This privacy policy explains how we handle your personal data on digitalgemology.com, where we sell 3D files and cutting files and offer a free 3D Gemstone Simulator. It is written to be read, so the short version comes first.
We collect what we need to sell you a file and let you download it. Checkout runs on Lemon Squeezy, which sells the files to you as merchant of record and passes us your order. The 3D Gemstone Simulator needs no personal data and keeps none. If you accept analytics, Google Analytics counts your visit; if you reject it, nothing is loaded; with analytics on, it also counts which buy buttons are clicked, never who clicked them. The free sample costs your email address, which we use to send you the file and for nothing else unless you opt in to news. Our Trustpilot button is a plain link: nothing loads from Trustpilot until you click it. If you choose to sign in with Google, your name and email address are kept only in a cookie in your browser. We do not sell your data, we do not use it for advertising, and we do not track you across other websites. We never see your card or PayPal details.
1. Who we are
Digital Gemology is a trading name of Compliance Condo B.V., a private limited company established in the Netherlands.
We act as the data controller for the personal data we process through this site and for the order details Lemon Squeezy passes to us. Lemon Squeezy is responsible for what it does at checkout, as section 2.1 explains.
2. What personal data we process
2.1 Checkout and order data
When you click Buy, you go to our checkout at digitalgemology.lemonsqueezy.com, run by Lemon Squeezy (Link, LLC, formerly Lemon Squeezy LLC, United States). Lemon Squeezy is the seller of record: it takes payment, charges tax, prevents fraud and sends your receipt. For that it collects your name, email address, billing address or country, payment details and, if you enter one, a VAT or tax ID. It decides how to handle that data itself, as an independent controller, under the Lemon Squeezy privacy policy.
Lemon Squeezy then passes us the order, and we process:
- your name and email address, so we can help with your files, your license and any question;
- your country or billing address, and for business customers the company name and VAT number if you gave them;
- the order number, the date, what you bought, the amount, and the license key issued with it;
- refunds and their reasons, if any.
We never receive your card or PayPal details.
2.2 Downloads and license keys
- Your download links, license key and order page are provided by Lemon Squeezy. It may record when a file is downloaded or a key is used, under its own privacy policy.
- We see your orders and license keys in our Lemon Squeezy account. We use them to deliver what you paid for, to help if a download fails, and to recognize a license that is being shared.
2.3 Communication data
- Messages you send us by email, including requests to be told when a file becomes available.
- Complaints and support requests.
2.4 Technical data
- Our hosting provider processes your IP address and basic request data to deliver pages and to protect the site against attack. We do not use it to identify you.
- Your choice of black or white page theme, stored on your own device (see the Cookie Policy).
2.5 Analytics, only if you accept
- If you click Accept in the cookie banner, Google Analytics records the pages you view, the site that sent you, your browser and device type, your approximate location, and a random identifier stored in a cookie on your device. Google Analytics does not store IP addresses.
- It also records a few clicks, so we can see which pages lead to a sale: a click on a Buy button
(event
begin_checkout, with the product, the file type, the price and where on the page the button was), a click on the free sample (generate_lead), and a click from a tool to a cut's page (tool_to_product). These events carry no name, email address or order details, and we cannot link them to your purchase at Lemon Squeezy. - We use it only as totals: how many people visit, which pages and tools they use, and which buttons lead to a sale. We do not use it to identify you, and its advertising features, Google signals and ad personalization are switched off.
- If you reject analytics, or do not choose, Google Analytics is not loaded and nothing is sent to Google. You can change your choice at any time with Cookie settings at the bottom of every page.
We run no advertising trackers on digitalgemology.com.
2.6 Using the 3D Gemstone Simulator
- The 3D Gemstone Simulator is free, needs no account and runs entirely in your browser. It asks for no personal data.
- It loads its data files from our own domain. These are ordinary page requests, handled as described in section 2.4; the simulator sends nothing else to us.
- The settings you choose are kept only in the page address, so a link reproduces the same stone. When a page address is opened, it reaches our hosting provider like any other request (section 2.4). We do not store the settings, and the simulator sets no cookies of its own and stores nothing in your browser.
2.7 Trustpilot reviews
- Every page shows a Review us on Trustpilot button at the bottom. It is a plain link: nothing loads from Trustpilot's servers and nothing is sent to Trustpilot until you click it.
- The button opens our profile on trustpilot.com. Anything you do there, including writing a review, is governed by Trustpilot's own privacy policy, and Trustpilot is the controller for it.
- We do not currently send Trustpilot your name, email address or order details. If we start inviting buyers to review their purchase, we will add it to this policy first.
2.8 Signing in with Google, only if you choose to
- You can sign in on our account page with your Google account. Nothing on the site needs it: browsing, the tools and buying all work without an account.
- When you sign in, Google shares your name, email address, profile picture and Google account ID with us, after asking you. We use the name, email address and account ID only to show your account page. We do not use the picture.
- We store none of it on our servers. It is kept in one cookie in your browser
(
__Host-dg_session), signed so that it cannot be altered, for 30 days or until you sign out, which deletes it. Your browser sends that cookie with each page request, so it passes through our hosting provider like any other request (section 2.4). - On Google's side, signing in falls under Google's own privacy policy, and Google is the controller for your Google account. You can remove our access at any time at myaccount.google.com/connections.
- We do not link your sign-in to your Lemon Squeezy orders, and we do not use it for marketing.
2.9 The free sample
- The free cube files are delivered through the same Lemon Squeezy checkout as a purchase, at a price of zero. To send them, Lemon Squeezy asks for your name and email address and passes them to us with the order, as in section 2.1. No payment details are asked.
- We use the address only to deliver the sample and to help if it does not open. We do not add it to a mailing list and we do not send you marketing, unless you tick the box to receive news at checkout (section 8). You can ask us to delete it at any time.
- The sample comes with the same license and the same rights if a file is faulty as a paid file (terms, Article 5).
2.10 Instagram, Skool and YouTube
- If you message us on Instagram (@digitalgemology), we see what you send and your profile name, and use them only to answer you. Meta is the controller for Instagram itself; for the statistics Meta gives us about our profile, Meta and we are joint controllers, under Meta's Page Insights terms.
- Our course community runs on Skool. If you join it, Skool is the controller for your account there, under its own privacy policy. We see what you post and your profile, and use them only to run the community.
- Lesson videos load from YouTube only when you press play (section 5).
2.11 What you have to give us
Only what checkout asks for. Your name, email address and country are needed to conclude the sale and deliver the files; without them Lemon Squeezy cannot complete the order. Everything else in this policy, from analytics to signing in with Google, is your choice, and the site works without it.
3. Why we process it, on what basis, and for how long
| Purpose | Basis (GDPR Art. 6) | Retention period |
|---|---|---|
| Delivering your files, helping with downloads, and handling withdrawals and refunds | Performance of a contract (1(b)) | For as long as we offer re-downloads of your purchase, and in any case no longer than 7 years after the purchase |
| Knowing which license you hold (order and license key) | Performance of a contract (1(b)) | 7 years after the purchase, the same period as our tax records. The license itself does not end then; we simply no longer keep the record of it |
| Answering questions and handling complaints | Performance of a contract (1(b)) or legitimate interest (1(f)) in answering people who write to us | 2 years after the matter is closed, or 5 years where the message is the record of an agreement or a dispute |
| Telling you when a file becomes available, if you asked us to | Consent (1(a)) | Until that message is sent or you withdraw consent, whichever is first |
| Sending the free sample and helping if it does not open (section 2.9) | Performance of a contract (1(b)) | 2 years after you received it, or sooner if you ask us to delete it |
| Sending news by email, only if you ticked the box at checkout | Consent (1(a)) | Until you unsubscribe, which every message lets you do |
| Preventing fraud and the sharing of paid files | Legitimate interest (1(f)) | Up to 1 year after detection |
| Counting visits, seeing which pages and tools are used and which buy buttons are clicked (Google Analytics) | Consent (1(a)), which you can withdraw at any time | At most 14 months in Google Analytics; the cookies last up to 2 years unless you withdraw or clear them |
| Showing your account page when you sign in with Google | Performance of a contract (1(b)), at your request | Only in the cookie on your device: 30 days, or until you sign out. We keep no copy |
| Keeping the site secure and available | Legitimate interest (1(f)) | Handled by our hosting provider, briefly; we keep no logs of our own that identify visitors |
| Counting how often AI tools use our MCP servers, API and pages, and how many visits come from an AI service | Legitimate interest (1(f)) | Totals by tool, page and type of software, about three months at Cloudflare. No IP address, no cookie and no search words, so this count holds no personal data |
| Accounting and tax: our sales and payout records from Lemon Squeezy | Legal obligation (1(c)) | 7 years, as Dutch tax law requires |
Legitimate interest: where we rely on it, our interests are protecting the files we sell from being passed around, keeping the site secure, and being able to show what was asked and agreed. We keep the impact proportionate: we keep no more than those purposes need, we build no profile from it, and we delete it on the schedule above. You can object at any time under section 7.
4. Who we share your data with
We share personal data only where it is necessary, and only with parties bound by a data processing agreement or another valid legal ground. We never sell your data. Some of the parties below process data for us (processors, under GDPR Art. 28); others handle it as controllers under their own policies. The table says which, and how a transfer outside the EU is safeguarded.
| Party | What they do, and in what role | Where, and the safeguard |
|---|---|---|
| Cloudflare, Inc. | Hosting of the site, the API and the AI endpoints, with protection against attack and the AI-use count. Processor | EU and US. Cloudflare is certified under the EU-US Data Privacy Framework; its data processing addendum adds the Standard Contractual Clauses |
| Link, LLC (Lemon Squeezy), a Stripe company | The sale, payment, tax, fraud and sanctions checks and the receipt: independent controller, as seller of record (section 2.1). Hosting the downloads, issuing license keys and passing your order to us: processor for us | US. The Standard Contractual Clauses in Lemon Squeezy's data processing terms |
| Google LLC | Google Workspace, which carries our email. Processor | US. EU-US Data Privacy Framework, and the Standard Contractual Clauses in Google's data processing terms |
| Google Ireland Limited / Google LLC | Google Analytics, only if you accept analytics (section 2.5). Processor | EU and US. EU-US Data Privacy Framework, and the Standard Contractual Clauses in Google's data processing terms |
| Google LLC | Sign in with Google, only if you use it (section 2.8). Controller for your Google account | US. EU-US Data Privacy Framework |
| Meta Platforms Ireland Ltd | Instagram, only if you message us there (section 2.10). Controller; joint controller with us for our profile statistics | EU, with transfers to Meta Platforms, Inc. under the EU-US Data Privacy Framework |
| Skool | Our course community, only if you join it (section 2.10). Controller for your Skool account | US, under Skool's own privacy policy |
The EU-US Data Privacy Framework is the European Commission's adequacy decision for certified US companies; the Standard Contractual Clauses are the Commission's model contract for transfers. We check the certifications when we review this policy and update the table if one changes. You can ask us for a copy of the safeguard that applies to any provider.
We may also have to share data with the tax authorities or with other public bodies where the law requires it.
5. Cookies and similar technologies
We keep this to the minimum. The full, per-item overview is in our Cookie Policy. In short: our hosting provider may set bot-protection cookies, your theme choice is kept on your own device, and checkout takes place on Lemon Squeezy's site, where its own cookie policy applies. Google Analytics cookies are set only if you accept them in the cookie banner, and your choice is remembered on your own device. If you sign in with Google, a cookie keeps you signed in until you sign out. The Trustpilot button is a plain link and sets nothing. There are no advertising cookies.
The lesson pages under /learn show each video as a still picture from our own server. Nothing loads from YouTube until you press play. Then the player loads from YouTube in privacy-enhanced mode (youtube-nocookie.com), and YouTube's own terms and privacy policy apply.
6. Security
We take appropriate technical and organizational measures to protect your personal data against loss, unauthorized access or disclosure, including encrypted connections (TLS), access restricted to the people who need it, and processors contractually bound to security obligations. The detail is in our cyber security notice.
In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) within 72 hours of becoming aware of it (GDPR Art. 33). Where the breach is likely to result in a high risk to you, we will also tell you directly and without undue delay (GDPR Art. 34), describing what happened, the likely consequences and what we have done about it. We keep an internal register of all data breaches.
7. Your rights
Under the General Data Protection Regulation you have the following rights:
| Right | What this means |
|---|---|
| Access | You can ask which personal data we process about you, and for a copy. |
| Rectification | You can have incorrect or incomplete data corrected. |
| Erasure | You can ask us to delete your data, unless the law requires us to keep it. |
| Restriction | You can ask us to restrict processing for a time. |
| Portability | You can receive your data in a common, machine-readable format. |
| Objection | You can object to processing based on legitimate interest. |
| Withdrawing consent | Where we rely on consent, you can withdraw it at any time, as easily as you gave it. |
| Automated decisions | We make no decisions about you based solely on automated processing. |
To exercise any of these rights, email support@digitalgemology.com from the address you bought with, so we can be reasonably sure it is you. We respond within one month; in complex cases we may extend this by two months, and we will tell you if we do. It is free.
What erasure means for a purchase. If you ask us to delete your data, we delete your correspondence and the order details we do not have to keep. Our sales records stay for seven years, because Dutch tax law requires it. Your license to use files you already downloaded is not affected, but we will no longer be able to help with re-downloads. Data held by Lemon Squeezy, including your receipt and its tax records, is Lemon Squeezy's to delete: ask it directly, or ask us and we will pass the request on.
You also have the right to lodge a complaint with the Dutch Data Protection Authority at autoriteitpersoonsgegevens.nl, or with the supervisory authority in your own country.
8. Marketing
We send marketing email only if you have asked for it, and every message has a way to stop further ones. Asking us to tell you when a file becomes available is a request for exactly that one message, not a newsletter subscription. Lemon Squeezy's checkout may offer its own marketing opt-in; we do not switch it on for you.
9. Minors
Our files are not directed at people under 16, and we do not knowingly process their data. If you think we have collected data from a minor by mistake, tell us at support@digitalgemology.com and we will delete it.
10. Changes to this policy
We will update this policy when our services, our providers or the law change, and in particular before we start any new kind of processing. The version and date are at the top of the page. Where a change is significant and we hold your email address, we will tell you by email.
Version 1.0 was the first edition for digitalgemology.com. Version 1.1 added the section on the 3D Gemstone Simulator (now 2.6). Version 1.2 added Google Analytics, which runs only with your consent (section 2.5). Version 1.3 added the Trustpilot review button (section 2.7). Version 1.4 describes checkout through Lemon Squeezy as merchant of record (sections 2.1, 2.2 and 4) and gives one contact address for everything. Version 1.5 adds signing in with Google (section 2.8). Version 1.6 makes the Trustpilot button a plain link, so nothing loads from Trustpilot until you click it (section 2.7). Version 1.7 adds the YouTube videos on our lesson pages (section 5). Version 1.8 says that the YouTube player loads only when you press play (section 5). Version 1.9 adds the count of how AI tools use the site, which holds no personal data. Version 2.0 adds the free sample (section 2.9), Instagram and Skool (section 2.10), what you have to give us (section 2.11) and the buy-button clicks Google Analytics counts (section 2.5); sets fixed retention periods for orders and license records (section 3); and says for every provider whether it works for us or as a controller, and how a transfer is safeguarded (section 4).
11. Contact
We have not appointed a data protection officer, as the law does not require one for our processing. Privacy questions go to the address above and are answered by a person.