Privacy Policy

This Privacy Policy explains how IaC Bazaar (“we”) handles personal data. We aim to comply with the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021, “PDPL”) and applicable data-protection rules.

Data we collect

• Account data - your name and email, received from your OAuth provider when you sign in.
• Billing data - a Stripe customer reference, your subscriptions and purchases. Card details are handled by Stripe; we never see or store them.
• Usage & security data - download logs, IP address, the two-letter country our CDN resolves from that address, the browser or command-line tool identifier (user agent), and timestamps. Used for entitlement enforcement, fraud/leak tracing, audit, and to understand which modules are being used and from where.
• Website analytics - pages viewed, referring site or campaign, approximate country, and device/browser type, collected on our behalf by Opinly and Google Analytics. See Website analytics below for exactly what is stored and how to opt out.

Downloads of free modules through the Terraform/OpenTofu registry are logged with IP address, country and user agent even when no account is signed in, because that is the only record we have that a download happened.

Why we use it (legal basis)

To provide the service (perform our contract with you): authentication, processing payments, granting entitlements and downloads, and customer support. For security and legal compliance: fraud prevention, audit, and tax/accounting obligations.

Processors we share data with

Stripe (payments), our object-storage and hosting providers (artifact delivery and application hosting), Cloudflare (content delivery and network ingress, which is what resolves the country from an IP address), our authentication provider, Opinly (website analytics and the articles on our blog), and Google (Google Analytics). Each processes data only to provide their service to us.

Retention

We keep account and transaction records for as long as your account is active and as required for tax, accounting, and legal purposes, after which they are deleted or anonymised.

Download logs are kept for 90 days with the IP address and user agent attached, after which those two fields are removed and only the date, module, and country are retained. Deleting your account removes the IP address and user agent from your download records immediately. Encrypted database backups holding older copies expire within a further 30 days.

Your rights (PDPL)

Subject to law, you may request access to, correction of, or erasure of your personal data, restrict or object to processing, and request portability. You can export your data and delete your account from your account settings, or contact us.

Website analytics

We use Opinly and Google Analytics to measure how the site is found and used - which pages are viewed, which search or campaign brought a visitor, the approximate country, and the type of device and browser. This tells us which guides and modules are worth writing more of.

Opinly stores a random identifier in your browser’s local storage (not a cookie) so repeat visits from the same browser are counted as one visitor. It is not shared with anyone and does not follow you to other websites. Clearing your browser storage resets it.

Google Analytics works differently: it sets the cookies described underCookiesand processes the visit on Google’s infrastructure. We do not enable Google Signals, advertising features or remarketing on the property, so the data is not joined to a Google advertising profile and is not used to target you elsewhere. We never send Google your email address or any other identifier that names you.

Where we already know who you are - you are signed in, or you have just bought something - we pass your email address to Opinly so a purchase can be attributed to the visit that led to it. Opinly stores that address only as an irreversible SHA-256 hash and never keeps the address itself. Purchase amounts and order references are sent from our server, not from your browser. Opinly’s analytics script can also pick up an email address typed into a form; we have switched that off on our sign-in, sign-up and password-reset forms.

To opt out, enable “Do Not Track” or a content blocker in your browser, or use private browsing - the analytics script is not required to browse, buy, or download. Analytics is never used for advertising, profiling, or automated decisions about you.

Cookies

Sign-in and session security use essential cookies. Google Analytics sets two more, named _ga and _ga_<id>, which hold a randomly generated visitor identifier and expire after two years; blocking or deleting them costs you nothing on this site. We do not use third-party advertising cookies, and our other analytics provider sets no cookies at all - it uses browser local storage as described above.

Contact

For privacy requests, see our contact page.