Privacy Policy

MystikMotion is operated by the MystikMotion studio in Vadodara, Gujarat, India. This policy explains what we collect, why, how long we keep it and what you can ask us to do with it. It covers the website, your account and our emails.

What we collect

• Account details: your name, email address, password (stored only as an Argon2id hash — we never see it) and the terms version you accepted.
• Order details: what you bought, when, the amount, currency and the Cashfree payment reference. Card numbers never reach our servers.
• Usage data: pages you visit on our site, the browser and rough location derived from IP, kept to keep the site fast and secure.
• Support conversations: emails and messages you send us, so we can answer without asking you to repeat yourself.
• Optional marketing consent, which starts unticked and needs a second confirmation by email.

Why we collect it

• To create your account, deliver your files, issue licences and keep your download history.
• To answer support questions and honour refunds.
• To detect fraud, abuse and piracy of our templates.
• To send service emails — verification, receipts, licence certificates, security notices.
• To send marketing email only if you asked for it, and stop the moment you unsubscribe.

Cookies

Strictly necessary cookies keep you signed in and protect forms against cross-site request forgery; these cannot be switched off. Analytics cookies are optional and only load after you accept them in the cookie banner. You can reject them and still use the entire site.

Payment processing

Payments are handled by Cashfree. They receive the details needed to process the charge and are bound by their own privacy and PCI-DSS obligations. We receive only the outcome of the payment and a reference number — never your card.

Service providers

We share data with a small set of processors who help us run the shop: Cashfree for payments, an email provider for transactional and marketing mail, and hosting/CDN providers that store the site and the template files. Each processes data only on our instructions.

How long we keep it

• Account data: while your account exists, and 30 days after deletion in case you change your mind.
• Invoices and order records: retained as long as tax and accounting law in India requires.
• Support email: up to three years, so we can refer back to previous issues.
• Unconfirmed marketing signups: deleted automatically if never confirmed.

Your choices

• Download a copy of your data from Account → Profile.
• Correct your name or email at any time in your account.
• Delete your account from Account → Delete; deletion removes personal data we are not legally required to keep.
• Unsubscribe from marketing email with one click, or by writing to us.
• Ask us anything about this policy and we will answer in plain language.

Security

Passwords are hashed with Argon2id, sessions are HTTP-only and rotated on sign-in, tokens are single-use and stored as hashes, and access to production data is limited to the people who build and run the studio. If a breach ever affects your data, we will tell you what happened and what we are doing about it.

Children

MystikMotion is a professional marketplace and is not intended for anyone under 18. We do not knowingly keep data for children; if you believe a minor has created an account, contact us and we will remove it.

Changes and contact

If this policy changes in a way that affects you, we will email account holders before the change takes effect. Questions or requests: hello@mystikmotion.com, and our grievance officer details are on the grievance page.