Privacy notice — SANDOFE sales and creator accounts

Version 2026-09-10-creator-1 · 10 September 2026

Controller and contact

SANDOFE LTD, company number 17445988, is the controller for this store. Registered office: Suite 631, The Linen Hall, 162-168 Regent Street, London, United Kingdom, W1B 5TG. Contact support@sbloccaora.com for privacy requests.

Information and purposes

We process your purchase email, selected guide, content or collection, price and currency, order and payment-provider references, payment/refund/dispute status, delivery and access records, language, checkout acknowledgements and accepted document versions. For tips we also process the named creator, amount and optional sender name and message. Checkout records a hashed IP value; hashing does not necessarily make information anonymous. These records allow us to process and deliver your order, attribute creator compensation, recover access and provide support, on the basis of performing our contract with you.

Creator accounts include public profile details, uploaded content and previews, verification documents and review results, accepted creator terms, internal compensation records, bank/payment-recipient details and payout requests. We use these to operate the creator agreement, verify identity and rights, prevent fraud, manage content reports and process manual payouts. Public profiles, published offer descriptions and previews are visible to visitors; verification documents and bank details are not public. Only provide documents through the designated private verification flow, not through public uploads or ordinary support messages.

We process accounting records where required by law. We rely on legitimate interests to prevent abuse, investigate payment discrepancies, secure the site and handle complaints. Technical information can include IP addresses, timestamps, browser/device information, request and error records. If you use an account, we also process authentication and profile information. Support requests contain the information you choose to send, together with communication and delivery records. Please do not send sensitive documents, card numbers or authentication codes.

The purchase email is necessary to deliver and recover access. Account registration is not required to buy a guide. We do not sell personal data or use this store for advertising profiling. Payment providers may perform their own fraud and compliance checks; contact support about an unsuccessful order or the provider about its own processing.

Payment providers and other recipients

When you choose Stripe or Revolut, we send the selected provider the information needed to create and reconcile the order, such as email, amount, currency, description and order reference. You enter payment details on its hosted checkout, not into SbloccaOra's servers. We receive payment results and references; our integration does not collect full card numbers or CVV. The provider processes additional payment, billing, device and fraud-prevention information under its own applicable terms and notice. Providers can act as controllers for their own obligations as well as processors for specified services. See Stripe Privacy, Revolut Privacy and, when used, Revolut Pay Checkout Privacy.

Hetzner hosts the application. Supabase supplies database, authentication and private file storage. Resend sends transactional and account emails, processing recipients, message content and delivery records. Authorised staff and advisers may access information needed for support, security, accounting or legal matters. Relevant data may be disclosed to authorities when required by law or necessary to protect legal rights.

The attributed creator can see information provided by the creator dashboard for their own transactions, including amounts, transaction references, any sender name/message and buyer email where needed to handle the transaction. Creators must use it only for the sale, support or contractual obligations, not unsolicited marketing. They do not receive full payment-card details. SANDOFE supplies the relevant recipient and bank information to its bank when executing a manual payout.

Providers and their subprocessors may process data outside the UK or EEA; an EU hosting region does not guarantee that every provider operation stays there. Resend states that stored email data resides in the United States. Published transfer arrangements include contractual safeguards where applicable. See Resend data location, Resend DPA, Supabase DPA and the payment-provider notices above. Contact us for information about safeguards applicable to your data.

Retention and security

We retain order, payment and accounting records for the applicable legal retention period and while needed to handle delivery, refunds, disputes or legal claims. Account and support information is retained while needed for the relevant service, security or outstanding request, then reviewed for deletion or anonymisation. Provider backups, delivery logs and security records have separate retention schedules. Deleting browser cookies or closing an account does not automatically remove legally required transaction records.

Files are private and delivered through controlled, expiring links. Keep access and recovery links confidential. No service can guarantee absolute security. See the Cookie notice for browser storage.

Verification files and bank details have restricted access and are reviewed for deletion when no longer needed, subject to fraud investigations and legal holds. Closing a creator account does not erase outstanding payouts, customer access rights or legally required financial evidence. Contact us for the retention arrangements applicable to a specific record.

Your rights

Depending on applicable law, you may request access, correction, erasure, restriction or portability and object to processing based on legitimate interests. We may perform proportionate identity checks. Contact support@sbloccaora.com or the registered office. You may complain to the UK ICO or the competent authority in your country. Your rights concerning a payment provider's independent processing can also be exercised with that provider. Material changes to this notice are dated and versioned.