Exaro Studio Privacy Policy

The controller or business responsible for the personal information described in this Privacy Policy is:

The information we collect depends on how you use the Services.

Account and Contact Information

We may collect:

• name;
• email address;
• username;
• account identifier;
• authentication information;
• company or studio name;
• country or region; and
• account preferences.

Transaction and Purchase Information

When you purchase an Asset, we may collect:

• products purchased;
• purchase date;
• transaction identifier;
• order history;
• billing country or region;
• payment status;
• refunds and disputes; and
• limited payment information received from our payment processor.

Payments may be processed by third-party payment processors.

Exaro does not necessarily receive or store your complete debit-card or credit-card number.

Communications

If you contact us, we may collect information contained in:

• customer-support requests;
• emails;
• bug reports;
• refund requests;
• intellectual-property complaints;
• surveys; and
• other communications.

Reviews and Other Submitted Content

If the Services allow reviews, comments, feedback, or other submissions, we may collect the content you submit and information associated with the submission.

Device and Usage Information

When you use the Services, we or our service providers may automatically receive information such as:

• IP address;
• browser type;
• operating system;
• device type;
• approximate location derived from IP address;
• referring page;
• pages visited;
• timestamps;
• session information;
• download activity;
• error information; and
• security and fraud-prevention signals.

We do not intentionally collect precise GPS location through the Services unless a feature specifically requires it and appropriate notice or consent is provided.

Cookies and Similar Technologies

We may use cookies, local storage, pixels, SDKs, or similar technologies for purposes such as:

• keeping users signed in;
• maintaining shopping-cart or checkout functionality;
• security;
• fraud detection;
• storing preferences;
• measuring site performance; and
• understanding how visitors use the Services.

Where required by law, non-essential cookies or similar technologies will be used only after obtaining appropriate consent.

Information Handled by the Exaro Studio Plugin

The Exaro Studio plugin runs inside your Unreal Editor, and most of what it touches never reaches us:

• License activation. When you activate, the plugin sends your license key and a machine identifier to our license server to validate the activation and enforce seat limits.
• Your AI API keys. Stored locally in your editor’s per-user configuration on your own machine, and sent only to the AI provider they belong to. They are never transmitted to Exaro.
• Your prompts, code, and project content. Sent directly from your machine to the AI provider you configure, under that provider’s terms and privacy policy. We have no access to any of it.
• No telemetry. The plugin does not report usage analytics, crash reports, prompt contents, or project data. Recipes and settings live in your project and are never uploaded.

We may use personal information to:

• operate and provide the Services;
• create and manage accounts;
• process purchases;
• provide purchased Assets and download access;
• authenticate users;
• provide customer support;
• respond to questions or complaints;
• maintain purchase histories;
• prevent fraud and abuse;
• protect our systems and users;
• enforce our Terms of Service and licenses;
• diagnose technical problems;
• understand and improve the Services;
• conduct internal analytics;
• send transactional communications;
• send marketing communications where permitted;
• comply with legal and tax obligations;
• establish, exercise, or defend legal claims; and
• protect the rights, safety, property, and security of Exaro and others.

We do not use personal information for materially different purposes without providing appropriate notice or obtaining consent where required.

If data-protection laws requiring a legal basis apply to you, including the GDPR or similar laws, our processing may rely on the following bases.

Performance of a Contract

We process information when necessary to:

• create your account;
• complete a purchase;
• deliver an Asset;
• maintain your purchase history; or
• provide customer support related to our agreement with you.

Legitimate Interests

We may process information for legitimate business interests such as:

• securing the Services;
• preventing fraud;
• maintaining and improving the website;
• understanding usage;
• protecting our legal rights; and
• operating our business.

We consider the effect of such processing on your privacy rights where required by law.

Consent

We rely on consent where required, including for certain:

• marketing communications;
• analytics technologies;
• advertising technologies; or
• non-essential cookies.

You may withdraw consent at any time, although withdrawal does not make prior lawful processing unlawful.

Legal Obligations

We may process information when necessary to comply with laws, tax obligations, lawful requests, court orders, or other legal requirements.

We may disclose personal information to the following categories of recipients.

Service Providers

We may use companies that provide:

• website hosting;
• cloud infrastructure;
• content delivery;
• security;
• authentication;
• payment processing;
• transaction processing;
• email delivery;
• analytics;
• customer support;
• error monitoring;
• fraud detection; and
• other business infrastructure.

These providers may process personal information as necessary to perform services for us.

Payment Providers

Payment information may be provided directly to payment processors.

Their handling of information is also governed by their own privacy policies and legal obligations.

Professional Advisers

Information may be shared with attorneys, accountants, auditors, insurers, consultants, or similar professional advisers when reasonably necessary.

Legal and Safety Disclosures

We may disclose information when we reasonably believe disclosure is necessary to:

• comply with applicable law;
• respond to valid legal process;
• investigate fraud or security incidents;
• enforce our agreements;
• protect our rights;
• protect users; or
• prevent harm.

Business Transactions

If Exaro participates in a merger, acquisition, financing, reorganization, bankruptcy, asset sale, or similar corporate transaction, personal information may be transferred as part of that transaction subject to applicable law.

At Your Direction

We may disclose information when you direct or authorize us to do so.

Exaro does not sell personal information for monetary consideration.

As of the Effective Date of this Privacy Policy, Exaro does not intentionally sell personal information as a core part of its business model.

Certain privacy laws define “sale,” “sharing,” or “targeted advertising” more broadly than ordinary monetary sales.

If Exaro begins using personal information for activities that constitute sale, sharing, or targeted advertising under an applicable privacy law, we will provide the disclosures and opt-out mechanisms required by that law.

The Services may use the following categories of cookies or similar technologies.

Strictly Necessary

These are used for functions such as:

• authentication;
• security;
• checkout;
• account sessions; and
• storing essential preferences.

Analytics

Analytics technologies may help us understand:

• traffic;
• page performance;
• downloads;
• errors; and
• general usage patterns.

Where required, analytics technologies will not be activated until appropriate consent has been obtained.

Marketing

If Exaro uses advertising or marketing technologies in the future, we will provide appropriate disclosures and choices where required.

You may also be able to control cookies through your browser settings.

Disabling essential technologies may prevent certain features from functioning properly.

Some browsers and extensions transmit privacy preference signals such as Global Privacy Control (“GPC”).

Where applicable law requires us to recognize such signals as a request to opt out of sale, sharing, or targeted advertising, we will process supported signals as required.

Because Exaro does not currently sell personal information for monetary consideration, some browser signals may not materially change how your information is processed.

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected and for legitimate business or legal requirements.

Retention periods may depend on:

• whether you maintain an account;
• whether purchase records must be retained;
• tax and accounting obligations;
• fraud-prevention needs;
• security requirements;
• contractual obligations;
• support history;
• legal claims; and
• applicable statutes of limitation.

For example, transaction records may be retained longer than ordinary website analytics because we may need them to demonstrate purchases, licenses, accounting records, and tax compliance.

When information is no longer reasonably required, we may delete, anonymize, or aggregate it.

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, loss, misuse, alteration, and disclosure.

No online system or data-storage method can be guaranteed to be completely secure.

You are responsible for maintaining the confidentiality of your account credentials.

If you believe your account or personal information has been compromised, contact us at support@codehawke.com.

Privacy rights vary by jurisdiction.

Depending on where you live and whether a particular privacy law applies to Exaro, you may have the right to:

• confirm whether we process your personal information;
• access personal information;
• obtain a copy of personal information;
• correct inaccurate information;
• request deletion;
• request restriction of processing;
• request data portability;
• object to certain processing;
• opt out of targeted advertising;
• opt out of the sale or sharing of personal information;
• withdraw consent;
• limit certain uses of sensitive personal information; and
• not receive discriminatory treatment for exercising privacy rights.

These rights may be subject to legal exceptions.

Where the Virginia Consumer Data Protection Act applies, Virginia consumers may have rights to:

• confirm whether we process their personal data;
• access their personal data;
• correct inaccuracies;
• delete personal data;
• obtain certain personal data in a portable format; and
• opt out of qualifying targeted advertising, sale of personal data, or certain profiling.

To submit a request, contact support@codehawke.com.

You do not need to create a new account solely to submit a privacy request.

We may take reasonable steps to authenticate your request.

If we deny your request, you may appeal our decision by contacting support@codehawke.com and placing “Privacy Appeal” in the subject line.

We will review privacy appeals as required by applicable law.

If an appeal is denied, we will provide information about any additional complaint process required by law.

If the California Consumer Privacy Act or other California privacy laws apply to Exaro and to your information, California residents may have rights including:

• the right to know or access categories and specific pieces of personal information;
• the right to request deletion;
• the right to correct inaccurate personal information;
• the right to opt out of qualifying sale or sharing;
• the right to limit certain uses of sensitive personal information where applicable; and
• the right not to be discriminated against for exercising privacy rights.

Where required, an authorized agent may submit a request on your behalf. We may request information necessary to verify your identity, the agent’s authority, or both.

Categories of Personal Information

During the preceding 12 months, depending upon how users interacted with the Services, we may have collected categories including:

• identifiers;
• customer-record information;
• commercial and transaction information;
• internet or electronic-network activity;
• approximate geolocation derived from IP address; and
• communications or other information users voluntarily provide.

We use and disclose these categories for the business and commercial purposes described in this Privacy Policy.

We do not knowingly sell personal information for monetary consideration.

If applicable European or United Kingdom data-protection law applies, you may have rights to:

• access personal data;
• correct inaccurate personal data;
• request erasure;
• restrict processing;
• object to processing;
• receive certain information in a portable format;
• withdraw consent; and
• lodge a complaint with an applicable supervisory authority.

Where we process personal information based on legitimate interests, you may have the right to object to that processing in circumstances provided by law.

Where we rely on consent, you may withdraw consent at any time.

Exaro is based in the United States.

If you access the Services from outside the United States, your information may be transferred to, stored in, or processed in the United States or another country where Exaro or its service providers operate.

These countries may have data-protection laws different from those in your jurisdiction.

Where applicable law requires safeguards for international transfers, we will use legally recognized transfer mechanisms or other appropriate safeguards.

The Services are not directed to children under 13 years of age.

We do not knowingly collect personal information from children under 13.

If you believe a child under 13 has provided personal information to Exaro, contact us at support@codehawke.com so we can investigate and take appropriate action.

Purchasing Assets requires legal capacity to enter into the applicable transaction as described in our Terms of Service.

If you subscribe to marketing messages, you may unsubscribe at any time by:

• using the unsubscribe link contained in an email; or
• contacting us.

You may continue to receive transactional or service communications, such as:

• receipts;
• purchase confirmations;
• security notices;
• password resets;
• account notices; and
• communications concerning Assets you purchased.

Exaro does not currently use personal information to make solely automated decisions that produce legal or similarly significant effects concerning users.

If this practice changes, we will provide disclosures and rights required by applicable law.

Privacy requests may be submitted to support@codehawke.com.

Your request should identify the privacy right you wish to exercise and provide sufficient information for us to reasonably identify and authenticate the request.

We may request additional information when reasonably necessary to verify identity or prevent unauthorized disclosure.

We will respond within the time required by applicable law.

We will not discriminate against you for exercising a privacy right.

We may update this Privacy Policy periodically to reflect:

• changes to the Services;
• new technologies;
• new service providers;
• changes in our information practices; or
• legal or regulatory developments.

We will update the “Last Updated” date when the Privacy Policy changes.

If a change materially affects how we use personal information, we will provide additional notice or obtain consent where required by law.

For questions about this Privacy Policy or our privacy practices: