Placeholder — this text has not been reviewed by a lawyer and must be replaced before launch. Bracketed values must be filled in, and the processor list must be re-checked against what the site actually runs on launch day.
Last updated: September 30, 2026
Who is responsible
Lean Commerce LLC, trading as Centarro, is the controller of the personal data described here. Postal address and registration details are in the legal notice. Privacy contact: store@centarro.io. [If a Data Protection Officer or an EU/UK representative is appointed under GDPR Art. 27, name them here.]
What we collect and why
| Data | Why | Legal basis (GDPR) |
|---|---|---|
| Account: email address, password hash | To give you an account, a license page and order history | Performance of a contract |
| Order: name, billing address, order contents, price, tax data | To sell you a license and meet accounting and tax duties | Contract; legal obligation |
| Payment: card details are entered on our payment processor's form and never reach this site; we store the processor's transaction reference and the outcome | To take and reconcile payment, and to refund it | Contract |
| License: license key, term, state, the Private Packagist customer identifier and its access token | To grant, renew and withdraw package access | Contract |
| Email: transactional messages we send you (order receipt, fulfilment, expiry notices) | To deliver what you bought and warn you before it expires | Contract |
| Server logs: IP address, request time, user agent, requested path | Security, abuse prevention and debugging | Legitimate interest |
We do not sell personal data, we do not share it for advertising, and we do not use it for automated decision-making or profiling.
Who processes it for us
- Stripe — payment processing. Card data is collected by Stripe directly on its hosted payment element and is not stored by us.
- Private Packagist (Packagist.com, Packagist Ltd.) — package delivery. Each license creates a Packagist customer identified by a generated project slug. We do not send your name or email address to Private Packagist.
- Upsun — hosting of this site, its database and backups, in the United States (US East), and delivery of transactional email.
- Slack — delivery of live chat messages to our team, only if you use the chat: your name, email address, the messages and any files you send.
- Google (Google Fonts) — delivery of the web fonts this site uses. Your browser loads them from Google's servers, which receive your IP address and browser details when a page is displayed.
Each of these acts on our instructions under a data processing agreement. Where a transfer leaves the European Economic Area or the United Kingdom, it relies on the European Commission's Standard Contractual Clauses or an adequacy decision.
Cookies and tracking
The store sets a session cookie when you log in or use the cart, and a cookie recording your consent choices. No analytics or advertising cookies are set. The live chat loads only after you allow it in the consent settings; it keeps the current conversation in your browser's session storage. Web fonts are loaded from Google Fonts, as described above.
How long we keep it
- Account and license records: for as long as the account exists, and for 5 years after its deletion where a license may still be reinstated.
- Orders, invoices and tax records: 7 years, as required by tax law.
- Server logs: 90 days.
- Email we sent you: 5 years.
Your rights
Subject to the law that applies to you, you may ask for a copy of your data, its correction or its deletion; object to or restrict processing; and receive it in a portable format. Write to store@centarro.io and we will answer within one month. If you are in the EEA or the UK, you may also complain to your national supervisory authority. Deleting your account ends your licenses and withdraws package access.
Security
The site is served over HTTPS, passwords are stored hashed, and access to production data is limited to the people who operate the store. No system is perfectly secure; if a breach affects your data, we will notify you and the relevant authority where the law requires it.
Children
The store is sold to businesses and professional users and is not directed at children under 16.
Changes
We will post any change on this page and update the date above. Material changes will also be sent to the email address on your account.