Privacy Policy

Banana Group.HK · Light Cluster Studio · Last updated: October 2026

This Privacy Policy explains how Light Cluster Studio (“LCS”) and Banana Group.HK handle personal data when you use bananagrouphk.com (the “Site”). It applies together with our Terms of Service.

1. Who is responsible

LCS operates the shop, buyer accounts, and download library on the Site. Payment processing is provided by Stripe; hosting and security are provided by Cloudflare; transactional email is sent through Resend when enabled. Purchase and entitlement records are stored in Cloudflare Workers KV (encrypted at rest by Cloudflare’s infrastructure).

2. Data we collect

• Buyer account (optional until checkout): Roblox user id and username; Discord user id and display name; email address after you confirm our verification link. We do not read your Discord account email via OAuth.
• Purchases: Product SKUs, order totals, Stripe Checkout session ids, payment status, and timestamps stored so we can show your library and prevent duplicate purchases.
• Payments: Stripe collects card and billing details on their forms. We receive payment outcomes and metadata (linked Roblox/Discord ids, SKUs) — not full card numbers on our servers.
• Cart: Line items you add may be stored in your browser’s localStorage until you clear them or complete checkout.
• Technical: IP address, user agent, and request logs via Cloudflare for security, abuse prevention, and debugging.
• OAuth: Roblox and Discord provide user ids and public profile fields only — we request scopes needed to identify your account, not your Discord email inbox.
• Stripe webhooks: We receive server notifications when checkout completes (session id, payment status) to unlock your library even if you close the browser early.

3. How we use data

• Verify buyers, deliver downloads, and record what you own.
• Process payments and prevent fraud, chargeback abuse, and file leaks.
• Send email verification links and (if configured) purchase-related messages.
• Operate Discord support for products you bought.

We do not sell your personal data. We do not use your data for third-party advertising profiles.

4. Legal bases (summary)

• Contract — to sell digital goods, deliver downloads, and support your purchases.
• Legitimate interests — fraud prevention, leak investigations, site security, and service improvement.
• Legal obligation — where we must retain records for tax, payment, or law enforcement requests.
• Consent — where you opt in (e.g. submitting your email for verification).

5. Cookies & storage

• bg_sess — signed session cookie so the Site remembers your OAuth links and buyer account while you browse.
• Stripe — may set cookies or local storage when you use Embedded Checkout on the Site.
• Cart storage — local only in your browser unless you proceed to checkout (then order metadata is sent to our server).

6. Processors & international transfers

Key providers and their roles:

• Stripe — payments and checkout fraud signals.
• Cloudflare — hosting, CDN, Workers, KV, and security logs.
• Resend — transactional email when enabled.
• Roblox and Discord — authentication only, under their respective policies.

These companies may process data in regions outside Hong Kong. Where required, we rely on their standard contractual safeguards and your acceptance of their terms when you use OAuth or pay.

7. Retention

Purchase records and buyer verification data are kept while you have an active relationship with us and as needed for accounting, disputes, and anti-leak enforcement. Session cookies expire according to server configuration; you can clear browser storage at any time (you may need to link accounts again). We may retain minimal purchase logs longer where needed to enforce licences or respond to payment disputes.

8. Security

We use HTTPS everywhere, signed session cookies, server-side checkout, and access-controlled downloads. No system is perfectly secure; report suspected account compromise to us on Discord promptly.

9. Your choices & rights

You can request access or correction of buyer data by contacting us on Discord. You may ask us to delete data where we have no legal reason to keep it; we may need to retain purchase records for tax, fraud, or licence enforcement even after deletion requests.

Clearing cookies or using a new browser will not transfer purchases — entitlements stay tied to the Roblox + Discord pair verified at checkout.

10. Children

The Site is not directed at children under 13. Roblox account holders must comply with Roblox’s own terms and age rules.

11. Changes

We may update this policy by posting a new version here with an updated date.

12. Contact

Questions: Light Cluster Studio Discord.

Legal hub & buyer guide · Terms of Service · Banana Group.HK