Scope and contact
This review draft covers the marketing website and the implemented Commerce and licensing flow. Public checkout, account sign-in and website downloads remain closed. Existing licensed delivery is a separate active service. The legal data controller and required disclosures remain unconfirmed. Email support@lazeclient.com privately for privacy questions; do not include a license key or full card details.
Browsing and technical data
The marketing pages do not require an account or collect payment details. The inspected marketing code contains no advertising pixels or analytics scripts and loads its fonts locally. Hosting and security providers may process technical connection data such as IP addresses and request information. That is not a promise that browsing produces no infrastructure logs. Optional Discord and other external links take you to services with their own privacy practices.
Discord account information
When public sign-in opens, Discord’s identify scope supplies your numeric user ID and display name, without requesting email, messages or server membership. Display names are temporary session information; the numeric ID links purchases. OAuth access tokens are used to retrieve identity and are not stored in the Commerce database or browser. Starting checkout creates a durable order and purchase principal, including if payment is later abandoned.
Orders, payments and device information
Commerce stores order and payment references, products, USD amounts, credits, partner identifiers, timestamps, states and fulfillment/reconciliation records in Cloudflare D1. Stripe hosts payment entry; the inspected Commerce flow receives identifiers, amounts and payment outcomes rather than full card numbers. Stripe processes payment data under its own terms and privacy notice. HWID registration sends a 64-character hardware-derived identifier to issuance operations and the Google licensing authority. A device-linked identifier is personal information where it can be linked to a person; it is not anonymous merely because it is hashed.
License and security records
The licensing authority stores key hashes, HWID bindings, Discord purchase identity, term, status, revisions and audit history. Commerce stores encrypted recoverable license keys and operation receipts. Authorized customers can reveal a key only after entitlement checks; the page keeps it in memory and an explicit copy action places it on the device clipboard. The native launcher remembers a key using Windows CurrentUser protection. Orders and license records support fulfillment, fraud/risk review, support and integrity checks. Legal bases and access/incident procedures require final approval.
Providers and support
Cloudflare hosts the website, Commerce service, D1 ledger and private R2 artifacts. Google Apps Script and Google Sheets operate the licensing authority. Discord supplies identity and optional community support. Stripe processes payments. Support messages contain the information you choose to send and are handled through the support mailbox and, if chosen, Discord. Provider roles, mailbox arrangements, storage locations and international transfer safeguards require verification before the final notice.
Laze Chat
The optional in-client chat uses Minecraft account verification through Mojang’s session service, separately from Discord purchase sign-in. The chat service processes Minecraft UUIDs, verified usernames, authentication challenges, connection state and the messages you send. Public messages are broadcast to connected users; private messages are routed to the named online recipient. The inspected service has no chat-history database; short-lived challenge and rate-limit records use expiration and cleanup. This does not establish that provider infrastructure retains no logs, or prevent recipients from keeping messages. Do not send keys, HWIDs or payment details in chat. Provider logging, incident handling and final retention disclosures still require review.
Cookies and sessions
The marketing site does not implement an account cookie. The planned Commerce login uses essential Secure, HttpOnly, SameSite=Lax cookies for OAuth state and an opaque session. OAuth state expires after 10 minutes and sessions after one hour; expiration prevents authorization before cleanup. CSRF tokens are held in page memory. External providers may use their own cookies when you visit them.
Retention and deletion
Expired OAuth/session rows and temporary profiles are eligible for scheduled cleanup while processing runs; stopped scheduling may delay physical deletion. Purchase, principal, payment-risk, issuance, licensing and audit records currently have no automatic deletion schedule. Signed journals and backups require integrity-preserving handling. No fixed retention period or automatic erasure is promised. Final review must set justified periods or criteria for each category, provider logs, support mail and backups, along with legal/accounting exceptions and a tested deletion procedure.
Privacy requests and choices
Depending on applicable law, rights may include access, correction, erasure, restriction, objection, portability and complaint to a regulator. Send requests privately to support@lazeclient.com with enough context to locate the account; do not send passwords, card numbers or keys. Verification, legal exceptions and response obligations must be finalized. A request to Laze cannot by itself erase information Stripe or another provider must independently retain. No sale or advertising use is implemented in the inspected marketing/Commerce code; this is not an unverified business-wide promise.
Security and changes
The implementation uses authenticated access, signed licensing operations and encryption for recoverable keys. No system guarantees absolute security. Final approval must cover staff access, incident handling, notification obligations and recovery. Material changes to an approved notice should be dated and communicated as required. This draft has no effective date and does not ask for consent.
Items awaiting approval
Confirm the controller and required contact disclosures, applicable legal bases and markets, provider roles/transfer safeguards, category-specific retention and backup periods, rights-request verification, age eligibility and incident responsibilities.
These items prevent final policy approval; they do not prevent you from contacting support about an existing purchase.
Review references
General guidance informs this draft; it does not establish which laws apply to a particular purchase.