Who we are: Black Market Props is a props market in a data-hungry world. We sell weathered 3D assets - we do not harvest profiles. Your data is not ours to give away.
Where data lives: this website and its order / ticket files are hosted on a VPS in Germany (European Union). The shop is operated from the United Kingdom. Personal data is processed under the EU GDPR (and UK GDPR where it applies to UK buyers). Hosting in the EU does not mean we sell or rent your data.
Lawful basis: we process Discord ID, username, email (if provided), order notes, and ticket chat to perform the contract - open your ticket, take payment via PayPal, and deliver files. We keep the minimum needed for that job.
On disk: Discord ID, Discord username, email, order notes, chat author IDs, display names, and message bodies are encrypted on the server (AES-256-GCM) so a stolen data file is not readable plaintext. Staff still decrypt in memory to fulfill orders - this is not end-to-end encryption against a fully compromised live server.
Processors / tools we use:
- OVHcloud (or our VPS host) - server hosting in Germany
- Discord - login only (identify / email scopes as granted)
- PayPal - Checkout on the buy page or commission ticket
- Resend (if enabled) - transactional order emails
When you sign in with Discord, we receive your Discord user ID, username, and (if allowed) email so we can open a private ticket for you. Discord is login only - chat and delivery stay on this site. Those fields are sealed at rest after checkout.
Your basket is stored only in your browser on this device. We do not keep a basket database.
Payment details are never entered into chat. You pay with PayPal Checkout on the buy page or commission ticket. PayPal processes the payment; this site receives a paid/not-paid result and may send your receipt / order id to PayPal so the payment matches the order. We do not store your card number.
When a ticket is closed, that chat file is deleted. You keep a receipt code under My tickets. Order summary fields needed for receipts / disputes may remain sealed on disk until we no longer need them for the contract, chargebacks, or legal duties.
Your rights: depending on where you are, you may have rights to access, correct, delete, or restrict personal data we hold, and to complain to a supervisory authority (in the UK: the ICO; in the EU: your local DPA, e.g. in Germany a state data protection authority). To exercise rights, open a ticket on this site or message us on Discord - we need enough detail to find your orders.
Questions: open a ticket on the site or message us on Discord.