise profit from biometric identifiers or biometric information, and we do not disclose them except to Stripe to perform the verification or where required by law.
2. How we use information
- To provide, operate, and improve the Service.
- To process payments and prevent fraud.
- To send transactional email (receipts, password resets, order updates).
- To send service announcements; marketing email only with your consent.
- To comply with legal obligations and enforce our Terms.
3. How we share information
- Service providers: Stripe (payments), Plaid (bank verification for payouts), Amazon SES (email), Cloudflare (CDN/edge), Hetzner (hosting), Anthropic/Google (AI). They process data on our behalf under contract.
- Merchants: shopper personal data is shared with the merchant operating the storefront — they're the controller for that data.
- Legal: when required by law, court order, or to protect rights/safety.
- Business transfers: as part of a merger, sale, or financing, subject to notice.
We don't sell personal data.
4. Cookies and similar tech
We use strictly necessary cookies (session, cart) and, with your consent where required, analytics cookies. You can disable cookies in your browser, but parts of the Service won't work without session cookies.
5. Data retention
We retain account data for the life of your account and for up to 7 years after termination for tax/audit purposes. Shopper data is retained per the merchant's instructions and applicable law. Backups are pruned within 90 days. Identity-verification data is retained and destroyed as described in the “identity & biometric verification” subsection of Section 1.
6. Security
We use industry-standard practices: TLS for data in transit, encryption at rest for sensitive fields, audit logging, least-privilege access, and regular vulnerability scanning. Card data is handled in SAQ-A scope — it never touches our servers.
7. Your rights
Depending on where you live, you may have rights to access, correct, delete, port, or restrict processing of your personal data, and to object to processing or withdraw consent. You can exercise these by emailing privacy@alphazerostudios.com. For data we hold as a processor on behalf of a merchant, contact the merchant directly.
8. International transfers
We may transfer data to the United States and other countries. For EEA/UK transfers we rely on Standard Contractual Clauses and equivalent safeguards.
9. Children
The Service is not directed to children under 16, and we don't knowingly collect their personal data.
10. Changes
We'll update this policy and post the new effective date. Material changes will be flagged via email or in-product banner.
11. Contact
privacy@alphazerostudios.com
AlphaZero Studios LLC
6538 W 64th Pl, Chicago, IL 60638, USA