Last updated: 14 August 2026
This policy explains what we collect when you visit 9pmfiles.com or buy from us, why, and what you can do about it. It is written to be read, not to be survived.
1. Who is responsible
DEMURTAS AGENCY S.R.L., registered in Romania, registration number J2024001952403, registered office Str. Gabroveni nr. 61, Camera 1, Birou 54, Bl. Y1A, Sc. C, Et. 3, Ap. 9, Sector 3, 030087 Bucharest, Romania, is the controller of your personal data. Contact for anything in this policy: hello@9pmfiles.com.
2. What we collect
When you buy: your name and email address; your billing address and country; what you ordered, when, and for how much; the last four digits and card type. We never see or store your full card number: payment is processed by our payment provider.
When you only visit: your IP address, device type, browser, and approximate location derived from the IP; the pages you view, what you click, and whether you came from an ad; cookie and pixel identifiers, as described in section 6.
When you write to us: whatever you put in the email, and our reply.
We do not ask for, and do not want, any special-category data: no health, no political opinions, no biometrics. Please don't send us any.
3. Why we use it, and on what basis
- Deliver your files and support you afterwards — performance of our contract.
- Refunds and fraud prevention — contract, and our legitimate interest in not being defrauded.
- Accounting and tax records — legal obligation.
- Marketing emails — your consent, withdrawable at any time.
- Advertising and measurement — your consent, given via the cookie banner.
- Site security and analytics — legitimate interest in a working shop.
4. Who we share it with
We do not sell your personal data for money.
- Shopify — runs the shop, the checkout and the order records.
- Our payment provider — processes the payment. They receive your card details directly; we do not.
- Klaviyo — sends order and marketing emails, if you have given consent.
- Meta (Facebook, Instagram) — receives advertising and conversion events, if you have consented to advertising cookies. See section 7: under some US state laws this counts as "sharing".
- Professional advisers and authorities — where the law requires it.
5. Where your data goes
Our providers are based in the European Union and the United States, so your data may be processed outside your country. Where data leaves the EEA or the UK, the transfer relies on the safeguards those providers put in place, such as Standard Contractual Clauses or an applicable adequacy decision.
6. Cookies and pixels
- Strictly necessary — cart, checkout, security. Cannot be switched off; without them the shop does not work.
- Analytics — how the site is used, in aggregate.
- Advertising — the Meta pixel and equivalent tags, used to measure ads and to show them to people like you.
Analytics and advertising cookies are only set if you accept them. You can change your mind at any time from the cookie settings link in the footer, or by clearing cookies in your browser.
7. If you are in the United States
Depending on your state, you may have the right to know what we hold, to have it deleted, to correct it, and to opt out of "sale" or "sharing" of personal information for cross-context behavioural advertising.
We do not sell personal information for money. Our use of advertising pixels may qualify as "sharing" under California and similar laws. You can opt out by declining advertising cookies in the banner, using the cookie settings link in the footer, or by emailing us. We will not treat you differently for doing so.
8. If you are in the EU or the UK
You have the right to access your data, correct it, delete it, restrict or object to its processing, receive it in a portable format, and withdraw consent at any time. Withdrawing consent does not affect what we did lawfully before.
You also have the right to complain to your national data protection authority. We would rather you wrote to us first: hello@9pmfiles.com.
9. How long we keep it
- Order and invoice records — as long as tax law requires, then deleted.
- Marketing contacts — until you unsubscribe, then suppressed so we don't email you again by mistake.
- Support emails — 24 months.
- Analytics and ad events — as set by the provider, typically up to 24 months.
10. Children
The shop is not intended for children. We do not knowingly collect data from anyone under 16. If you believe a child has given us data, write to us and we will delete it.
11. Security
The site runs over HTTPS. Payment data never reaches our systems. Access to order data is limited to the people who need it, which today is one person.
12. Changes
If we change this policy we will update the date at the top, and for significant changes we will say so on the site.