Last updated: July 6, 2026
This policy applies to the BlackBox Tools website at blackboxtools.com ("the site", "the website") and all products and services offered through it, operated by Diego Cordova d/b/a BlackBox Tools ("BlackBox Tools", "we", "us", "our").
Our mobile apps have their own privacy policies. For the Screencrate app, see Screencrate Privacy Policy. This page covers the blackboxtools.com website only.
BlackBox Tools is built on a simple privacy principle: we collect only what we need to deliver your products and run the website, nothing more. We do not sell, rent, license, trade, or otherwise monetize your personal data. We do not build behavioral profiles. We do not serve advertising on this website. We do not use tracking pixels from social media platforms.
This policy is written in plain language so you can understand exactly what happens with your information. If anything is unclear, email us and we will explain it.
For the purposes of the EU General Data Protection Regulation ("GDPR"), the UK GDPR, and all other applicable data protection laws, the data controller is:
We are a small, independent business. We do not have a Data Protection Officer because we do not engage in large-scale processing of special-category data. All privacy inquiries are handled directly by the business owner.
We collect the minimum information necessary to operate the website and deliver products. Here is an exhaustive list:
When collected: When you download our free LUT pack, make a purchase, or voluntarily contact us.
Why: To deliver your download link, send order confirmations, issue replacement download tokens, and respond to support requests.
Legal basis (GDPR): Performance of a contract (Art. 6(1)(b)) for purchases and downloads; legitimate interest (Art. 6(1)(f)) for support inquiries.
Retention: Until you request deletion, or 3 years after your last interaction with us, whichever comes first. You can request deletion at any time (see Section 11).
What we receive: We do not collect, see, store, or have access to your credit card number, CVV, billing address, or any payment card details. All payment processing is handled entirely by Stripe, Inc. Stripe is PCI DSS Level 1 certified - the highest level of payment security certification. Your payment data goes directly from your browser to Stripe's servers and never touches ours.
What Stripe shares with us: A transaction confirmation (amount, date, currency, last 4 digits of your card for your reference, and whether the payment succeeded). We use this solely to fulfill your order and issue refunds if requested.
Legal basis (GDPR): Performance of a contract (Art. 6(1)(b)).
Stripe's privacy policy: stripe.com/privacy
What: Our hosting provider (Netlify) automatically records standard server access logs, which may include your IP address, browser type and version, operating system, referring URL, pages visited, and the date and time of your visit.
Why: These logs are necessary for website security, abuse prevention, and basic operational troubleshooting.
Legal basis (GDPR): Legitimate interest in maintaining website security and availability (Art. 6(1)(f)).
Retention: Netlify retains access logs for up to 30 days. We do not independently store server logs.
Netlify's privacy policy: netlify.com/privacy
If we use an analytics service (such as a privacy-respecting, cookie-free tool), it collects only aggregated, non-identifying data: page views, referral sources, and country-level location. It does not use cookies, does not track individual users across sessions, does not collect IP addresses in identifiable form, and does not share data with any advertising network.
Legal basis (GDPR): Legitimate interest in understanding aggregate website usage (Art. 6(1)(f)).
To be explicit, we do none of the following:
We use a minimal number of cookies, limited to:
You can delete or block cookies through your browser settings at any time. Because we use no advertising or non-essential tracking cookies, doing so will not affect your ability to browse or purchase from the site (though it may reset a cookie-consent preference if one was set).
We use the information described in Section 3 for the following purposes only:
We do not use your data for marketing, profiling, advertising, or any purpose not listed above.
We use a limited number of third-party services to operate. Each receives only the minimum data necessary for its function:
| Service | Purpose | Data They Receive | Location |
|---|---|---|---|
| Stripe | Payment processing | Payment card details (directly from your browser) | United States |
| Netlify | Website hosting & CDN | Server logs (IP, browser, pages visited) | United States / Global CDN |
We do not share your personal information with any other third parties, service providers, or partners. If we add a new sub-processor in the future, this policy will be updated before the change takes effect.
We do not sell, trade, rent, or voluntarily disclose your personal data to any third party except as described in Section 7. We may disclose information only if:
As of the date of this policy, we have never disclosed personal data to any government, law enforcement agency, or third party under any of the above provisions.
When data reaches the end of its retention period, it is permanently and irreversibly deleted. We do not archive data "just in case."
We implement the following security measures to protect your information:
No system is 100% secure. If we ever discover a data breach affecting your personal information, we will notify affected users within 72 hours and report to the relevant supervisory authority where required by law.
Depending on where you live, you have specific rights under applicable privacy laws. We honor all of these rights regardless of your location - you do not need to prove residency to exercise them.
If you are in the European Economic Area (EEA), United Kingdom, or Switzerland:
Legal bases for processing: We process personal data under Article 6(1)(b) (performance of a contract - delivering your products), Article 6(1)(f) (legitimate interest - website security, support, analytics), and Article 6(1)(c) (legal obligation - tax records). We do not rely on consent as a legal basis for any processing on this website, so there is no consent to withdraw for website data processing.
California (CCPA/CPRA):
Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Oregon (OCPA), Montana (MCDPA), Iowa (ICDPA), Indiana (INPA), Tennessee (TIPA), and other U.S. state privacy laws:
If you are in Canada, you have the right to access, correct, and withdraw consent for the collection and use of your personal information. Because we collect minimal data and do not use it for marketing or profiling, exercising these rights is straightforward. Contact us and we will respond within 30 days.
If you are in Brazil, you have the right to confirmation of processing, access, correction, anonymization, portability, deletion, information about sharing, and revocation of consent under the Lei Geral de Protecao de Dados. Contact us to exercise any of these rights.
If you are in South Africa, you have the right to access, correction, deletion, and objection to processing under the Protection of Personal Information Act. We process your data lawfully, and you may lodge a complaint with the Information Regulator.
If you are in Australia, you have the right to access and correct your personal information under the Australian Privacy Principles. If you believe we have breached the Privacy Act, you may complain to the Office of the Australian Information Commissioner (OAIC).
If you are in Japan, you have the right to request disclosure, correction, cessation of use, and deletion of your personal information under the Act on the Protection of Personal Information.
If you are in South Korea, you have the right to access, correct, suspend processing of, and delete your personal information under the Personal Information Protection Act.
If you are in India, you have the right to access, correction, erasure, and grievance redressal under the Digital Personal Data Protection Act, 2023.
Regardless of where you live, we will honor any reasonable request to access, correct, or delete the personal data we hold about you. We believe everyone deserves the same privacy protections.
Email toolsblackbox@gmail.com with your request. To help us locate your data, include the email address you used to make a purchase or download. We will respond within 30 days (or sooner where required by law). We will never charge a fee for processing a privacy request. We will verify your identity before processing deletion or access requests to prevent unauthorized access.
BlackBox Tools is based in the United States. If you access our website from outside the United States, your data may be transferred to and processed in the United States.
For users in the EEA, UK, or Switzerland: we rely on the following safeguards for international transfers:
We do not independently transfer personal data to any country that lacks adequate data protection without appropriate safeguards in place.
We do not respond to "Do Not Track" (DNT) browser signals because we do not engage in tracking. We recognize Global Privacy Control (GPC) signals as a valid opt-out of the sale or sharing of personal information; however, since we do not sell or share personal information, no action is needed on our part.
BlackBox Tools is not directed at children under the age of 13 (or the applicable minimum age in your jurisdiction - 16 in the EEA for GDPR purposes). We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided us with personal data, contact us immediately at toolsblackbox@gmail.com and we will delete it within 48 hours.
We comply with the U.S. Children's Online Privacy Protection Act (COPPA), the UK Age Appropriate Design Code, and equivalent protections in all jurisdictions.
Our mobile applications have their own, separate privacy policies that cover the specific data practices of each app:
As we release additional apps or services, their privacy policies will be linked here. The present website policy covers only the blackboxtools.com website and the digital product store.
To the maximum extent permitted by applicable law, Diego Cordova (d/b/a BlackBox Tools) shall not be liable for any indirect, incidental, special, consequential, or punitive damages, or any loss of profits, revenue, data, or goodwill, arising out of or related to your use of this website, our products, or this privacy policy, regardless of the theory of liability (contract, tort, strict liability, or otherwise), even if we have been advised of the possibility of such damages.
Our total aggregate liability for all claims related to this website, our products, and our services shall not exceed the greater of: (a) the total amount you paid to BlackBox Tools in the twelve (12) months preceding the claim, or (b) fifty U.S. dollars ($50.00 USD).
Some jurisdictions do not allow the exclusion or limitation of certain damages. In such jurisdictions, our liability is limited to the fullest extent permitted by law.
You agree to indemnify, defend, and hold harmless BlackBox Tools (d/b/a BlackBox Tools), its owner, affiliates, and agents from and against any and all claims, damages, losses, liabilities, costs, and expenses (including reasonable attorneys' fees) arising out of or related to: (a) your use of the website or products; (b) your violation of this privacy policy or our terms of service; (c) your violation of any third-party rights; or (d) any content you submit to us (such as support emails).
This website and all products are provided on an "AS IS" and "AS AVAILABLE" basis, without warranties of any kind, whether express, implied, or statutory, including but not limited to implied warranties of merchantability, fitness for a particular purpose, title, and non-infringement. We do not warrant that the website will be uninterrupted, error-free, secure, or free of viruses or other harmful components.
This privacy policy and any disputes arising from it are governed by the laws of the State of Oklahoma, United States of America, without regard to conflict-of-law principles.
Any legal action or proceeding relating to this policy shall be brought exclusively in the state or federal courts located in Tulsa County, Oklahoma, and you consent to the personal jurisdiction of those courts.
Informal resolution first: Before initiating any legal proceeding, you agree to contact us at toolsblackbox@gmail.com and attempt to resolve the dispute informally for at least 30 days.
Note for EEA/UK users: Nothing in this section limits your right to bring proceedings in your country of residence as permitted by applicable law, or to lodge complaints with your local data protection authority.
If any provision of this privacy policy is found to be unenforceable or invalid by a court of competent jurisdiction, that provision will be limited or eliminated to the minimum extent necessary, and the remaining provisions will remain in full force and effect.
This privacy policy, together with our Terms of Service and Refund Policy, constitutes the entire agreement between you and BlackBox Tools regarding the subject matter herein, and supersedes all prior or contemporaneous communications, whether electronic, oral, or written.
We may update this Privacy Policy from time to time. When we do, we will:
Your continued use of the website after changes are posted constitutes your acceptance of the revised policy. If you disagree with any changes, your sole remedy is to stop using the website and request deletion of your data.
If you have any questions about this Privacy Policy, want to exercise your privacy rights, or have concerns about how your data is handled, contact us:
We aim to respond to all privacy inquiries within 30 days. For GDPR and UK GDPR requests, we will respond within one calendar month as required by law.