The short version: AJNEXA is a digital store — we sell downloadable products and creative services worldwide, so no shipping addresses, no warehouses, and no more data than we actually need. We collect what it takes to create your account, process your order, deliver your files, and (only if you opt in) send you our newsletter. We explain below exactly what we hold, why, and the legal basis for it. We never sell your personal data. You can ask us at any time to see, correct or delete what we hold, and — if you are in the EU/EEA or UK — you can complain to your data protection authority. Just write to [email protected].
Who we are — the data controller
ajnexa.com is operated by AJNEXA, based in Marrakech, Morocco. AJNEXA is the data controller responsible for the personal data described in this policy — meaning we decide what data is collected and why. We sell digital products — AI prompt packs, Notion templates, Canva templates, ad creative packs and ebooks — as well as productized creative services, to customers worldwide, including in the EU/EEA and the UK. Because everything we sell is delivered digitally, we do not collect shipping addresses or handle physical deliveries. For anything related to this policy, or to exercise your rights, contact us at [email protected].
What we collect
We keep data collection to the minimum needed to run the store. Depending on how you use the site, this includes:
- Account details. When you create an account we store your name, email address and an encrypted password, so you can sign in and access your download library.
- Order information. When you buy something we record what you purchased, the billing details you provide, the date and amount of the transaction, and your download activity for that order. We never see or store your full card number — payment details go directly to our payment processor.
- Newsletter sign-ups. If you subscribe through one of our forms (powered by Contact Form 7), we store the name and email address you give us, solely to send you the emails you asked for.
- Support messages. When you email us, we keep your message and our replies so we can help you and keep a record of what was agreed.
- Technical and security data. Our servers and security layer (Cloudflare) automatically log data such as your IP address, browser and device type, and access times, to keep the site secure and prevent fraud and abuse.
- Analytics. If you consent to analytics cookies, we use analytics tools to understand how visitors use the site — pages viewed, approximate location, device and browser type. This data is aggregated and is not used to identify you personally.
Why we process your data, and our legal basis
Under the GDPR and equivalent laws, every use of your personal data needs a legal basis. Here is what we do with your data and why we are allowed to:
| What data | Why we process it | Legal basis |
|---|---|---|
| Account details; order and billing information | To create your account, process your order, deliver your files and keep them available, and handle refunds | Performance of a contract with you |
| Order and invoice records | To meet our accounting, tax and bookkeeping obligations | Legal obligation |
| Newsletter name and email | To send you the newsletter and product updates you signed up for | Consent (withdrawable at any time) |
| Analytics and other non-essential cookies | To understand how the site is used and improve it | Consent (withdrawable at any time) |
| Technical and security logs | To keep the store secure and prevent fraud and abuse | Legitimate interest in a secure, working store |
| Support messages; aggregated usage insights | To answer your questions, provide support and improve our products and service | Legitimate interest in helping and improving |
Where we rely on legitimate interest, we have weighed it against your rights and privacy. You can object to that processing at any time (see Your rights below). We do not sell, rent or trade your personal data. Ever.
How long we keep your data
We keep personal data only as long as we need it:
- Account data — for as long as your account exists. Close your account and we remove it, keeping only what the law requires.
- Order and invoice records — for the statutory accounting period, which is around 7 years; the exact period is set by the applicable local law.
- Newsletter data — until you unsubscribe or ask us to remove it, whichever comes first.
- Support emails — around 24 months after your query is resolved, unless they relate to an order we must keep for accounting.
- Analytics data — for the retention period configured with our analytics provider, after which it is deleted or kept only in aggregated form.
Who we share data with
We share your data only with the service providers (processors) that make the store run, and only what each of them needs to do its job:
- Hosting provider — hosts the website and its database on our behalf.
- Payment processor — handles your payment and receives the details needed to complete the transaction securely. We never store your full card details on our servers.
- Email / SMTP delivery provider — processes your email address to send order confirmations, download links and — if you subscribed — our newsletter.
- Analytics provider — measures how the site is used, where you have consented to analytics cookies.
- Cloudflare — acts as our content delivery network and security layer, filtering malicious traffic and helping the site load quickly.
Each provider is bound to process your data only on our instructions and to protect it. A current list of the specific providers we use is available on request at [email protected].
International data transfers
AJNEXA operates from Morocco, which is outside the European Economic Area (EEA) and is not covered by an EU adequacy decision. This means that when you buy from us or contact us, personal data reaching AJNEXA is transferred outside the EEA (and, for UK customers, outside the UK). Some of our processors may also store or process data in other countries. Where such transfers happen, we rely on appropriate safeguards — in particular the European Commission’s Standard Contractual Clauses (SCCs) with the processors concerned, where applicable — so that your data continues to be protected to an equivalent standard. You can ask us for more detail about the safeguards in place.
Cookies
Like most online stores, we use cookies — small text files stored in your browser. Some are strictly necessary to keep you signed in, remember your cart and make checkout work; others are only set if you consent. We explain each category, how long cookies last, and how to change or withdraw your consent, in our dedicated Cookie Policy.
Automated decision-making
We do not carry out automated decision-making or profiling that produces legal effects for you or similarly significantly affects you. Your orders and any support you receive are handled by real people, not by algorithms making decisions about you.
Children
Our store and services are not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, contact us and we will delete it.
Your rights
You are in control of your data. Subject to the conditions in applicable law, you have the right to:
- Access — ask for a copy of the personal data we hold about you.
- Rectification — ask us to correct anything that is inaccurate or incomplete.
- Erasure — ask us to delete your personal data (we may need to keep minimal order records where the law requires it).
- Restriction — ask us to pause our use of your data while a concern is resolved.
- Portability — receive the data you gave us in a common, machine-readable format, or have it sent to another provider.
- Objection — object to processing based on our legitimate interests, including any direct marketing.
- Withdraw consent — where we rely on your consent (the newsletter, non-essential cookies), withdraw it at any time. This does not affect the lawfulness of what we did before you withdrew it.
- Complain to a supervisory authority. If you are in the EU/EEA, you can lodge a complaint with the data protection authority in your country; if you are in the UK, with the Information Commissioner’s Office (ICO). We would appreciate the chance to address your concern first, but this is your right regardless.
How to exercise your rights
To exercise any of these rights, email us at [email protected]. We will respond within 30 days. There is no charge, and a real person will handle your request. You can also unsubscribe from the newsletter with one click via the link in any email.
Contact
Questions about this policy or about your data? Write to [email protected] — a real person will answer.
Last updated: 22 July 2026
This document is provided for general information. The store owner should have it reviewed by a qualified lawyer to ensure it meets all applicable legal requirements.