Privacy Policy

Last updated: 26th September 2026

This Privacy Policy explains how rystal collects, uses and protects personal information when you visit our website, purchase digital products or interact with us.

This policy applies to get.rystal.shop and any related rystal shop pages or redirects, including rystal.shop.

rystal is based in Sydney, Australia.

Contact: rystalmail@gmail.com

1. What we collect

We may collect the following information:

• your name and email address;
• billing details, country and order information;
• products purchased, download access and account details;
• messages you send to us for support or enquiries;
• newsletter sign-up information;
• website, checkout and analytics data, such as pages viewed, products viewed, checkout activity, purchases, device/browser information, IP address, cookies and similar tracking data.

Payment details are processed securely by our checkout and payment providers. We do not store full card numbers ourselves.

We do not intentionally collect sensitive personal information such as health information, religious beliefs, government ID documents or similar data.

2. How we collect information

We collect information when you:

• visit our website or Payhip store;
• buy or download a product;
• create or use a Payhip customer account;
• sign up to our email list;
• contact us for support;
• interact with cookies, analytics tools or advertising pixels.

Some information is collected directly by third-party tools we use, including Payhip, Stripe, ConvertKit, Google Analytics, DataFast, Meta/Facebook Pixel, and TikTok Pixel.

3. How we use information

We use personal information to:

• process orders and deliver digital downloads;
• provide access to presets, project files, plugins, bundles and other digital products;
• manage customer accounts, downloads, refunds and support;
• send order confirmations, product updates and important service messages;
• send marketing emails if you have subscribed or where we are legally allowed to do so;
• improve our website, products, offers and customer experience;
• measure website traffic, sales and ad performance;
• run advertising, including Meta/Facebook and Google advertising;
• prevent fraud, abuse and security issues;
• comply with tax, accounting, legal and platform obligations.

4. Marketing emails

If you join our email list or otherwise consent to receive marketing, we may send you emails about rystal products, updates, discounts, launches and educational content.

You can unsubscribe at any time using the unsubscribe link in our emails or by contacting rystalmail@gmail.com.

We do not sell or rent your email list. Sharing activity with advertising providers may be considered a sale or sharing of personal information under some US privacy laws; you can opt out using Privacy choices.

5. Cookies, analytics and advertising pixels

Our website and checkout may use cookies, pixels and similar technologies.

These may be used to:

• keep the website and checkout working properly;
• remember preferences;
• understand website traffic and product performance;
• measure purchases and conversions;
• improve marketing and advertising;
• create or improve advertising audiences.

We use or may use:

• Payhip cookies for checkout, accounts, security, analytics and store functionality;
• Google Analytics to understand website traffic and usage;
• DataFast to understand visits, traffic sources and how people use our website;
• Meta/Facebook Pixel to measure ad performance, track events such as page views, product views and purchases, and improve advertising.
• TikTok Pixel to measure ad performance, track events such as page views, product views and purchases, and improve advertising.

Your tracking choices

Site stats covers Google Analytics and DataFast. On this storefront, site stats may start without an approval prompt for visitors in Australia, New Zealand, the United States, Indonesia, the Philippines, Singapore and South Africa, unless you have opted out. This also applies in India before 13 May 2027. In Indonesia, the Philippines, Singapore and South Africa, we rely on our legitimate interest in understanding visits, page performance and referral sources to improve this storefront, subject to your rights and the safeguards described here. This does not authorise advertising, sensitive-data collection or identifying you by name or email. For locations where prior permission is required, or where we have not established a suitable basis for this configuration, we ask before starting site stats. We also ask when your location is unavailable.

On eligible public storefront pages, visitors located in Australia, New Zealand, Pakistan, Iraq, India before 13 May 2027, and eligible United States locations outside California receive a notice and can turn Meta tracking off; this regional configuration starts without waiting for an acceptance click. Meta receives visit and shopping events, cookie/click identifiers, browser details and IP addresses to measure and personalise advertising. Meta may process this information overseas, including in the United States, and use it for its own advertising and service purposes. We do not send names, email addresses, phone numbers or payment-card details through this configuration. Existing refusals still apply.

In India from 13 May 2027, California, other countries, or when the required location information is unavailable, Meta stays off until allowed. This includes locations whose rules or application to our configuration have not yet been established; it does not mean every such location legally requires prior consent. TikTok stays off until allowed everywhere. Acknowledging the regional notice is not recorded as consent. See Meta’s Privacy Policy and Meta ad preferences; industry opt-out choices are also available. We honour saved rejections and Global Privacy Control by keeping optional tracking off.

You can change your choices at any time using Privacy choices in the footer. Turning a category off reloads the page to stop its loaded trackers. This does not erase information already received by a provider. These controls apply to this storefront; external checkout and other linked services have their own privacy controls.

US privacy choices

You can opt out of sharing for targeted advertising using Privacy choices in the footer, turning Meta ads off and saving, or choosing Turn off or Only Necessary. We also honour Global Privacy Control. We do not require an account or payment to opt out. You may contact rystalmail@gmail.com to request access, correction or deletion of your information, or appeal a privacy decision; we will respond as required by the law that applies to your request. We do not penalise you for exercising privacy rights.

Meta advertising and purchase measurement

When Meta ads are enabled through your explicit choice or the regional notice-and-opt-out configuration, we use the Meta Pixel and Conversions API to measure advertising results and support personalised advertising. This can include visits and shopping activity, completed purchase amount and currency, an order reference, Meta browser or click identifiers, IP address and browser information. Purchase events are linked to an exact checkout record and a current permission record that distinguishes consent from regional notice-based processing. Opting out revokes that permission for later purchase sending. We do not send payment card details through these tools. Meta may process this information outside Australia under its applicable terms and privacy policies. You can turn off Meta ads using Privacy choices. Withdrawing permission does not remove information already sent to Meta.

In Mexico, ordinary Meta visit tracking uses the notice-and-opt-out configuration, while purchase sharing requires an explicit Meta choice. In Kazakhstan and Uzbekistan, optional analytics and advertising tools are disabled in this website configuration. Other locations use the available consent choices; an unknown location does not enable automatic Meta tracking.

Meta also uses shared activity for its own purposes, including personalised ads, Feed and AI content, product research and development, and security. These uses are broader than measuring our ads. Under its Business Tools Terms, Meta may retain Event Data for up to two years. Its Privacy Policy explains its processing and applicable rights. Where available, Meta’s Activity from other businesses setting controls use for personalised ads and other content. It is not a promise to delete or disconnect events. Turning tracking off here stops future optional sends; it does not erase information already received by Meta.

Our privacy contact is Rystal at rystalmail@gmail.com. You can ask to access, correct, object to or delete information where applicable, including help directing a request concerning data already sent to a provider. Overseas recipients may be subject to different privacy protections from those in your country. The optional Meta choice covers the disclosed overseas sharing and purposes; declining it does not prevent shopping.

Where the EU General Data Protection Regulation applies, Rystal and Meta Platforms Ireland Limited are joint controllers for the collection and transmission of this activity data to Meta. Our Controller Addendum allocates our respective responsibilities: we provide this notice and the information about collection and transmission; Meta Ireland handles rights requests for personal data it stores after transmission. Each party remains responsible for its own legal basis and security obligations. You can exercise your rights with either party. Meta's Privacy Policy explains its identity, contact details, processing, legal bases and how to exercise your rights.

DataFast analytics

We use DataFast to understand website traffic. When Site stats is enabled, it uses cookies to collect page visits, traffic sources, IP addresses, approximate location, browser/device information and visitor identifiers.

You can opt out or withdraw consent through Privacy choices in the footer by turning off Site stats and saving, or selecting Only Necessary. For details, see DataFast’s Privacy Policy.

Where Meta Pixel/TikTok Pixel advanced matching is enabled, your email address may be sent to Meta/TikTok in hashed form. Hashing helps protect the original email address, but it may still be used by Meta/TikTok to match website activity to a Meta/TikTok account.

You can control cookies through your browser settings, the website cookie banner where available, and your Meta/TikTok and Google ad/privacy settings. Blocking some cookies may affect checkout, account access or download functionality.

6. Who we share information with

We only share information where needed to run the business, provide our products, process payments, send emails, measure performance, advertise, protect the website or comply with the law.

We may share information with:

• Payhip — checkout, product delivery, customer accounts, tax and store hosting;
• Stripe — card and payment processing;
• ConvertKit — email newsletter and marketing;
• Google Analytics — analytics and website measurement;
• DataFast — website analytics and visitor activity reporting;
• Meta/Facebook — pixel tracking, ad measurement and advertising;
• professional advisers, authorities or service providers where required for legal, accounting, tax, fraud prevention or security purposes.
• TikTok — pixel tracking, ad measurement and advertising

These providers may process information under their own privacy policies and may store data outside Australia.

7. International transfers

Because we sell digital products online and use international service providers, your information may be processed or stored in countries outside Australia, including the United States, United Kingdom, European Union and other locations where our service providers operate.

We use trusted platforms and take reasonable steps to work with providers that protect personal information appropriately.

8. Legal bases for EEA/UK users

Where the GDPR or UK GDPR applies, we process personal information on these legal bases:

• contract — to process purchases, deliver products and provide support;
• consent — for email marketing and certain non-essential cookies or advertising where required;
• legitimate interests — to improve products, secure the website, understand business performance and communicate with customers;
• legal obligations — for tax, accounting, consumer law and compliance requirements.

You may withdraw consent at any time where processing is based on consent.

9. Data retention

We keep personal information only for as long as needed for orders, downloads, customer support, legal, tax, accounting, security and marketing purposes.

If you unsubscribe from marketing, we may keep limited information to make sure we do not email you again by mistake.

You can request deletion of your information, but some data may need to be kept where required for legal, tax, fraud prevention, dispute or platform reasons.

10. Security

We take reasonable steps to protect personal information from misuse, loss, unauthorised access, modification or disclosure.

Most personal information is stored and processed through secure third-party platforms such as Payhip, Stripe and ConvertKit.

No online system is completely secure, so please avoid sending sensitive personal information through email or contact forms.

11. Your rights and choices

Depending on where you live, you may have rights to:

• access the personal information we hold about you;
• ask us to correct inaccurate information;
• ask us to delete your information;
• object to or restrict certain processing;
• unsubscribe from marketing;
• withdraw consent where processing is based on consent;
• request a copy of certain information in a portable format.

To make a privacy request, contact:

rystalmail@gmail.com

We may need to verify your identity before responding.

12. Children

Our website and products are not directed to children. We do not knowingly collect personal information from children without appropriate consent.

13. Complaints

If you have a privacy concern, contact us first at:

rystalmail@gmail.com

We will try to respond within a reasonable time.

If you are in Australia and are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC).

If you are in the EEA or UK, you may also have the right to contact your local data protection authority.

14. Changes to this policy

We may update this Privacy Policy from time to time. The latest version will be posted on this page with the updated date.