Privacy Policy: Transparent Data Practices

Shine GPL operates on a strict data minimization principle. We collect only the information required to create your account, verify manual payments, and protect the platform from abuse. We do not build advertising profiles, we do not collect behavioral analytics for resale, and we do not request access to your site data, server credentials, or payment card numbers.

Records we may store are limited to the following categories:

• Account identifiers: Username and email address you provide during registration or checkout. These are used for login, order association, and essential communication.
• Order verification material: Order reference number and, where you use manual payment methods, a transaction screenshot or receipt ID you submit. This is used only for payment audit and account activation.
• Support correspondence: Messages you send to our support team, retained only to resolve your request and maintain a record of the resolution.
• Temporary security logs: IP address and request timestamps recorded by rate limiting and firewall systems to block scraping bots, brute force logins, and download abuse. These logs are short lived and rotated automatically.

We do not collect phone numbers, physical addresses, government IDs, card details, or location tracking data. If you contact us, provide only the detail needed for us to help you.

Your information is used for defined operational purposes only. It is never used for advertising, profiling, or undisclosed secondary processing.

• Verification of payment proofs: Order references and screenshots are reviewed manually to confirm receipt of payment and activate the correct membership plan.
• Account access and download delivery: Your username and email link your membership to time limited download tokens. Tokens expire automatically and cannot be reused by third parties.
• Essential communication: Password reset emails, payment confirmation notices, download link delivery, and security alerts related to your account.
• Edge security and abuse prevention: Temporary IP logs are analyzed to enforce rate limits, block malicious bots, and preserve fair download bandwidth for all members.

If legal authorities request data, we disclose only what is legally required, and we will notify you where permitted by law.

Shine GPL uses only essential cookies and local session storage required for the site to function. We use zero third party advertising pixels, zero cross site trackers, and zero behavioral marketing cookies.

• Login session cookies: Standard WordPress authentication cookies that keep you logged in and remember your secure session. Without these, login and member downloads cannot work.
• Security and preference cookies: Short lived cookies for CSRF protection, rate limiting, and remembering basic display preferences such as dismissed notices.
• Local session storage: Temporary browser storage used for cart state or interface state during your visit. This data stays in your browser and is cleared when the session ends.

You can control cookies through your browser settings. Blocking essential cookies will prevent login and download access, but will not affect your ability to browse public pages. We do not use cookie walls for tracking consent because we do not run non essential tracking.

We apply layered technical and administrative controls to protect stored account records and data in transit.

• 256-bit SSL encryption: All account pages, checkout flows, and member downloads are served over TLS (HTTPS). Data exchanged between your browser and our servers is encrypted in transit.
• Password hashing: Passwords are never stored in plain text. They are processed with bcrypt via WordPress wp_hash_password with per user salts, so the original password cannot be retrieved from the database.
• Edge firewalls and access control: Web application firewall rules, bot filtering, and rate limits at the edge reduce scraping, injection attempts, and credential stuffing. Administrative access follows least privilege principles.
• Tokenized downloads: Download links use signed, time limited tokens tied to an active membership. Expired or shared links stop working automatically.
• Retention limits: Payment screenshots and temporary logs are kept only as long as needed for audit and security, then deleted or anonymized on a scheduled cycle.

No system is immune to risk. If a security incident affecting your personal data occurs, we will notify affected users and describe corrective action in line with applicable legal requirements.

Our practices are aligned with GDPR and CCPA principles, regardless of where you live. You retain control over your account record at all times.

• Right to access: Request a copy of the personal data we hold about you, including account details and order history.
• Right to correction: Request correction of inaccurate email addresses, usernames (where technically possible), or order records.
• Right to export: Receive your data in a common, machine readable format for portability.
• Right to deletion: Request complete account erasure. Upon verified request, we permanently delete your username, email, support tickets linked to your account, and submitted verification files, except where limited retention is required by law for fraud prevention or tax records.
• Right to restrict and object: Request that we limit processing to storage only while a dispute is resolved.

To exercise any right, contact us from your account email with the subject line: Privacy Request. We verify identity by matching the request to the account holder to prevent unauthorized deletion. We respond within 30 days, and deletion of backups completes within the next backup rotation cycle. Deleting your account ends access to member downloads and support tied to that membership.