Storm Development

1. Introduction

At Storm Development, accessible from stormss.cc, we are committed to safeguarding the privacy and security of our users. This Privacy Policy ("Policy") explains how we collect, use, disclose, store, and protect your personal information when you visit or engage with our products and services, including but not limited to Storm SS and Storm Optimizations (collectively, the "Service").

This Policy is complementary to our Terms of Service and End User License Agreement, and collectively these documents govern your use of our products and services.

By using the Service, you acknowledge that you have read and understood this Privacy Policy. Where we rely on consent as the legal basis for processing your data, we will obtain your explicit consent before collecting or processing your personal information.

2. Data Controller

The data controller responsible for your personal data is:

Data Protection Officer (DPO)

EU/EEA & UK GDPR Representatives (Article 27)

If you are located in the EU or UK, and have questions or concerns regarding your personal data, you may contact our GDPR representative:

EU Representative:

UK Representative:

To submit a Data Subject Access Request (DSAR), data deletion request, or any other GDPR-related inquiry, please use our secure portal.

This link allows you to verify our appointed representative and submit GDPR requests directly. Requests submitted through this portal are logged and tracked to ensure timely response and compliance.

3. Information We Collect

3.1 Personal Information

We collect the following categories of personal information. For each category, we identify the legal basis for processing under applicable law:

Discord Identifier (DCID)

When you log into the Service via Discord or use the software, we collect your unique Discord Identifier to link your account with your Discord profile, manage access, and provide notifications.

Hardware Identifiers (HWID)

We collect hardware identifiers unique to your device to ensure the integrity and security of the Service, detect unauthorized use, and prevent abuse. HWID is used to identify specific devices rather than individual users.

Gaming Profiles (SteamID64)

We may store your SteamID64 to identify to whom suspected cheat data belongs.

Suspected Cheat Data

We collect file names, file paths, file hashes, and process start times linked to confirmed or suspected cheating software. This data is attached to gaming profiles and is not used to identify you in any other way.

3.2 Information We Do Not Collect

IP Addresses: While IP addresses may be temporarily processed for security and operational purposes (e.g., monitoring traffic, preventing fraud), we do not persistently store or link IP addresses to user accounts.

Email Addresses: We request an email address at the time of purchase solely to deliver the product. Email data is stored by our payment processors; the Service does not store or link email addresses to user accounts.

3.3 Usage Data

We collect information about your interactions with the Service, such as access times, pages or features visited, device type, operating system, and browser type. This data is collected in an aggregated or pseudonymized form and is used solely for improving performance, identifying technical issues, and optimizing the user experience.

3.4 Cookies and Tracking Technologies

Our website (stormss.cc) may use cookies and similar tracking technologies. We categorize cookies as follows:

For visitors located in the EU/EEA or the United Kingdom, we will obtain your consent via a cookie consent banner before placing any non-essential cookies on your device. You may withdraw your consent at any time through the cookie settings on our website.

For more details, please refer to our Cookie Policy.

4. How We Use Your Information

4.1 Service Provision and Improvement

We use the data we collect to provide, maintain, and improve the Service, including analyzing usage trends, identifying technical issues, optimizing performance, and developing new features.

4.2 Account Management and Support

We use collected information to create and manage your account, verify your identity, and assist with support inquiries.

4.3 Security and Fraud Prevention

We use technical data to detect and prevent fraudulent activities, including cheating, to maintain a fair and secure environment. This data is analyzed to identify suspicious behavior or patterns that may indicate attempts to exploit or bypass the Service's security measures.

4.4 Automated Decision-Making

The Service may use automated processes to analyze suspected cheat data and flag or restrict accounts suspected of cheating. If an automated decision produces legal effects or similarly significant effects concerning you (such as suspension or banning of your account), you have the right to:

• Obtain human intervention from Storm Development;
• Express your point of view and contest the decision;
• Receive an explanation of the decision reached.

To exercise these rights, contact us at [email protected].

4.5 Legal Compliance

We may process your data where necessary to comply with applicable legal obligations, including responding to lawful requests from law enforcement or regulatory authorities.

5. Information Sharing and Disclosure

We do not sell, trade, rent, or otherwise transfer your personal information to outside parties for their marketing purposes.

We may share your information only in the following circumstances:

• Legal Obligations: To comply with applicable laws, regulations, legal processes, or enforceable governmental requests.
• Protection of Rights: To protect and defend the rights, property, or safety of Storm Development, our users, or the public.
• Service Providers: With trusted third-party service providers who process data on our behalf (e.g., payment processors, hosting providers), subject to contractual obligations to protect your data and use it only as directed by us.
• Business Transfers: In the event of a merger, acquisition, reorganization, or sale of assets, your data may be transferred. We will notify you via prominent notice on our website and/or by email before your data is transferred and becomes subject to a different privacy policy.
• Authorized Entities: With law enforcement agencies, government authorities, or regulatory bodies in compliance with applicable laws, only to the extent required to investigate, prevent, or address potential violations of our policies or the law.

6. International Data Transfers

Storm Development is based in the United States. If you access the Service from outside the United States, your data may be transferred to, stored in, and processed in the United States or other countries where our service providers operate.

For transfers of personal data from the EU/EEA or the United Kingdom to countries that have not received an adequacy decision, we implement appropriate safeguards, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission;
• The UK International Data Transfer Agreement or UK Addendum to the EU SCCs, as applicable;
• Any other transfer mechanism permitted under applicable data protection law.

For transfers of personal data from Brazil, we comply with the requirements of LGPD Article 33, including ensuring that the receiving country provides an adequate level of data protection or that appropriate safeguards are in place.

You may request a copy of the applicable safeguards by contacting us at [email protected].

7. Data Security

We use industry-standard technical and organizational measures to protect the integrity and security of your data against unauthorized access, alteration, disclosure, or destruction. These measures include encryption of data in transit, access controls, and regular security assessments.

However, no method of electronic transmission or storage is 100% secure. While we strive to protect your personal data, we cannot guarantee absolute security.

8. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:

• Notify the relevant supervisory authority within 72 hours of becoming aware of the breach, as required under GDPR Article 33 and UK GDPR Article 33;
• Notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms, as required under GDPR Article 34 and UK GDPR Article 34;
• Notify the Brazilian National Data Protection Authority (ANPD) and affected data subjects within a reasonable time as required under LGPD Article 48;
• Comply with all applicable state and federal breach notification laws in the United States.

9. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data. We will honor these rights in accordance with applicable law.

9.1 Rights Under GDPR and UK GDPR (EU/EEA and UK Residents)

If you are located in the EU/EEA or the United Kingdom, you have the following rights under the General Data Protection Regulation (GDPR) or the UK GDPR:

To exercise any of these rights, contact us at [email protected] or via our Discord channel. We will respond to your request within one month (30 days). If your request is complex, we may extend this period by up to two additional months, but we will notify you of the extension and the reasons within the initial 30-day period. There is no fee for exercising your rights unless requests are manifestly unfounded or excessive.

Supervisory Authority: You have the right to lodge a complaint with your local Data Protection Authority. UK residents may contact the Information Commissioner's Office (ICO).

9.2 Rights Under LGPD (Brazilian Residents)

If you are located in Brazil, you have the following rights under the Lei Geral de Prote��o de Dados (LGPD):

• Confirmation of the existence of processing of your data;
• Access to your data;
• Correction of incomplete, inaccurate, or outdated data;
• Anonymization, blocking, or deletion of unnecessary or excessive data;
• Deletion of personal data processed with your consent;
• Information about public and private entities with which your data has been shared;
• Information about the possibility of denying consent and the consequences;
• Revocation of consent;
• Data portability to another service provider;
• Review of decisions made solely on the basis of automated processing.

We will respond to your request within 15 days as required by LGPD. To exercise your rights, contact us at [email protected] or via Discord.

Supervisory Authority: You may file a complaint with the Autoridade Nacional de Prote��o de Dados (ANPD).

9.3 Rights Under CCPA/CPRA (California Residents)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• Right to Know: You may request that we disclose the categories and specific pieces of personal information we have collected, the purposes for collection, the categories of sources, and the categories of third parties with whom we share your data.
• Right to Delete: You may request deletion of personal information we have collected from you, subject to certain exceptions.
• Right to Correct: You may request correction of inaccurate personal information.
• Right to Opt-Out of Sale/Sharing: You have the right to opt out of the sale or sharing of your personal information. Storm Development does not sell or share personal information as defined by the CCPA/CPRA.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights.

To exercise your rights, contact us at [email protected]. We will verify your identity before processing your request and respond within 45 days, with a possible extension of an additional 45 days for complex requests.

9.4 Rights Under PIPA (South Korean Residents)

If you are located in South Korea, you have rights under the Personal Information Protection Act (PIPA), including the right to request access to, correction of, suspension of processing of, and deletion of your personal data. We obtain separate, specific consent for the collection and use of your personal data as required by PIPA. To exercise your rights, contact us at [email protected].

9.5 Rights Under APPI (Japanese Residents)

If you are located in Japan, you have rights under the Act on the Protection of Personal Information (APPI), including the right to request disclosure, correction, suspension of use, and deletion of your personal data. We specify the purpose of use of your personal data and do not share it with third parties without your consent except as permitted by law. To exercise your rights, contact us at [email protected].

9.6 Rights Under PIPL (Chinese Residents)

If you are located in China, you have rights under the Personal Information Protection Law (PIPL), including the right to know, to decide on, to restrict or refuse the processing of your personal data, and to request copies, corrections, or deletion. Processing of sensitive personal information (including biometric data) requires your separate consent. If applicable, we will comply with cross-border transfer requirements including security assessments. To exercise your rights, contact us at [email protected].

9.7 General

All requests to exercise data subject rights should be submitted in writing via email to [email protected] or via our Discord channel. We may request additional information to verify your identity. All requests will be processed free of charge unless they are manifestly unfounded or excessive.

10. Children's Privacy

Our Service is not directed at children under the age of 13 (or the minimum age of digital consent in your jurisdiction, whichever is higher). We do not knowingly collect personal information from children under 13.

United States (COPPA)

If we learn that we have collected personal information from a child under 13 in the United States without verifiable parental consent, we will delete that information as quickly as possible. If you believe we have collected information from a child under 13, please contact us immediately.

European Union (GDPR Art. 8)

Where consent is the legal basis for processing, we require the consent of a parent or guardian for users under the age of 16 (or the lower age set by your Member State, which may not be below 13). We implement age-verification measures at the point of registration.

United Kingdom

We comply with the UK Age Appropriate Design Code where applicable and require parental consent for users under 13.

Brazil (LGPD Art. 14)

Processing of children's and adolescents' data is carried out in their best interest, with consent from at least one parent or legal guardian.

11. Data Protection Impact Assessment

Storm Development has conducted a Data Protection Impact Assessment (DPIA) in accordance with GDPR Article 35 for processing activities that are likely to result in a high risk to the rights and freedoms of individuals. This includes our collection of hardware identifiers, suspected cheat data processing, and any automated decision-making that may significantly affect users. The DPIA is maintained internally and updated as processing activities change.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Post the updated Privacy Policy on our website with an updated "Last Updated" date;
• Notify you via email or a prominent notice within the Service at least 30 days before the changes take effect;
• Where required by law, obtain your consent to the updated Policy before continuing to process your data under the new terms.

Your continued use of the Service after the effective date of the updated Policy constitutes your acceptance of the changes, except where additional consent is required by law.

13. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our data processing practices, please contact us:

Data Protection Officer

EU Representative (Art. 27 GDPR)

UK Representative (Art. 27 UK GDPR)

To submit a Data Subject Access Request (DSAR), data deletion request, or any other GDPR-related inquiry, please use our secure portal.

This link allows you to verify our appointed representative and submit GDPR requests directly. Requests submitted through this portal are logged and tracked to ensure timely response and compliance.

Supervisory Authorities

• EU/EEA Residents: Your local Data Protection Authority (list at edpb.europa.eu)
• UK Residents: Information Commissioner's Office (ICO) at ico.org.uk
• Brazilian Residents: Autoridade Nacional de Prote��o de Dados (ANPD) at gov.br/anpd
• US Residents: Federal Trade Commission (FTC) at ftc.gov
• South Korean Residents: Personal Information Protection Commission (PIPC)
• Japanese Residents: Personal Information Protection Commission (PPC)

14. Legal Notice / Impressum

Information provided strictly for transparency and regulatory compliance purposes (e.g., according to § 5 DDG).

Company Operations & Headquarters

Contact Information

For rapid, direct, and electronic communication, please use the following official channels:

Merchant of Record (Reseller)

Storm Development partners with an authorized Merchant of Record for all order fulfillment, billing, and payment processing. All software license sales are legally processed by:

European Privacy & GDPR Compliance (Article 27)

For data privacy inquiries, Data Subject Access Requests (DSAR), or official communications from European Data Protection Authorities, please contact our appointed Article 27 Representatives (Euverify Ltd) via our dedicated portal: