When you buy something we receive your email address and an order number from PayPal. We never see or store your card details.
We also keep a record of the delivery itself: when your download page was opened, which files you downloaded and when, and the IP address and browser the request came from. We keep this because payment providers treat a digital sale as undelivered unless the seller can show the buyer actually received the goods, and that record cannot be reconstructed after a dispute is raised. It is used for that purpose and for nothing else — not for advertising, profiling or tracking you across other sites.
We do not sell your data, we do not run advertising trackers, and we do not email you marketing unless you ask for it.
Order and delivery records are kept for 400 days, which covers the window in which a payment can be disputed, and then removed. Ask us to delete your record sooner and we will, unless a dispute on your order is still open — note that deleting it also ends our ability to re-issue your download links.