Klienci z USA i Ameryki Łacińskiej: błąd przy płatności został naprawiony, możesz znowu płacić!

Medal Capes
Polski
£ GBP
Zaloguj się Koszyk

Informacje prawne

Polityka prywatności

Ten dokument jest dostępny w języku angielskim. Wiążąca jest wersja angielska.

Last updated: 3 November 2026

This privacy policy explains how Medal Capes ("we", "us") handles personal data when you visit medalcapes.com, buy a cape, contact us, join our Discord server or take part in our partner program. We process personal data in line with the EU General Data Protection Regulation (GDPR).

1. Who is responsible

The controller for the processing described here is Medal Capes. For anything about your personal data, email info@medal-capes.com.

2. What we collect, why, and on what legal basis

  • Orders. Your email address, full name, billing country, the capes you order, price, any discount code, payment method and status, the site language, and the IP address and browser type used at checkout. We need this to deliver your order, send your confirmation and order emails, give you access to your codes, handle questions and refunds, and keep our accounts. Legal basis: performance of the contract (art. 6(1)(b) GDPR) and our legal obligation to keep financial records (art. 6(1)(c)). The IP address and browser type are kept to prevent fraud (legitimate interest, art. 6(1)(f)). Your email address, name and country are required to place an order; without them we cannot deliver.
  • Hero Cape activation. For capes we activate on your account, you open a ticket on our Discord server and we sign in with a one-time Microsoft sign-in code you give us. We never ask for or store your password. Legal basis: performance of the contract.
  • Code reveals. When a code is shown on your order page we log the time, IP address and browser type. This protects you and us in case of disputes or misuse (legitimate interest).
  • Discount codes. Every discount code entered at checkout is logged with the result, IP address, browser type and, if given, your email address. After 5 wrong codes within an hour, discount codes are temporarily blocked for that IP address. This prevents guessing of codes (legitimate interest). If you are blocked by mistake, contact us.
  • Creator codes. If you use the code of one of our partners (YouTubers), that partner sees in their partner dashboard the date, the capes, the amount paid and their commission for your order. They never see your name, email address, country or order number.
  • Review request. About a day after delivery we send one email asking you to review your order. Legal basis: legitimate interest in feedback from customers. Reply "stop" to that email if you do not want it, and we will not send it again.
  • Reviews. If you rate a cape from your order page, we publish your star rating, your review text and the name you enter (we suggest your first name and last initial) on that cape's page, with the date. Your email address and order details are never shown. Legal basis: your consent (art. 6(1)(a)); you can change your review at any time from your order page, or ask us to remove it.
  • Customer account (optional). Your email address and a hashed password, stored by our authentication provider Supabase. Legal basis: performance of the contract.
  • Support messages. Your name, email address, optional order number and your message, received by email. Legal basis: performance of the contract or, for general questions, our legitimate interest in answering you.
  • Discord (optional). If you connect Discord on your order page, we store your Discord user ID with the order and use it once to add you to our Discord server with the customer role. We do not receive your Discord password or email address. Legal basis: your consent; you can leave the server or remove the role at any time.
  • Giveaways on Discord. When you enter a giveaway (by reacting to the pinned message in a giveaway channel), we check your Discord username and user ID, whether you are still a member of our server and whether you show our server tag, and we pick winners at random. Winners send us a screenshot as proof of the entry requirements (such as a YouTube subscription) in a ticket. We use this only to run that giveaway and deliver the prize. Legal basis: performance of the giveaway you enter (art. 6(1)(b)).
  • Invite rewards on Discord. If you get a personal invite link (with /invite-link in our Discord server), we store your Discord user ID, your Discord name and your link. When someone joins with your link, they sign in with Discord (we receive their Discord user ID and name, not their password or email address) and our bot adds them to the server; we store who invited them, when they joined and when their Discord account was created (derived from the user ID, to keep out new alt accounts). Every 5 minutes we check whether invited members are still in the server, and we show the invite counts of the top inviters with their Discord name on a leaderboard in the server. If you claim a reward, we store which cape you chose and the discount code we gave you. If a member of our staff gives you a cape (an invite reward, a giveaway prize or as support), we also store your Discord name (for invite rewards your Discord user ID), which cape, the one-time code, the reason and which staff member gave it; our staff see this list so nobody gets the same reward twice. If you break the invite rules (for example join-for-join, trading invites, alt accounts or bots), our staff can disqualify you: we store your Discord user ID, name, the reason and who decided it, switch off your unused reward codes, and post your Discord name and the reason in the #hall-of-shame channel of our server. You can ask us to review this in a ticket. Legal basis: performance of the invite program you take part in (art. 6(1)(b)); for invited members and for disqualifications, our legitimate interest in counting invites fairly and keeping the program free of abuse (art. 6(1)(f)).
  • Visitor statistics. To see which pages are visited most, we count page views with the page address, site language, the website or link that referred you, your country (derived by our host from your connection) and your device type (mobile, tablet or desktop). To count unique visitors per day we combine your IP address and browser type with a random value that changes every day and is then deleted, and store only the resulting code; your IP address itself is not stored and you cannot be followed from one day to the next. We use no cookies or local storage for this and only look at totals. Legal basis: our legitimate interest in improving the website.
  • Language and currency. Until you choose them yourself, we show prices in a currency that fits the site language (for example your own currency on the Spanish site if you are in Mexico), and visitors from Poland see the Polish version of the site. For this our host derives your country from your connection on each visit; we do not store it. If you are sent to the Polish version, we remember that in the mcs_lang cookie. Exchange rates come from a public rates service that our server queries; no visitor data is sent there. You always pay in euro. Legal basis: our legitimate interest in showing the shop in a familiar language and currency.
  • Bot protection. Sign-in, registration and support forms use Cloudflare Turnstile to tell people from bots. Cloudflare processes your IP address and technical browser data for this. Legal basis: our legitimate interest in protecting the site against abuse.
  • Partner program. For partners (creators) we process their name, YouTube channel, discount code, commission and vouchers, and for the partner portal a username, a hashed password, an encrypted two-factor secret and sign-in attempts with IP address. Legal basis: performance of the partner agreement and our legitimate interest in securing the portal.

We do not see or store your bank, PayPal or card details. Those are entered with and processed by our payment providers: Mollie B.V. for billing addresses in the EU and for PayPal, and Stripe for card and Google Pay payments with a billing address outside the EU. With a billing address in the United States, Stripe sells the order to you as reseller (merchant of record, shown as "Sold through Link") for card, Apple Pay, Google Pay and other payment methods offered on its checkout page, and Link sends you the receipt. Each acts as an independent controller for the payment under its own privacy policy.

We do not take decisions about you based solely on automated processing that have legal or similarly significant effects. The temporary discount-code block described above is a security measure only.

3. Who receives your data

We share personal data only with service providers that we need to run the shop, under agreements that oblige them to protect it:

  • Mollie B.V., the Netherlands (payments)
  • Stripe Payments Europe, Ltd., Ireland (payments with a billing address outside the EU)
  • Supabase (database and authentication, hosted in the EU)
  • Netlify (website hosting)
  • Postmark by ActiveCampaign (sending order and support emails)
  • ImprovMX and Google Gmail (receiving and forwarding email sent to our address)
  • Cloudflare (Turnstile bot protection)
  • Discord (our community server, tickets and giveaways; only if you use Discord)
  • YouTube / Google (video thumbnails and videos, see section 6)

We may also disclose data when the law requires it, for example to the tax authorities. We do not sell personal data and we do not use advertising trackers.

4. Transfers outside the EU

Some of these providers are based in, or use servers in, countries outside the European Economic Area, in particular the United States. In that case the transfer is covered by the EU-US Data Privacy Framework where the provider is certified under it, or by the European Commission's standard contractual clauses. Email us if you want more information about these safeguards.

5. How long we keep your data

  • Orders, invoices and the related payment data: 7 years (Dutch tax law).
  • Code reveal logs: as long as the related order.
  • Discount code attempts: 12 months.
  • Customer account: until you delete it or ask us to.
  • Reviews: until you or we remove them.
  • Support emails: up to 2 years after the last contact.
  • Giveaway data: until the giveaway is settled and the prizes are delivered, at most 6 months.
  • Invite rewards: as long as the invite program runs, or until you ask us to remove your data; rewards used in an order are kept with that order.
  • Visitor statistics: up to 2 years; the daily random value is deleted the next day.
  • Partner portal sign-in attempts: 90 days; partner data: for the duration of the partnership and afterwards as long as needed for our accounts.
  • Hosting server logs: as kept by our host, usually up to 30 days.

6. Cookies, local storage and embedded content

We only use cookies and local storage that are needed for the site to work or that remember a choice you made. We use no analytics or advertising cookies, so we do not ask for cookie consent.

  • mcs_access, mcs_refresh: keep you signed in (until you sign out, at most 30 days).
  • mcs_lang, mcs_cur: your chosen language and currency (1 year).
  • mcs_discord: security check while you connect Discord (10 minutes).
  • mcs_partner, mcs_dash_cur: partner portal sign-in (30 days) and its currency choice (1 year); only on the partner portal.
  • Local storage mcs_cart_v1: your cart. mcs_music, mcs_music_vol and session storage mcs_music_t: your music player choice, volume and position. mcs_event_…: that you closed the announcement of a YouTube live stream, so we do not show it again.

On the videos page, the how-to-redeem page and in announcements of our own YouTube live streams we show video thumbnails loaded from YouTube's image server, so YouTube (Google) receives your IP address and browser data when those images load. The video player itself (from youtube-nocookie.com) only loads after you click play; from then on YouTube's privacy policy applies. Links to Discord, YouTube and Trustpilot take you to those services, which have their own privacy policies.

7. Your rights

You have the right to access your personal data, to have it corrected or deleted, to restrict its processing, to receive it in a portable format, and to object to processing based on our legitimate interest. Where we rely on your consent, you can withdraw it at any time; this does not affect processing before the withdrawal. Some data we must keep by law (for example order records for the tax authorities), even if you ask us to delete it.

To use your rights, email info@medal-capes.com. We answer within one month and may ask you to confirm your identity first, for example by writing from the email address used for your order. You can also file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl) or the data protection authority in your own country.

8. Children

If you are under 16, please ask a parent or guardian before you buy from us or give us personal data. If you believe a child has given us personal data without permission, contact us and we will delete it where the law allows.

9. Security

Connections to our site are encrypted (HTTPS). Redeem codes are stored encrypted and are only decrypted for the buyer after a confirmed payment. Passwords are stored as hashes. Access to the administration and the partner portal requires two-factor authentication and is logged. If a data breach affects your rights and freedoms, we will report it as required by law.

10. Changes

We may update this policy when our shop or the law changes. The date at the top shows the latest version. For important changes we will put a notice on the site.