PRIVACY
POLICY

Introduction

At AMOX Studios s.r.o. ("AMOX Studios," "we," "us," "our"), your privacy matters. This Privacy Policy describes what data we collect, how we use it, and how it is protected across all AMOX services - including the Commission Platform, the AMOX Marketplace, Discord-based systems, and the following websites: amoxstudios.com, amox.gg, apply.amox.gg, creators.amox.gg, and my.amox.gg.

AMOX Studios takes a data-minimisation approach. We collect only what is operationally or legally necessary, and we rely on trusted, GDPR-compliant third-party services for sensitive processing such as payments and communications.

We do not directly collect or store payment card information, full billing addresses from Buyers and Clients, or IP addresses.

Data We Collect

For Clients using the Commission Platform and Buyers using the Marketplace, AMOX Studios collects only the minimum data required to provide its services:

• —Discord username and user ID (for platform access and communication).

• —Email address (only when voluntarily submitted via forms, support tickets, or newsletter sign-up).

• —Ticket and commission logs (messages, attachments, timestamps).

• —Commission request and Marketplace order form responses, collected directly through the AMOX platform and stored in our Cloudflare D1 database (EU jurisdiction). Creator and internal member applications submitted via apply.amox.gg follow the same flow.

• —Consent record: for each application submitted via apply.amox.gg, we store a reference to the version of this Privacy Policy that the applicant accepted at submission time. This is retained as proof of informed consent and follows the same retention schedule as the application record itself.

• —Reviews and feedback submitted after order completion.

• —Audit log: a pseudonymous record of actions taken on your account (application submissions, portfolio file uploads and removals, data export requests, application deletions, and admin review decisions). Each entry stores the Discord ID, Clerk user ID, action type, and a timestamp. No IP addresses, no cookies, no request bodies. Used for security, abuse prevention, and dispute resolution under GDPR Article 6(1)(f) legitimate interest.

• —Moderation whitelist: a persistent list of Discord user IDs that exempts specified accounts from automated moderation actions on our Discord server. Entries are added and removed by administrators and are stored in our Cloudflare D1 database (EU jurisdiction). No other personal data is associated with whitelist entries.

Payment processing for Clients and Buyers is handled entirely by Stripe. AMOX Studios does not see, store, or process payment card details, full billing addresses, or bank information for Clients or Buyers directly.

Email communications (e.g., order notifications, receipts, newsletters) sent to Clients and Buyers are processed via Resend. AMOX Studios does not store email content beyond what is needed for operational record-keeping.

When a user attempts to join our Discord server, our moderation bot reads the account creation timestamp provided by the Discord gateway event and may deny entry if the account falls below an administrator-configured minimum age. This value is evaluated in memory and is not stored by AMOX Studios. Existing members are not affected by this check.

Because Freelancers and Sellers enter into binding service and commercial agreements with AMOX Studios s.r.o. and receive financial payouts, we are required by Czech and EU law to collect and retain the following personal data:

• —Full legal name.

• —Residential or business address.

• —Country of residence or registration.

• —Email address.

• —Discord username and ID.

• —Steam account (for game-related service verification).

• —Payment details (e.g., bank account number, IBAN, PayPal address).

• —Invoice or tax identification number (where applicable).

• —Age confirmation (18+ declaration).

• —Skills, portfolio links, and professional references.

• —Freelancer Agreement and NDA participation status.

This data is collected solely for operational, contractual, legal, and accounting purposes. It is not shared with third parties except where required by law.

When you visit our website, Cloudflare Web Analytics collects anonymous usage statistics including page views, referrers, and general device information. This service does not use cookies and does not track individual users. No personally identifiable information is collected through analytics.

Third-Party Services

AMOX Studios integrates the following third-party platforms, each of which processes user data independently under its own privacy policy. All processors are bound by data processing agreements and comply with GDPR.

• —Stripe - Payment and escrow processing. stripe.com/privacy

• —Discord - Communication, thread management, and user verification. Message data on Discord is subject to Discord's own retention policies and may persist until the user or AMOX deletes the relevant thread. discord.com/privacy

• —Resend - Transactional and operational email delivery, including newsletters. resend.com/privacy

• —Google Workspace - Internal document management and forms. policies.google.com/privacy

• —Google - Google Analytics 4 (GA4) is used on amox.gg, apply.amox.gg, creators.amox.gg, and my.amox.gg for anonymous website analytics. GA4 is configured with Google Consent Mode v2; analytics cookies are only set after the user accepts the cookie banner. Data retention is set to 14 months. Google Ads, Google Signals, and user-provided data features are disabled. The data controller for GA4 is Google Ireland Ltd, with sub-processing by Google LLC (USA) carried out under the EU-US Data Privacy Framework and Standard Contractual Clauses (SCCs) as permitted by GDPR Chapter V. policies.google.com/privacy

• —Cloudflare - Website hosting, DDoS protection, DNS, anonymous web analytics, file and asset storage (R2), and application database (D1). R2 and D1 are configured to store and process data within the European Union jurisdiction. Cloudflare is certified under the EU-US Data Privacy Framework. Cloudflare Web Analytics does not use cookies and collects no personally identifiable information. cloudflare.com/privacypolicy

• —Clerk - User authentication and session management for apply.amox.gg and my.amox.gg. Clerk handles Discord OAuth sign-in on our behalf and processes the associated authentication data, including Discord OAuth identifiers, email addresses provided by Discord, and session tokens. Clerk is US-based; transfers are carried out under the EU-US Data Privacy Framework and Standard Contractual Clauses (SCCs) as permitted by GDPR Chapter V. clerk.com/privacy

Newsletter & Marketing Communications

If you subscribe to the AMOX Studios newsletter, we will use your email address to send you updates, announcements, and relevant platform news. Your subscription is based on your explicit consent.

You may unsubscribe at any time by clicking the unsubscribe link in any email we send, or by contacting us at contact@amoxstudios.com. Upon unsubscribing, your email address will be removed from our mailing list promptly.

Newsletter delivery is managed via Resend. Your email address is stored securely in our database and within Resend's systems. We do not share subscriber data with third parties for marketing purposes.

Cookies & Tracking

Cookie usage differs by site. The sections below describe exactly which cookies are set where.

amoxstudios.com

The company website uses only a strictly necessary cookie to store your cookie consent preference. Cloudflare Web Analytics is used for anonymous usage statistics and operates entirely without cookies. No tracking, advertising, or profiling cookies are used on amoxstudios.com.

amox.gg and creators.amox.gg

These sites do not require login and set a smaller set of cookies. Strictly necessary cookies (always active, no consent required):

• —amox_consent - Stores your cookie banner choice.

• —__cf_bm - Cloudflare bot-management cookie, used for security and DDoS protection.

The following analytics cookies are set only after you click "Accept" on the cookie banner:

• —_ga - Google Analytics 4 client identifier.

• —_ga_<stream-id> - Google Analytics 4 session cookie.

apply.amox.gg and my.amox.gg

These are our authenticated applications (the creator/member application flow and the creator panel). They use the following strictly necessary cookies, which are always active and do not require consent:

• —__clerk_* - Authentication session cookies set by Clerk.

• —amox_lang - Stores your language preference.

• —amox_consent - Stores your cookie banner choice.

• —__cf_bm - Cloudflare bot-management cookie, used for security and DDoS protection.

The following analytics cookies are set only after you click "Accept" on the cookie banner:

• —_ga - Google Analytics 4 client identifier.

• —_ga_<stream-id> - Google Analytics 4 session cookie.

Google Consent Mode v2 is used to manage consent across all amox.gg subdomains. By default, analytics_storage is denied until the user accepts. Advertising storage and ad-related signals are permanently denied and never activated.

You can revoke your consent at any time via the "Manage cookies" link in the website footer, or by clearing your browser cookies for .amox.gg. We do not track individual browsing behaviour, user activity patterns, or IP addresses.

Legal Basis for Processing

Under the EU General Data Protection Regulation (GDPR), AMOX Studios processes personal data only where a valid legal basis exists:

• —Consent - for newsletter subscriptions and optional marketing communications.

• —Contract performance - to process commissions, Marketplace orders, and freelancer payouts.

• —Legal obligation - to comply with Czech accounting law, EU tax regulations, and applicable financial record-keeping requirements.

• —Legitimate interests - for platform moderation, dispute resolution, fraud prevention, security, and improving our services, where those interests are not overridden by the rights of the individual.

AMOX Studios does not carry out automated decision-making or profiling that produces legal or similarly significant effects concerning users, other than a limited Discord moderation measure that may deny entry to newly joining accounts below an administrator-configured minimum age, carried out under our legitimate interest in platform security.

Your Rights

Users located in the EU and EEA have the following rights regarding their personal data:

• —Access - the right to request a copy of the personal data we hold about you.

• —Rectification - the right to request correction of inaccurate or incomplete data.

• —Erasure - the right to request deletion of your data where retention is no longer legally required.

• —Restriction - the right to request that we limit how we process your data in certain circumstances.

• —Portability - the right to receive your data in a structured, machine-readable format where technically feasible.

• —Objection - the right to object to processing based on legitimate interests.

• —Withdrawal of consent - where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

Human review of automated moderation - if you believe you were denied entry to our Discord server in error, you may request human review at contact@amoxstudios.com. Where appropriate, your Discord ID will be added to the moderation whitelist so you can rejoin.

To exercise any of these rights, please contact us at contact@amoxstudios.com. We will respond within 30 days, as required under GDPR.

Complaints & Supervisory Authority

If you are unhappy with how we handle your personal data, we would appreciate the opportunity to address your concerns first - please contact us at contact@amoxstudios.com.

You also have the right to lodge a complaint with the Czech data protection supervisory authority at any time:

• —Authority: Úřad pro ochranu osobních údajů (UOOU)

• —Address: Pplk. Sochora 27, 170 00 Praha 7, Czech Republic

• —Website: uoou.cz

Data Retention

We retain data only for as long as necessary for the purpose for which it was collected, or as required by law:

• —Accounting and tax records (invoices, payout records, transaction logs) are retained for up to 10 years in accordance with Czech Act No. 563/1991 Coll. on Accounting and applicable EU tax regulations. This is the legally mandated minimum and supersedes any shorter period.

• —Operational data (support ticket logs, commission threads, order records) may be retained for internal reference unless a deletion request is submitted and legally permissible.

• —Newsletter subscriber data is retained until you unsubscribe or request deletion.

• —Contact form submissions are retained for up to 2 years.

• —Creator and internal member applications submitted via apply.amox.gg are retained for up to 3 months after submission. On acceptance, the relevant data is transferred to the applicant's member or freelancer profile record and the original application row undergoes a post-onboarding cleanup that removes the personal data fields from it; the accepted profile then follows the retention schedule above.

• —Application consent records (the reference to the Privacy Policy version accepted at submission) are retained for the same period as the application itself. On acceptance, a copy of the consent reference is carried over to the member or freelancer profile record as proof of informed consent and is retained for as long as that profile exists.

• —Audit log entries are retained for up to 12 months, then automatically deleted. On self-service deletion of an application, every audit entry tied to that application is removed; only a single pseudonymous record that the deletion itself happened is retained for security and dispute-resolution purposes.

• —Moderation whitelist entries persist until an administrator removes them, because their purpose - exempting specific accounts from automated moderation - requires an indefinite lifetime. Users may request removal of their Discord ID from the whitelist at any time via contact@amoxstudios.com.

• —Upon account deletion or a valid data removal request, personal data will be anonymised to the minimum necessary, retaining only what is legally required.

Data Security

AMOX Studios uses industry-standard security measures to protect personal data against unauthorised access, loss, alteration, or disclosure. All data is transmitted over HTTPS and stored securely. Access to stored data is strictly limited to authorised AMOX Management personnel and is logged for accountability purposes.

We do not store sensitive data (payment details, full billing information) on our own infrastructure - such data is handled exclusively by our certified third-party payment processor, Stripe.

In the event of a data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority (UOOU) within 72 hours as required by GDPR, and will inform affected users without undue delay where required.

International Data Transfers

All data is processed within the European Union, or by third-party services that comply with the EU-U.S. Data Privacy Framework or equivalent appropriate safeguards recognised under GDPR (Chapter V). This includes Cloudflare (certified under the EU-US Data Privacy Framework, with R2 and D1 operating in the EU jurisdiction), Clerk (US-based authentication provider operating under the EU-US Data Privacy Framework and Standard Contractual Clauses), and Google (Google Ireland Ltd as controller, with sub-processing by Google LLC under the EU-US Data Privacy Framework and Standard Contractual Clauses).

AMOX Studios does not transfer personal data to jurisdictions lacking adequate data protection without ensuring appropriate legal mechanisms are in place.

Changes to This Policy

AMOX Studios may update this Privacy Policy from time to time to reflect changes in our services, operations, or legal requirements. Material updates will be communicated via our Discord server and/or official website with reasonable advance notice. The review date at the top of this document will be updated accordingly.

Continued use of AMOX services after the effective date of any update constitutes acceptance of the revised Privacy Policy.

Last reviewed: 22 April 2026.

Contact

For all privacy enquiries, data access requests, newsletter unsubscribes, or GDPR-related matters:

• —Email: contact@amoxstudios.com

• —Legal / DPA matters: legal@amoxstudios.com

• —Company: AMOX Studios s.r.o.

• —Executive Director: Václav Tomášek

• —IČO: 23312823

• —DIČ: CZ23312823

• —Registered Office: Šlovice 141, 321 00 Dobřany, Czech Republic

By accessing or using any AMOX Studios services, you acknowledge that you have read, understood, and agree to this Privacy Policy.