Who we are and what this covers

Venge Store ("we", "us") operates venge.cc, the customer dashboard, our license validation server, and our Discord server and bot. This policy applies to all of them.

We process personal data in line with the Saudi Personal Data Protection Law (Royal Decree M/19) and its implementing regulations.

What we actually collect

This is the complete list of personal data our systems store, taken from the systems themselves.

Discord account data

When you log in, we ask Discord for two permissions only: identify and guilds.members.read. From these we store your Discord user ID, your username / tag, and your avatar URL. We read your membership and roles in our own server only, to confirm your purchases and to check whether you hold a staff role.

Session data

A successful login creates a session record containing a random session token, your Discord ID, tag and avatar, whether you are an admin, and an expiry timestamp. It also stores the Discord access token issued to us, which is what lets us verify your server membership. Sessions last 7 days. We keep at most 4 sessions per account — logging in on a fifth device deletes the oldest.

License and order records

For each license: the license key, the product, its status, any expiry date, the date it was issued, and any internal note an admin adds. These records are linked to your Discord ID.

Server IP address and validation logs

When a product on your server contacts our license server, we record the IP address of that server, the outcome of the check (success, IP mismatch, expired, revoked, edited), the User-Agent string sent, and the time. Your license also stores the currently bound server IP and when it was last reset or last validated.

Redeem code submissions

If you redeem a code, we ask for your server name and a Discord invite link for that server, and store them with the redeemed code.

Website analytics

For each page view on our site we record the page, your IP address, your User-Agent, the referring URL, your country (provided by Cloudflare), and the time.

Cookies

We use exactly two cookies, both HttpOnly and SameSite=Lax, and neither is used for advertising or cross-site tracking:

We also hold IP addresses briefly in memory for rate limiting. That is never written to the database.

What we do not collect

• No payment details. No card numbers, CVV, PINs or bank details ever reach our servers.
• No passwords. There is no Venge password — login is entirely through Discord.
• No email address is collected by the dashboard or the license system.
• No private Discord messages, and no monitoring of your presence, status or activity.
• No data about other Discord servers you belong to. Our permission covers our own server only.
• No advertising or cross-site tracking cookies, no third-party analytics, no ad networks.
• No use of your data to train AI models, and we never sell or rent it.
• No files from your server are uploaded to us. Integrity checks compare a short checksum, not your code.

Why we process it, and our legal basis

You may ask us which basis applies to any specific processing, and we will tell you.

Automated decisions

Three things happen automatically, without a person reviewing them first:

• Your Discord product role is assigned when a license is issued to you.
• Your license binds to the first server IP that validates it, and validation from a different IP is refused until the binding is reset.
• If an integrity check shows that protected files have been modified, the product stops validating and returns an edited result.

Who your data reaches

We do not sell your data or share it with anyone for their own marketing. It reaches only the following, and only as far as needed:

Transfers outside Saudi Arabia

Discord is based in the United States, and Cloudflare and our hosting provider operate internationally, so some data is processed outside the Kingdom. We limit this to what the service requires, in line with Article 29 of the Personal Data Protection Law and the transfer regulations, relying on the necessity of performing our contract with you and on the safeguards those providers offer. We do not transfer data where it would harm national security or vital interests.

How long we keep it

We would rather be accurate than flattering here, so this reflects what our systems currently do:

Deletion requests are handled manually by our team through Discord, not by a self-service button.

Your rights

Under Article 4 of the Personal Data Protection Law you have the right to:

• Be told what we process and on what basis — that is what this page is for.
• Access the personal data we hold about you.
• Receive a copy of it in a readable format, free of charge.
• Have inaccurate, incomplete or outdated data corrected.
• Ask us to delete data we no longer need.
• Withdraw consent, where consent is what we relied on.
• Complain to the Saudi Data & AI Authority (SDAIA).

To exercise any of these, message us through our Discord with your Discord tag. We will confirm your identity through your Discord account and respond within the period set by the regulations. Some records cannot be deleted while they are still needed — an active license, a purchase record we must retain, or evidence in an open dispute — and we will tell you plainly when that applies.

How we protect it

• All traffic to our site and license server runs over HTTPS / TLS.
• Session tokens are generated with a cryptographically secure random source, and session cookies are HttpOnly and SameSite=Lax, so page scripts cannot read them.
• Administrative access is limited to accounts holding a staff role in our Discord server.
• Sensitive endpoints are rate limited, and login is protected against CSRF with a single-use state value.
• Database input is parameterised, and user-supplied content is escaped before display.
• Old sessions are purged automatically.

No service can promise perfect security, and data sent over the internet can never be guaranteed completely safe. If you believe your account or license has been compromised, contact us immediately through Discord.

If there is a breach

If personal data is exposed, damaged or accessed without authorisation, we will notify SDAIA within 72 hours where the incident is likely to cause harm, and we will inform affected customers without undue delay where their data or rights are at risk. This applies equally to incidents at the providers who process data on our behalf.

Children

Our products and store are intended for people who can legally enter into a contract, which is 18 or older. We do not knowingly collect data from anyone below that age. Processing a minor's data requires verified consent from a parent or guardian. If we become aware that an account belongs to someone who cannot legally contract, we may suspend or delete it.

Changes to this policy

We may update this policy. The current version is always published here with its "Last updated" date and takes effect when published. If we start processing your data for a materially new purpose, we will ask for your consent rather than assume it from continued use.

Contact and supervisory authority

For any privacy question, data request or complaint, reach us through our official channels:

If you are not satisfied with our response, you may complain to the Saudi Data & AI Authority (SDAIA), the supervisory authority for personal data in the Kingdom. This policy forms part of our Terms & Conditions.