Privacy policy

As a global developer community and digital listing directory, the types of data we collect and process under the principle of data minimization include:

• Account Data: Your name, username, email address, and billing/invoicing information that may be requested for your transactions on the Platform.
• Technical & Security Data: Your IP address, browser type, operating system, session identifiers, and security logs used for anti-fraud and DDoS/cybersecurity protection.
• Transactional & License Verification Data (OEM Key System): Records of the digital products, VIP/Developer membership packages, or licenses you acquire, along with the target domain names (website URLs) you register in our system to generate and validate your OEM product license keys.
• Vendor Verification (KYC & Trader Traceability) Data: For users upgrading to Vendor (VIP/Developer) status, identity, corporate/tax details, and contact verification records required under applicable marketplace and Digital Services Act (DSA) regulations.
• Payment Security (Zero Card Storage): Your credit card, bank, or sensitive payment credentials are never hosted, processed, or stored on XenForest servers. All financial transactions are conducted directly through independent external payment gateways (e.g., Stripe, PayPal) and are governed by the respective payment provider's PCI-DSS security standards and Privacy Policy.
• User-Generated Content & Support Data: Forum posts, uploaded media files, code snippets, private messages, and temporary technical credentials (such as website URLs, admin panels, or FTP/SSH details) that you voluntarily transmit during technical support, installation, or troubleshooting requests.
• Profile Privacy Controls: Our Platform allows you to manage how your account appears to other users. You can customize your online status, recent activity visibility, and communication preferences at any time via your account settings.
• Children's Privacy (COPPA & Age Compliance): Our services are intended for users who meet the minimum legal registration age specified in our Terms and Rules. We do not knowingly collect personal data from anyone below the required minimum age threshold, and commercial/vendor privileges strictly require reaching the legal age of majority. Upon detection of a false age declaration, the respective account and associated data will be immediately deleted.

We collect some or all of this information when you register as a member, fill out our contact form, browse this site (see our Cookie Policy), purchase a digital product or membership package, register a licensed domain, or create a support ticket.

We process your personal information strictly on valid legal grounds—namely Contractual Necessity, Legitimate Interests, Legal Obligations, and your explicit Consent—in the following ways:

• Service Provision & Licensing (Contractual Necessity): To register and manage your account, generate OEM product licenses, and allow you to contribute content to our ecosystem.
• Listing Directory Operations (Contractual Necessity): To provide the technical directory infrastructure enabling verified independent vendors on the Platform to showcase their products, verify buyer licenses, and fulfill customer orders.
• Support and Operational Processes (Contractual Necessity): To securely process the technical data you transmit in order to carry out requested technical support, bug resolution, or installation services.
• Cybersecurity & Fraud Prevention (Legitimate Interest): Your IP address and technical logs are recorded when you perform key actions to prevent unauthorized access, multi-accounting, piracy/nulling, spam, and fraudulent chargebacks. Your IP address is never shared publicly.
• Regulatory Compliance (Legal Obligation): To comply with international tax, anti-money laundering (AML), copyright (DMCA), and marketplace traceability (DSA) laws.
• Communication: To inform you of critical Platform updates, product version releases, security alerts, and relevant activity on your account.

Strict No-Sale Guarantee: XenForest never sells, rents, or trades your personal information to data brokers, third-party advertisers, or unauthorized external entities under any circumstances.

Because XenForest operates as an independent P2P listing directory, purchasing a third-party plugin, theme, or service listed on our system means you are transacting directly with the relevant independent vendor. To facilitate these transactions, license delivery, infrastructure security, and technical support:

• Independent Vendors (Sellers): We share only the minimal necessary transaction data (such as your username, email address, licensed domain, and license key) with the specific vendor whose product you purchased. Under our Vendor Agreement, sellers act as independent data controllers strictly for order fulfillment and support, and are contractually prohibited from using your personal data for unsolicited off-platform marketing or sharing it with third parties without your explicit consent.
• Infrastructure and Security Providers: To provide uninterrupted and secure service, technical traffic data may be processed by trusted infrastructure, DDoS protection, and cybersecurity partners (e.g., Cloudflare) operating under GDPR-compliant Data Processing Agreements (DPAs) and Standard Contractual Clauses (SCCs) for international data transfers.

We are committed to ensuring that any information you provide to us is protected. To prevent unauthorized access, alteration, or disclosure, we employ industry-standard TLS/SSL encryption, hashed credentials, Two-Factor Authentication (2FA) support, isolated server infrastructure, and strict access controls.

Data Retention: We retain your personal and account data for as long as your account remains active or as needed to provide you with services and active software licenses. Any temporary credentials shared for technical support (e.g., FTP/admin access) are purged immediately upon ticket completion. Please note that even if you request account deletion, we are legally required to retain specific financial, licensing, and transactional logs (e.g., invoice/subscription records, KYC verification, and IP logs tied to commercial transactions) for up to seven (7) years to comply with international tax, anti-money laundering (AML), and legal defense obligations.

Cookies are small text files set by us on your device (computer, smartphone, tablet, etc.) that enable essential site functionality, such as keeping you securely logged in, protecting forms against Cross-Site Request Forgery (CSRF), and remembering your interface preferences (such as Light/Dark theme selection).

We provide a comprehensive breakdown of the cookies we set and how you can manage your preferences on our Cookie Policy page.

As a global platform, we believe that privacy is a fundamental right. Regardless of your country of residence, we extend high standards of international data protection (including UK/EU GDPR and CCPA) to all our users worldwide. You have the following rights regarding your personal data:

• Right to Access & Data Portability: You have the right to request confirmation of the personal data we hold about you and obtain a structured, machine-readable copy of it.
• Right to Rectification: If you believe the personal information we hold for you is incomplete or inaccurate, you may update it in your account settings or ask us to correct it.
• Right to Restrict or Object to Processing: You have the right to object to specific non-essential processing activities or withdraw optional consent at any time.
• Right to Erasure (Right to be Forgotten): You have the right to request the deletion or anonymization of your personal data. Please note that under GDPR Article 17(3), this right is not absolute and does not apply where retention is necessary for compliance with legal/tax obligations, the defense of legal claims, or preserving the integrity of public community discussions (where your username is anonymized while keeping thread continuity intact).

To exercise any of these rights, please contact us. We do not discriminate against any user for exercising their privacy rights. In the event of a severe personal data breach that poses a high risk to your rights and freedoms, we commit to notifying affected users and relevant supervisory authorities within 72 hours of becoming aware of the incident.

Continued use of our Platform signifies your acceptance of this policy. If you do not accept this policy, please discontinue use of the Platform. When registering an account or completing transactions, we will request your explicit acceptance of this Privacy Policy.

We may update this policy periodically to reflect changes in international legal requirements or Platform features. You may be asked to review and re-accept the updated policy if significant material changes occur in the future.