Privacy Policy

01Who is responsible for your data

This policy explains what personal data ASPI processes through the aspimenu.com website (the “Website”), your ASPI MENU account and the loader: for what purposes, for how long, who receives it and what rights you have. The data controller is ASPI, which provides ASPI MENU and operates the Website.

For any privacy matter, including exercising your rights, you can contact us by opening a ticket on our official Discord server (discord.gg/aspimenu).

We process your data in accordance with the General Data Protection Regulation (GDPR) and Spanish Organic Law 3/2018 on the Protection of Personal Data and guarantee of digital rights (LOPDGDD).

02Data you give us

We only ask for what we need to provide the service:

• Account: username, email address and password. Your password is not stored in our database: it is protected by the loader’s licensing system, which is where it is checked when you log in, both on the Website and in the loader. Only while you are confirming your email address during registration do we store it, encrypted, for a maximum of 30 minutes, so that we can create the account.
• Verification codes: we send you a code by email to confirm your email address when you register; to add or change your account’s email address; to add, change or remove your Discord; to turn on two-step verification; and to recover your password. We only store a cryptographic hash of the code, which expires after 10 minutes.
• Two-step verification (2FA), if you turn it on: the secret key for your authenticator app, stored encrypted.
• Discord, if you add it: your Discord ID, entered manually or obtained when you link your Discord account (in that case, Discord gives us your ID and your username; we do not store your Discord token). We use it to give you roles on our server and to identify you in support.
• Orders: the email address we send the key to, the plan, the amount, the payment method and the order status.
• HWID reset requests: the reason, the text you write and any screenshots you attach.
• Reseller program: your store’s name and links, your Discord ID, your message, your balance transactions and your key purchases. If you request that a key be blacklisted, also the reason, your explanation and any evidence you attach, which may include data about your buyers: in that case, you are the one providing it to us, and you must be legally entitled to do so.
• Support: whatever you tell us in Discord tickets, where Discord’s privacy policy also applies.

We do not ask for postal addresses, phone numbers, identity documents or dates of birth.

03Data collected automatically

• Technical connection data: IP address, approximate country, browser and device identification (user agent) and language, which are recorded with logins, orders, payments and security events.
• Browsing on the Website: using our own system and without cookies, we record the pages viewed, the path taken and any errors during each visit, together with the IP address and the browser identifier. After 30 days we delete the IP address, the browser identifier and the details of the pages viewed; the visit summary, without that data, is deleted after 90 days. We do not use any third-party analytics or advertising tools.
• Approximate prices in other currencies: while the currency is set to “Automatic”, we use the approximate country of your connection (as reported by Cloudflare’s network) to suggest yours, without storing it. If you choose a currency or turn the estimates off, that choice is stored only in your browser (Cookie Policy). We get the exchange rates from public sources without sending them any of your data.
• A random device identifier (the __Host-am_d cookie), so that we can block devices used for fraud or to get around a block (see the Cookie Policy).
• A security log of relevant events (logins, account changes, orders, payments, deliveries and blocked attempts) with the technical data mentioned above.
• Cloudflare Turnstile’s anti-bot check on registration, login, email codes, payment, key redemption and the internal panel.
• IP reputation analysis: to prevent fraud, we may query a specialized service (vpnapi.io) for the approximate location of the IP address, its network operator and whether it is a VPN, a proxy or a Tor node.

04Loader and licensing system data

For your license to work, the loader and the licensing system process your username and password (in protected form), the status and expiry of your license, the keys you redeem, your computer’s identifier (HWID) together with its processor and graphics card models, and technical data about your logins to the loader, such as the date and IP address. The Website retrieves this data to show you your license and your computer, and to process HWID resets.

If your key was sold by a reseller, that reseller can see whether it has been redeemed, when and under which username, in order to manage the sale and any potential fraud.

05What we use your data for and on what legal basis

• Creating and managing your account and your license, delivering your keys, processing HWID resets, running the reseller program and providing support: performance of the contract (Article 6(1)(b) GDPR).
• Sending you the necessary emails (codes, order confirmations, deliveries and notices about your account and your license): performance of the contract.
• Keeping the accounting and tax records of sales: compliance with a legal obligation (Article 6(1)(c)).
• Protecting the Website, the Software and our customers against fraud, abuse and attacks (Turnstile, rate limits, IP analysis, security logging and blocking of accounts, email addresses, devices and computers) and enforcing our Terms, including the blacklist: our legitimate interest (Article 6(1)(f)).
• Defending ourselves against chargebacks and claims with evidence of the order, the delivery and the use: our legitimate interest.
• Improving the Website with our own cookie-free browsing statistics: our legitimate interest.
• Giving you roles on our Discord server when you link your account: your consent (Article 6(1)(a)), which you can withdraw by unlinking Discord in your account.

We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly affect you. Automated checks may place an order or a request under review, but decisions such as blacklisting are made by a member of the team.

06Who receives your data

We do not sell or rent out personal data. We only share it with those who need it to provide the service:

• Stripe (card, Apple Pay, Google Pay and PayPal payments, and the other methods offered in the payment form, such as Klarna, Amazon Pay, Revolut Pay or Bizum): processes your card details in its own systems; we only receive data such as the card’s brand, type, last four digits and country. If you pay with Apple Pay, Google Pay or one of those other methods, its provider (for example, Apple, Google, Klarna or Amazon) is also involved and receives the data needed for the payment.
• PayPal (through Stripe): when you pay with PayPal, the payment is processed by Stripe; PayPal shares your name and your PayPal account email with Stripe, and we receive them to match the payment to your order.
• NOWPayments (cryptocurrencies): receives the order number and the amount in order to generate the payment invoice.
• ASPI’s shared infrastructure: ASPI also operates the aspishop.cc store, and some cryptocurrency payment notifications, as well as the sending of emails, go through systems that ASPI shares between its stores. That is why our emails may reach you from an address on the aspishop.cc domain. This is internal processing by ASPI and does not involve disclosing your data to third parties.
• Brevo (email delivery, a European Union company): processes your email address and the content of the emails we send you.
• Cloudflare (content delivery network, security, Turnstile and file storage): all Website traffic passes through its network, and it keeps the images you upload, such as screenshots for HWID resets, in private storage.
• The provider of the licensing system and the loader: processes the data described in section 4 so that you can log in and use your license.
• Discord: if you link your account, to verify who you are and give you roles on our server; and for support tickets, which are handled on Discord.
• vpnapi.io (IP reputation): receives only IP addresses, to prevent fraud.
• Authorities and courts, only where the law requires us to.

07International transfers

Some of these providers, such as Stripe, PayPal, Apple, Google, Amazon, Cloudflare and Discord, are established outside the European Economic Area or have systems there. In those cases, transfers are based on a European Commission adequacy decision (including the EU-U.S. Data Privacy Framework, where the provider is certified under it) or, where there is none, on the standard contractual clauses approved by the European Commission. Brevo is a European Union company, and our database is on our own server in the European Union.

08How long we keep your data

• Orders, payments and billing data: 6 years, to meet commercial and tax obligations.
• Account: for as long as it exists. If you delete it, we erase or anonymize its data, except for data we must keep by law or to defend ourselves against claims, and data needed to keep an active blacklist in place.
• Sessions: until you log out or the session expires (24 hours, or 30 days if you choose “Remember me”).
• Codes sent by email: until they are used or expire (10 minutes), and for at most one more hour. Registrations pending email confirmation: 30 minutes.
• Security logs, payment logs and logs of team actions: 2 years. Delivery, reseller and HWID logs: 1 year. Login and technical logs: 6 months.
• Payment gateway notifications: 6 months.
• Browsing: the IP address, the browser identifier and the pages viewed, 30 days; the visit summary, without that data, 90 days.
• Screenshots and evidence submitted with requests (HWID resets, blacklisting and disputes): for as long as they are needed to resolve the request and to defend ourselves against related claims.
• Blocks and blacklist entries: for as long as they remain active.
• Delivered keys: stored encrypted together with their order, so that we can show you your purchase and handle guarantee claims.
• Encrypted database backups: up to 30 days.

09How we protect your data

All traffic is encrypted (TLS). Our server has no ports open to the internet: it can only be reached through an encrypted Cloudflare tunnel. Keys, 2FA secret keys and other sensitive data are stored encrypted (AES-256-GCM); codes and data used for lookups are stored only as cryptographic hashes; and sessions use secure, HttpOnly cookies. Access to the internal panel is restricted to the team, with additional authentication, and the actions taken there are logged. We review and update these measures over time.

If a security breach occurs that poses a risk to your data, we will act as required by the GDPR, notifying the supervisory authority and, where appropriate, you as well.

10Your rights

You can, at any time and free of charge, access your data, have it rectified, ask us to erase it, restrict or object to certain processing, request a copy in a portable format and withdraw any consent you have given.

To exercise any of these rights, open a ticket on our Discord stating what you want. Before acting, we may ask you to prove that the account is yours (for example, with a code sent to its email address). We respond within one month, which may be extended by two further months in complex cases, in which case we will tell you. Please note that we must keep data subject to legal obligations, such as order billing records, even if you delete your account.

If you believe we are not handling your data properly, you can lodge a complaint with a supervisory authority; in Spain, the Spanish Data Protection Agency (AEPD, www.aepd.es).

11Minors

The Website and ASPI MENU are only for people aged 18 or over. We do not knowingly process the data of children under 14, the age of digital consent in Spain; if we discover that such data has been provided to us, we will delete it.

12Communications

We do not send advertising or newsletters. The emails we send you are only those needed for your account, your orders and your license. ASPI MENU news (updates, offers and restocks) is posted on our Discord.

13Links to other services

The Website links to third-party services, such as our Discord server and payment providers’ pages. When you are on one of them, its own privacy policy applies, and we recommend that you read it.

14Changes to this policy

When our practices change, we will update this policy and its date. We will announce significant changes on the Website and on our Discord. You can ask us for previous versions in a ticket.