Privacy Policy
Last updated: July 30, 2026
CDM STORES ("we", "our", or "us") operates the website cdmstores.com and the AI OBS Agent software. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or use our services.
1. Information We Collect
1.1 Information You Provide Directly
- Account Information: When you create an account, we collect your name, email address, and password (hashed).
- Google OAuth Data: When you sign in with Google, we access your name, email address, and profile picture from your Google Account. This data is used solely to create and identify your account on our platform.
- Address Information: When you make a purchase, we collect your shipping address (street, city, state, ZIP, country) to fulfill orders.
1.2 Information Collected Automatically
- Usage Data: We collect anonymous analytics about how you interact with our website (pages visited, time on site) via Cloudflare Web Analytics.
- Technical Data: Your IP address, browser type, and device information are processed by Cloudflare for security and content delivery purposes.
🔐 Google OAuth Scope Explanation
When you choose "Continue with Google", we request access to your basic profile information (name, email, profile picture). This data is used exclusively to:
- Create or identify your CDM STORES account
- Display your name and avatar in your dashboard
- Send you account-related notifications (license keys, subscription updates)
We never read, send, or delete your emails. We never access your Google Drive, contacts, or any other Google service data beyond the basic profile scope.
2. How We Use Your Information
- Account Management: To create, maintain, and secure your account.
- Service Delivery: To provide AI OBS Agent licenses, process payments via Stripe, and deliver product updates.
- Communication: To send transactional emails (license keys, subscription confirmations, payment receipts) and support responses.
- Security: To detect and prevent fraud, abuse, and unauthorized access.
3. Payment Processing
All payments are processed by Stripe, Inc., a PCI-DSS Level 1 certified payment provider. We never store your credit card information on our servers. Stripe's use of your data is governed by their Privacy Policy.
4. Data Storage & Security
- Your data is stored in Cloudflare D1 databases with encryption at rest and in transit.
- Passwords are hashed using bcrypt (never stored in plaintext).
- Authentication tokens are managed via secure HTTP-only cookies.
- We use industry-standard TLS encryption for all data transmission.
5. Data Sharing
We do not sell your personal data to third parties. We share data only with:
- Cloudflare: Infrastructure hosting (CDN, D1 database, Workers).
- Stripe: Payment processing (as described above).
- Law Enforcement: Only when required by valid legal process.
6. Your Rights (GDPR / LGPD / CCPA)
Depending on your jurisdiction, you have the right to:
- Access: Request a copy of your personal data.
- Correction: Update inaccurate information.
- Deletion: Request deletion of your account and data.
- Portability: Receive your data in a structured format.
- Withdraw Consent: Revoke Google OAuth access at any time via your Google Account settings.
To exercise any of these rights, contact us at [email protected].
7. Cookies
We use essential cookies for authentication (HTTP-only session cookies) and security (Cloudflare). We do not use tracking cookies for advertising purposes. No cookie consent banner is required under GDPR as we only use strictly necessary cookies.
8. Children's Privacy
Our services are not intended for individuals under the age of 13. We do not knowingly collect data from children.
9. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated via email or a notice on our website. Continued use of our services after changes constitutes acceptance.
10. Contact Us
For privacy-related inquiries, contact our Data Protection Officer:
