Privacy Policy

METALOM LTD (trading as 9AM Studios) is the data controller for the personal data described in this policy. We are registered in England and Wales under company number 16956239, with registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.

For any privacy question or to exercise your rights, contact privacy@9am.dev.

Analytics and attribution data. We use DataFast to understand how the site is used and which visits lead to purchases. It sets cookies containing a randomly generated visitor identifier (see section 4) and records pages visited, referrer, and approximate location derived from your IP address. We store a record linking that visitor identifier to a Tebex basket reference and, after a purchase, to the transaction reference.

Purchase attribution. When Tebex notifies us that a purchase has completed, we send the transaction amount, currency, transaction reference, our visitor identifier and the customer’s name, email address and customer reference to DataFast so the sale can be attributed to the original visit. This is the only routine circumstance in which we pass customer contact details to a third party for our own analytics.

Newsletter subscribers. If you subscribe, we add your email address to our audience list held by Resend, so we can send you product announcements and offers. We ask for nothing else.

Staff accounts. The store is administered through accounts we create. Public registration is disabled. For those accounts we hold a name, email address, a hashed password, an optional avatar image, and session records containing an IP address, browser user-agent string, session token and expiry time.

Support correspondence. If you email us or contact us on Discord, we keep the message and your contact details so we can answer and keep a record of the issue.

Server logs. Our hosting provider records technical request logs, including IP addresses, for security and reliability.

• Consent — for newsletter emails, and for non-essential cookies. You can withdraw consent at any time; see sections 4 and 8.
• Performance of a contract — for administering staff accounts and providing support in connection with a product you have bought.
• Legitimate interests — for keeping the site secure and available, preventing fraud and abuse, understanding which marketing works, and keeping records of support issues. We balance these against your rights, and you can object at any time.
• Legal obligation — where we must retain information or respond to a lawful request.

We ask for your permission before setting any non-essential cookie. Until you choose “Allow analytics”, the analytics script is not loaded and none of the cookies below are set. You can change your choice at any time using the Cookie Settings link in the footer of any page; if you decline or withdraw consent, we delete these cookies.

Once you consent, our analytics provider, DataFast, sets the following first-party cookies:

• datafast_visitor_id — a randomly generated identifier for your browser, used to recognise return visits and to attribute a purchase to the visit that led to it.
• datafast_session_id — identifies a single browsing session.
• datafast_visitor_first_seen_at and datafast_visitor_session_count — record when we first saw the browser and how many sessions it has had.

A related value, datafast_pageview_state, is kept in your browser’s session storage and is cleared when you close the tab. If you sign in to a staff account, an essential session cookie is also set; that one is strictly necessary and cannot be turned off without breaking sign-in.

The analytics cookies above are not strictly necessary, which is why we only set them with your consent. Declining costs you nothing: every part of the site works the same either way, and it has no effect on any purchase you have made. You can also block or delete cookies in your browser settings at any time.

We do not sell your personal data. We share it only with providers who process it on our behalf or who are independent controllers in their own right:

• Tebex Limited — merchant of record. Handles checkout, payment, tax and refunds as a separate controller.
• Cfx.re — delivers purchased assets to your Cfx.re account and operates the escrow system.
• DataFast — website analytics and purchase attribution, including the customer name and email described in section 2.
• Resend — stores our newsletter audience and delivers email.
• Vercel — hosts the website and processes request logs.
• Our database and file storage providers — store the records described above and the media shown on the site.

We may also disclose data where we are required to by law, or to establish, exercise or defend legal claims.

Some of these providers operate outside the United Kingdom, including in the United States. Where personal data is transferred outside the UK, we rely on the safeguards permitted under UK data protection law — typically an adequacy decision, or the International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses. You can ask us for details of the safeguards that apply to a particular transfer.

• Newsletter subscriptions: until you unsubscribe, after which we keep a suppression record so we do not email you again by mistake.
• Analytics and attribution records: for as long as they remain useful for measuring marketing performance, and no longer than necessary for that purpose.
• Staff accounts and their session records: while the account is active, and for a short period afterwards.
• Support correspondence: for as long as needed to resolve the issue and to handle any follow-up or dispute.
• Server logs: for the limited period our hosting provider retains them.

Records relating to a purchase are held by Tebex under their own retention policy, including for tax and accounting purposes.

Under UK GDPR, and equivalent EU rules where they apply to you, you have the right to:

• ask for a copy of the personal data we hold about you;
• have inaccurate data corrected;
• ask us to delete your data, where there is no overriding reason for us to keep it;
• ask us to restrict how we use it, or object to us using it on the basis of legitimate interests;
• receive data you gave us in a portable format;
• withdraw consent at any time, including by using the unsubscribe link in any newsletter; and
• complain to a supervisory authority.

To exercise any of these, email privacy@9am.dev. We will respond within one month. If your request concerns payment or billing information, we will point you to Tebex, who hold it.

If you are unhappy with how we have handled your data you can complain to the UK Information Commissioner’s Office at ico.org.uk, or to your local supervisory authority in the EU.

We use encrypted connections, store passwords only as hashes, and limit access to personal data to those who need it. No system is completely secure, but we take reasonable technical and organisational measures to protect the data we hold.

This website is not directed at children, and we do not knowingly collect personal data from anyone under 13. If you believe a child has given us personal data, contact privacy@9am.dev and we will delete it.

We may update this policy. The version on this page is the one that applies, and the date at the top shows when it last changed. Related documents: our Terms of Service, Refund Policy and End User Licence Agreement.