PRIVACY POLICY

LAST REVISED // OCTOBER 2026

At Arkhyron Official Store ("Arkhyron", "we", "us"), we value your privacy and are committed to protecting your personal information. This Privacy Policy explains what data we collect, why we collect it, how long we keep it, who we share it with, and what rights you have under the EU General Data Protection Regulation (GDPR).

1. Who We Are (Data Controller)

The controller of your personal data is Arkhyron Official Store, an online-only business operating through arkhyron.com. We do not operate a physical store. For any question or request regarding your personal data, contact us at arkhyron@gmail.com.

2. User Accounts & Registration Data

When you register or log in, we process your username, email address, a securely hashed version of your password (we never store your password in plain text), your optional profile avatar, an optional reference code, and the date your account was created. A one-time verification code (OTP) is sent to your email during registration and password recovery and expires after 5 minutes.

Legal basis: performance of a contract (providing your account and our services).

3. Cookies & Local Storage

We use your browser's local storage to keep you logged in (a signed session token, your username, email and avatar) and to remember your cookie-banner choice. This data stays in your browser and is removed when you log out or clear your browser data. We do not use advertising or tracking cookies.

Legal basis: strictly necessary for the functioning of the website.

4. Support Tickets & Services

When you submit support tickets, we store the ticket subject, messages, timestamps, conversation threads, and any service linked to the ticket. Services registered to your account (purchased or assigned packages) include the package name, cost, payment method, status, date and progress messages.

Legal basis: performance of a contract (customer support and service delivery).

5. Comments & Likes

When you comment on or like a news post, we store the comment text, the date, and the account (email) that posted it or liked the post. Your username and avatar are shown publicly next to your comments. Your email address is never shown publicly.

Legal basis: performance of a contract (providing community features to account holders).

6. Newsletter

If you subscribe to our newsletter, we store your email address to send you announcements, new packages and updates. You can unsubscribe at any time through the un-register page.

Legal basis: your consent, which you can withdraw at any time.

7. Email Notifications

We send transactional emails (verification codes, password recovery, order confirmations, service notifications and, if you enable it per ticket, replies to your support tickets) to your registered email address.

Legal basis: performance of a contract.

8. Payments (Stripe)

Payments are handled by Stripe Checkout. We never receive or store your card details; they are processed directly by Stripe. After a successful payment, we record the Stripe session ID, the purchased package, the amount paid, the payment method type and your email address, in order to register your purchased service. Stripe may also issue invoices on our behalf.

Legal basis: performance of a contract and compliance with legal (tax and accounting) obligations.

9. Security & IP Addresses

To protect accounts against abuse (for example repeated failed logins or excessive code requests), we temporarily process your IP address and email address in short-lived counters that are deleted automatically within about one hour. We do not use IP addresses for tracking or profiling.

Legal basis: our legitimate interest in keeping the website and your account secure.

10. Service Providers & International Transfers

We share personal data only with providers that help us run the website:

  • Cloudflare: website hosting, server logic and data storage, and the Turnstile security check on login, registration and password recovery forms (protection against bots).
  • Stripe: payment processing and invoicing.
  • Resend: sending emails.
  • Google Fonts, jsDelivr, Wikimedia: fonts and images loaded by your browser, which may receive your IP address.
  • YouTube: only when you view a post that contains an embedded video.

Some of these providers are located in or may process data in the United States. Such transfers are protected by appropriate safeguards, such as the EU-U.S. Data Privacy Framework or the European Commission's Standard Contractual Clauses. We never sell your personal data.

11. How Long We Keep Your Data

  • Account, tickets, services, comments and likes: for as long as your account exists, or until you ask us to delete them.
  • Payment and invoice records: for as long as required by Greek tax and accounting law.
  • Newsletter email: until you unsubscribe.
  • Verification codes: 5 minutes. Security counters: up to about one hour.
  • Unverified registrations: may be deleted at any time.

12. Your Rights

Under the GDPR you have the right to:

  • access the personal data we hold about you and receive a copy of it;
  • correct inaccurate data (you can update your username, avatar and password from your profile);
  • delete your account and data at any time from Profile Settings > Delete Account;
  • restrict or object to certain processing;
  • receive your data in a portable format;
  • withdraw your consent at any time (for example, unsubscribe from the newsletter).

We also email you a security notice whenever your password is changed or reset, two-factor authentication is turned on or off, or your account is logged out from all devices.

To exercise any of these rights, email arkhyron@gmail.com from the email address linked to your account. We will respond within one month. Some data may be kept where the law requires it (for example, invoices).

You also have the right to lodge a complaint with the Hellenic Data Protection Authority (www.dpa.gr).

13. Children

Our services are not directed to children under 15. We do not knowingly collect personal data from children under this age. If you believe a child has provided us with personal data, please contact us so we can delete it.

14. Changes to This Policy

We may update this Privacy Policy from time to time. The latest version will always be available on this page, with the revision date shown at the top.