Who this notice covers
Undermax operates this website and its purchase, redemption and support services. Contact [email protected] for privacy questions, access or correction requests, deletion requests, or purchase help. You do not need to register to email us.
This notice covers Undermax Friends and the website's plugin services. Desktop products may have additional notices: see Card Duel Studio privacy for local files and optional connected AI services. Payment and distribution providers publish their own notices.
Information used by each service
- Undermax Friends: itch.io account identifier, referral code, selected products, prices and discounts, payment status and PayPal transaction references, assigned download links, terms version and acceptance time. If you provide an optional receipt email, we use it for your order and access links. That email is encrypted in the Friends order database; this statement does not mean every system or email message is end-to-end encrypted.
- Code redemption: your itch.io account identifier, the code, email you provide, selected products, redemption status, assigned links and relevant security records. These records help fulfill and recover the correct redemption.
- Linked accounts and support: account identifiers and information needed by the connection you authorize, plus messages, attachments and diagnostic details you submit. Remove passwords, API keys, private download links and unrelated personal information from attachments.
- Account history: Purchases and connections use stable provider identifiers, so a changed username or email does not create a different owner. We record identity changes observed during sign-in or synchronization, purchase corrections, receipt attempts and security context. Receipt addresses may differ from account addresses. Sensitive operation details are encrypted and restricted to authorized administrators.
- Website operation: requests can include IP address, browser/app information, URL and time. Hosting or security logs and short-lived abuse controls help operate and protect the service. Friends rate limiting uses a keyed identifier derived from the request address.
Why we use it
We use this information to fulfill orders, link the correct products, send requested receipts, answer support requests, reconcile payments, prevent abuse and meet applicable recordkeeping obligations. An optional receipt email is not a newsletter subscription. We do not ask for your PayPal password or store full payment card numbers in the Friends order database.
Providers and access
Undermax is responsible for its storefront, product delivery and support. PayPal processes Friends payments and receives the order reference, product information and amount. Undermax sends payment instructions and receives transaction status, but does not operate PayPal or collect your PayPal password or full card details. itch.io provides product claiming, downloads and account services. Xsolla handles checkout for the offers routed to its platform. Donweb provides website hosting and email infrastructure. Cloudflare provides network protection, delivery and website performance analytics. These providers process connection and service data needed for their functions. Their operations may involve countries outside your own.
Authorized Undermax administrators can access order and support records. Friends associates purchases with a partner code for attribution and reporting; the public code does not expose customer records. We may retain or disclose information when required by law or necessary to investigate abuse and protect users. We do not sell personal information.
Provider notices: PayPal, itch.io and Xsolla.
Cookies, browser storage and retention
Essential session cookies support shared itch.io sign-in across the website, request validation and purchase continuity. Partner access uses a separate protected session. You can connect it to your signed-in itch.io account by verifying the Partner password; matching email addresses alone do not establish ownership. Partner passwords are stored as one-way password hashes, contact emails are encrypted, and recovery tokens are stored as hashes with a short expiry and single use. Administrators can issue temporary passwords, require a password change and invalidate sessions. Partners see only orders attributed to their own code, without customer emails, payment-provider identifiers or personal download links. Friends uses browser session storage to restore a cart after sign-in and an order in the same browser session. We retain the latest encrypted snapshot of your Undermax library from itch.io to display ownership checks; an unavailable check does not establish that a key is unclaimed. Payment providers may use their own cookies when their checkout loads. Blocking essential storage can interrupt these features.
Unpaid Friends attempts normally expire after 30 minutes. Abandoned, canceled or failed creation attempts with no authorization, captured payment or assigned product are eligible for deletion after 7 days; cleanup runs when the service is used. Payment and delivery evidence is retained for reconciliation and applicable obligations. An uncertain payment is reviewed rather than automatically deleted.
We retain records for the purposes above, including unresolved support, payment disputes and applicable legal obligations. Retention depends on the type of record and the obligation involved; it is not an unlimited promise to keep downloadable products available. Deletion requests may require retaining records that the law or an unresolved transaction requires. We can explain the applicable handling when you contact us.
Account security and optional insights
Essential sign-in records help protect accounts and investigate access problems. Optional account insights start disabled. If you enable Share insights in My connections, we record the supported site activity and license counts described in the account insights notice. Turning it off stops new optional events and removes your stored optional event history. The notice explains the separate retention periods for sign-in records and optional events.
Your privacy choices
You may request access, correction or deletion of your information and exercise other rights available under applicable law by emailing [email protected]. We may ask for information needed to verify the request without asking for account passwords. You may also contact your competent data-protection authority; in Argentina, see the AAIP's rights guidance.
Refunds and purchase cancellation
Digital purchases are normally final. Undermax does not offer discretionary refunds for a change of mind, accidental selection, unused access or compatibility requirements disclosed before purchase. Exceptional cases are reviewed individually, including duplicate charges, missing delivery or a material defect we cannot resolve. This policy does not restrict mandatory consumer rights or remedies available through your payment provider.
If an item is not delivered, a link is defective, a charge is duplicated, or the product does not match the offer, contact us with the order or receipt reference and a short explanation. You can also request a cancellation or refund using the same contact. Do not send payment-card details or account passwords.
No account required: email [email protected] to request help, cancellation or a refund. The Support Portal is an additional option.
- Friends / PayPal: include your Undermax order or PayPal transaction reference. Undermax reviews fulfillment and refund requests; PayPal's available dispute process also applies to the payment.
- Direct itch.io purchase: use the purchase support/refund options in your itch.io receipt or account. We can help investigate the product or delivery issue.
- Xsolla purchase: use Xsolla's refund support with your transaction reference. The specific policy shown at checkout governs that provider's process. Contact Undermax for redemption or product issues.
Friends supplies digital access after payment confirmation, with your express request to begin delivery immediately. Where applicable law allows, immediate digital supply may end a change-of-mind withdrawal right. That does not waive remedies for non-delivery, material defects or a product that differs from its description. Mandatory rights, provider dispute rules and their deadlines take precedence over our discretionary policy.
Requests are assessed using the purchase record and the reported issue. We may offer troubleshooting or replacement access where appropriate; a refund is not guaranteed merely because a request was submitted. If approved, it is processed through the original purchase provider and normally returned to the original payment method. Provider and bank processing times or exchange-rate differences may apply. Any affected license or download access may end following a full refund, without limiting non-excludable rights.
Notice updates
The date and version identify this notice. Changes do not remove rights applicable to an earlier purchase. Contact [email protected] if you need clarification or a copy of the terms associated with your order.