Privacy policy

The controller within the meaning of the General Data Protection Regulation is Jack Jipp, trading under the business name Lyron, Grünstraße 43, 40667 Meerbusch, Germany.

The website runs on server infrastructure provided by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany. When a page is requested, the server processes technical log data including the IP address, date and time, requested URL, referrer, browser and operating-system information, HTTP status and amount of data transferred.

Requests to the website pass through the network of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, which sits in front of our server as a content delivery network and security service. Cloudflare processes the technical request data described above, in particular IP address, time, requested URL, referrer and browser information, to deliver the website quickly, cache static files and fend off attacks and abusive traffic. Cloudflare acts as our processor under a data processing agreement, is certified under the EU-US Data Privacy Framework and additionally provides Standard Contractual Clauses.

This processing is necessary to deliver the website, maintain stability, diagnose errors and prevent abusive access. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure and reliable operation of the service. Logs are retained only for as long as required for operations and security investigations, then deleted or anonymised; where a specific security incident occurs, they may be retained longer to preserve evidence.

When you submit a custom-webpart enquiry, we process your name, email address, optionally your company, budget and timeframe, and your project description. If you contact us directly, we also process the message and metadata you provide.

Processing takes place to answer your enquiry and take steps toward a contract under Article 6(1)(b) GDPR. Where a contact person acts on behalf of an organisation, processing is additionally based on Article 6(1)(f) GDPR; our legitimate interest is handling business communications.

If you subscribe to a launch notification, we store your email address, selected product and registration time solely to notify you when that product becomes available for sale. The legal basis is Article 6(1)(a) GDPR. You may withdraw consent at any time by email. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

To prepare a B2B purchase, we process the company, contact name, email address, Microsoft 365 tenant ID, selected product, language, price and discount identifiers, acceptance time, and version of the accepted terms. After payment confirmation we additionally process identifiers relating to Stripe Checkout, the payment and customer record, payment and invoice status, invoice link, licence and download status, and any refund or dispute events.

This data is required to process the order and licence agreement, provide the tenant licence key and private download, prevent abuse, provide support, and comply with commercial and tax obligations. The legal bases are Article 6(1)(b), (c) and (f) GDPR. Mandatory fields are required to conclude the contract; the purchase cannot be completed without them.

Lyron is the seller and contractual partner for the purchase and licence. We use Stripe as a payment service provider. Depending on the information supplied during checkout, Stripe processes identity, contact, billing, tax-ID, payment, device and transaction data to provide the checkout, authenticate and settle the payment, prevent fraud and support refunds. Stripe does not sell or resell the product and does not become a party to the purchase or licence agreement.

We receive the order and payment information required to deliver the product, issue the invoice and support the customer. Stripe processes payment data in accordance with its contractual and statutory obligations and describes its data-protection roles and safeguards for international transfers in its privacy policy. The legal bases for our disclosure and subsequent processing are Article 6(1)(b), (c) and (f) GDPR.

Purchase and delivery emails are sent through Resend, a service of Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA. This involves processing the recipient address, name, order information, message content, licence key, download link and delivery status. We do not use Resend for advertising tracking.

Processing is necessary to perform the contract under Article 6(1)(b) GDPR and for reliable delivery and evidence under Article 6(1)(f) GDPR. Resend stores service data in the United States. According to the provider, transfers are safeguarded by the EU-US Data Privacy Framework and, additionally, the EU Standard Contractual Clauses in its Data Processing Addendum.

SPFxStore does not use analytics, advertising or profiling cookies. When checkout is started, a random, technically necessary and HttpOnly-protected claim is stored in the browser. It is used solely to securely associate the order status and later delivery with the same browser and expires after 30 minutes. The legal bases are section 25(2)(2) TDDDG and Article 6(1)(b) and (f) GDPR.

To see which pages are visited, where visitors come from and how fast pages load, we use Cloudflare Web Analytics (same provider as in section 2). Each page loads a small script from Cloudflare (static.cloudflareinsights.com). It sends the page visited, the referring page, browser, operating system and device type as well as loading and performance values to Cloudflare; the country is derived from the IP address. The script sets no cookies, stores nothing on your device and builds no user profiles. According to Cloudflare, IP addresses and browser identifiers are not used to recognise individual visitors; we only see aggregated figures. The legal basis is our legitimate interest in designing the website according to demand and keeping it technically sound (Article 6(1)(f) GDPR). You can object by blocking scripts from static.cloudflareinsights.com in your browser, for example with a content blocker.

When you open Stripe Checkout, the payment page is provided by Stripe. Stripe may use technologies required for secure checkout, fraud prevention and payment processing. Product images, PDFs, fonts and videos are delivered from our own server via the Cloudflare network described in section 2; playing them does not transmit data to video or advertising networks.

Data is disclosed only to parties that require it for the purposes described: hosting and infrastructure providers (IONOS, Cloudflare), Stripe for payment processing, Resend for transactional emails, and carefully selected technical providers. Authorities or advisers receive data only where required by law or to establish, exercise or defend legal claims.

For transfers outside the European Economic Area, we rely on an adequacy decision or appropriate safeguards under Articles 44 et seq. GDPR, in particular Standard Contractual Clauses. More detail about Cloudflare, Stripe and Resend is available in the linked notices.

We retain personal data only for as long as the relevant purpose continues. Enquiry and contact data is deleted after communication ends if no contract results and no legitimate evidentiary interest remains. Launch data is deleted after the notification or withdrawal of consent. Order, invoice, licence and communication data is retained during the contractual relationship and afterwards in accordance with applicable commercial, tax and liability periods. Security and abuse evidence is retained only as long as required for prevention and legal enforcement.

Subject to the statutory requirements, you have rights of access, rectification, erasure, restriction of processing and data portability. You may object to processing based on legitimate interests for reasons relating to your particular situation and may withdraw consent at any time for the future.

You may also lodge a complaint with a data-protection supervisory authority, in particular the State Commissioner for Data Protection and Freedom of Information responsible for North Rhine-Westphalia.

We apply appropriate technical and organisational safeguards including encrypted transmission, private package storage, signed download claims, access restrictions and data-minimised logging. Lyron does not carry out solely automated decision-making with legal or similarly significant effects or profiling; Stripe may perform automated fraud and payment-security checks as described in its privacy information.

We update this policy if the services or applicable law change. For a purchase, the contractual-terms version displayed at checkout and stored with the acceptance time applies.