Bear of Spades and mcSkinningBee Privacy Policy

Version dated August 27, 2026

This Privacy Policy explains how Bear of Spades collects, uses, retains, and protects personal data in connection with the www.bearofspades.com website, downloads of mcSkinningBee, licence purchases, licence activation and validation, information about new versions, and support.

It applies to website visitors, mcSkinningBee users, subscribers to new-version information, customers, artists to whom a licence is assigned, and individuals who contact Bear of Spades.

1. Data controller

The controller responsible for the processing described in this Policy is:

  • Maxime Cozic – Entrepreneur individuel (EI)

  • Trade name: Bear of Spades

  • Address: 14 bis rue du Pont-au-Coq, 95350 Saint-Brice-sous-Forêt, France

  • SIREN: 501 400 212

  • SIRET: 501 400 212 00020

  • Privacy contact: privacy@bearofspades.com

  • Website: www.bearofspades.com

Messages sent to privacy@bearofspades.com may be redirected to the Bear of Spades support system. Access to requests remains restricted to persons authorised to handle them.

Bear of Spades has not appointed a Data Protection Officer because such an appointment is not required as of the date of this Policy.

2. Principles applied

Bear of Spades endeavours to:

  • collect only the data necessary for specified purposes;
  • provide individuals with clear information;
  • retain data for a limited period;
  • protect data using measures appropriate to the risk;
  • not sell personal data; and
  • enable individuals to exercise the rights granted by applicable law.

3. Data collected

3.1 Website visits and technical logs

When a person visits the website, the servers may automatically process:

  • the IP address;
  • the date and time of the request;
  • the requested resource;
  • the server response code;
  • the browser type and version;
  • the operating system reported by the browser;
  • the referring page, when transmitted; and
  • technical information relating to errors, security, and abuse prevention.

This information is used to provide and secure the website, diagnose incidents, and maintain its operation. As of the date of this Policy, Bear of Spades does not use an audience analytics service, behavioural advertising, or advertising tracking on its website.

3.2 Downloads

When a download takes place, Bear of Spades processes the technical information necessary to provide the file and secure the service.

To estimate the number of unique downloads without retaining IP addresses for this purpose over the long term:

  • the IP address is truncated;
  • the truncated value is transformed using a cryptographic mechanism with a secret that is rotated daily;
  • the resulting daily pseudonym is retained for no more than 48 hours; and
  • only aggregated statistical totals that no longer identify an individual are subsequently retained.

This counting process is separate from technical security logs, which may contain the full IP address for their own retention period.

3.3 Subscription to information about new versions

When a person chooses to receive emails about new versions of mcSkinningBee, Bear of Spades may process:

  • their email address;
  • the date and time of subscription;
  • the subscription source or form;
  • the version of the consent wording presented;
  • the subscription confirmation status;
  • interactions necessary to manage the subscription, including confirmation or unsubscription; and
  • the date of the most recent relevant contact or interaction.

Subscription is optional. The subscription checkbox is not preselected, and mcSkinningBee remains available for download without subscribing.

Each email provides a simple means of unsubscribing. Withdrawal of consent does not affect the lawfulness of processing carried out before that withdrawal.

3.4 Orders and payments

Purchases are made without creating a user account.

In connection with an order, Bear of Spades may receive or process:

  • the first and last name of the customer or designated artist;
  • the organisation name, where applicable;
  • the email address;
  • the billing address and country;
  • the EU VAT identification number, where applicable;
  • the licence type, product, duration, and quantity;
  • the amount, currency, taxes, and payment status;
  • customer, order, payment, invoice, or transaction identifiers provided by Stripe or Link;
  • information necessary for fraud prevention, refunds, and disputes; and
  • the version of the contractual documents accepted and the date of acceptance.

Bear of Spades does not receive or retain full payment-card details. They are processed by Stripe, Link, and the relevant payment service providers.

3.5 Creation, assignment, and management of licences

To generate and administer a licence, Bear of Spades may process:

  • the licence identifier;
  • the licence type, status, and expiry date;
  • the name and email address of the designated user;
  • the licence-holding organisation, where a licence is purchased by a studio or other organisation;
  • the date of creation, activation, renewal, suspension, or deactivation; and
  • information necessary for permitted corrections and reassignments.

3.6 Activation and validation of mcSkinningBee

Upon first activation, mcSkinningBee generates a random secret on the device that is specific to that installation. This secret is stored using the operating system's protected storage features where available.

The raw secret is not transmitted to Bear of Spades. mcSkinningBee derives from it a pseudonymous identifier specific to the licence. Only this derived identifier is sent to the server.

For this purpose, Bear of Spades does not collect:

  • the motherboard serial number;
  • a disk serial number;
  • the MAC address;
  • the processor serial number; or
  • a fingerprint composed of hardware characteristics.

An activation or validation request may contain:

  • the licence identifier;
  • the pseudonymous installation identifier;
  • the mcSkinningBee version;
  • the Autodesk Maya version;
  • the date and time of the request;
  • the validation result;
  • the licence status and expiry date; and
  • technical information strictly necessary to diagnose a validation failure.

An initial authorisation may be temporary. A further validation may be required approximately six weeks after purchase or first activation to finalise the authorisation for the remainder of the licence period. Where the first activation occurs after that period, the final authorisation may be issued immediately. Once the final authorisation has been issued for an installation, no ordinary periodic validation is planned for that installation before the licence expires.

The same designated user may activate the licence on multiple computers in accordance with the Licence Terms. Manifestly unusual activation volumes may be reviewed manually to identify a technical error, unauthorised sharing, fraud, or other abuse. No adverse measure is taken solely on the basis of a fully automated decision.

3.7 Support and complaints

When a person contacts Bear of Spades by email, Bear of Spades may process:

  • their name, email address, and organisation;
  • the message content and attachments;
  • order or licence references;
  • technical information supplied voluntarily;
  • the history of correspondence; and
  • the measures taken to resolve the request.

Users are asked not to send sensitive banking data, passwords, or information unrelated to their request.

3.8 Discord

Bear of Spades provides links to Discord channels for community support and bug reporting. Use of Discord is optional and requires access to a service operated by Discord.

Usernames, messages, files, reactions, and other information posted on Discord are processed by Discord under its own terms and privacy policy. Depending on the channel configuration, this information may be visible to other members.

Bear of Spades may view and respond to messages posted in its channels. Where a message must be retained or transferred to the internal support system to address an issue, only the information reasonably necessary is copied.

4. Purposes and legal bases

Purpose Main legal basis
Provide and secure the website and downloads Bear of Spades' legitimate interest in operating and securing its service
Produce aggregated download statistics Legitimate interest in understanding overall service use while minimising data collection
Send optional information about new versions Consent
Manage an order, deliver a licence, and provide contractual documents Performance of a contract or steps taken before entering into a contract
Process payments, invoicing, refunds, and disputes Performance of a contract, legal obligation, or legitimate interest, depending on the processing
Maintain accounting and tax records Legal obligation
Activate and validate licences Performance of a contract and legitimate interest in protecting the licensing system
Detect fraud, abusive sharing, and circumvention Legitimate interest in preventing abuse and protecting the rights of Bear of Spades and its customers
Provide support and handle complaints Performance of a contract, pre-contractual steps, or legitimate interest, depending on the request
Establish, exercise, or defend legal claims Legitimate interest and compliance with legal obligations

Where processing is based on legitimate interest, Bear of Spades assesses the necessity of the processing and its reasonably foreseeable effects on data subjects. Individuals may object to such processing on grounds relating to their particular situation, subject to compelling legitimate grounds or the need to establish, exercise, or defend legal claims.

5. Required and optional data

Information identified as required during an order or activation is necessary to enter into or perform the contract, correctly assign the licence, prevent fraud, or comply with a legal obligation. Without it, Bear of Spades may be unable to process the order, deliver or validate the licence, or respond to a request.

Subscription to information about new versions is optional and does not affect the ability to download or purchase mcSkinningBee.

Use of Discord is also optional. Contractual and personal-data requests may be sent by email.

6. Recipients and service providers

Data is accessible only to the extent necessary by:

  • Maxime Cozic and persons expressly authorised to act for Bear of Spades;
  • OVHcloud, for hosting the website, application, database, backups, email, and SMTP service;
  • Stripe, Stripe Managed Payments, Link, financial institutions, and associated service providers for payment, indirect taxation, invoicing, fraud prevention, refunds, and disputes;
  • Discord, where the person chooses to use the Discord channels;
  • professional advisers, insurers, auditors, mediators, or authorities where access is necessary and legally justified; and
  • any administrative or judicial authority where required by law.

Bear of Spades does not sell or rent personal data and does not disclose it to third parties for their own advertising purposes.

7. Hosting and international transfers

The Bear of Spades website, application, database, backups, and email services are hosted by OVHcloud on infrastructure located in France, according to the configuration selected by Bear of Spades.

Stripe, Link, Discord, and their service providers may process certain data from countries outside the European Economic Area. In such cases, these providers state that they implement mechanisms provided for under applicable law, including an adequacy decision, Standard Contractual Clauses, or other appropriate safeguards.

For more information:

8. Retention periods

Data category Intended retention period
Orders, invoices, and accounting or tax records 10 years where this period is legally required
Main customer and licence data For the licence term, then 5 years after its expiry or the end of the contractual relationship
Pseudonymous installation identifiers For the licence term, then 12 months
Activation and validation logs 12 months
Website and server technical and security logs 12 months, unless a documented specific need or legal obligation requires otherwise
Daily pseudonyms used to count downloads No more than 48 hours
Download statistics that have become anonymous and aggregated No fixed limit, because they are no longer personal data
Subscription data for information about versions Until unsubscription or 3 years after the most recent relevant contact or interaction
Minimal objection or suppression list At least 3 years, solely to prevent further solicitation
Support requests and complaints 3 years after the request is closed, unless litigation or an obligation requires a different period
Routine backups Rolling 30-day cycle

Minimal evidence of subscription consent may be archived for as long as necessary to demonstrate Bear of Spades' compliance and defend its rights, without being used to send new messages after unsubscription.

At the end of the applicable period, data is deleted or anonymised. Data deleted from active systems may temporarily remain in backups during the 30-day cycle, without being reused except where necessary for secure restoration.

9. Cookies and local storage

As of the date of this Policy, the Bear of Spades website does not use advertising cookies or any audience analytics tool involving individual tracking.

The website may use strictly necessary or functional storage to:

  • remember the light or dark theme preference locally;
  • remember the selected language locally;
  • protect forms and requests against abuse;
  • ensure the security and continuity of a technical operation; and
  • enable redirection to payment or the return from it.

Theme and language preferences remain in the browser until the user changes them or deletes local data. They are not used for advertising or profiling.

Stripe or Link payment pages may use their own cookies or storage mechanisms in accordance with the information provided by those services.

If Bear of Spades later adds analytics, advertising, or another non-essential tracker, this Policy and the consent mechanism will be updated before it is activated where required by law.

10. Security

Bear of Spades implements reasonable technical and organisational measures, including as appropriate:

  • encryption of communications using HTTPS/TLS;
  • access controls and restrictions;
  • protection of credentials and technical secrets;
  • separation of environments and limitation of privileges;
  • backups hosted in France;
  • logging of security events;
  • component updates;
  • pseudonymisation of installation identifiers;
  • signing of licence authorisations; and
  • incident response procedures.

No transmission or system can be guaranteed to be absolutely secure. In the event of a personal data breach likely to result in a risk, Bear of Spades makes the required notifications to the CNIL and, where required by law, to the affected individuals.

11. Automated decision-making and profiling

Bear of Spades does not make decisions producing legal effects or similarly significantly affecting an individual solely on the basis of fully automated processing.

Technical rules may automatically accept or reject a request where the licence has expired, is invalid or revoked, or does not match the signed data. Unusual situations or suspected abuse that could lead to suspension are reasonably reviewed and may be subject to human intervention.

12. Individual rights

Subject to the conditions set out in the General Data Protection Regulation and French law, an individual may request:

  • access to their data;
  • rectification of inaccurate data;
  • erasure of their data;
  • restriction of processing;
  • portability of data they have provided, where the applicable conditions are met;
  • objection to processing based on legitimate interest;
  • withdrawal of consent at any time; and
  • information about safeguards applicable to international transfers.

An individual may also provide instructions concerning the handling of their data after death, under the conditions provided for by French law.

Certain requests may be restricted where retention is necessary to comply with a legal obligation, perform the contract, or establish, exercise, or defend legal claims.

13. Exercising rights

Requests should be sent to privacy@bearofspades.com, with sufficient details about the request and the information needed to locate the relevant data.

Bear of Spades may request proof of identity only where reasonably necessary to prevent disclosure of data to an unauthorised person. A copy of an identity document should not be sent without being requested.

Bear of Spades responds within the periods prescribed by law, generally within one month. This period may be extended where the request is complex or numerous, in which case the individual will be informed.

14. Complaint to the CNIL

If an individual considers that their rights have not been respected, they may lodge a complaint with the French Data Protection Authority, the Commission nationale de l'informatique et des libertés (CNIL):

Individuals are encouraged to contact Bear of Spades first so that the request can be reviewed and resolved.

15. Data concerning third parties

Where an organisation purchases a licence for a designated artist, it must ensure that it is authorised to provide the necessary information about that artist and that it informs the artist of this Policy.

A person who provides data concerning a third party in a support request must limit that information to what is necessary.

16. Minors

mcSkinningBee may be used in an educational setting, but its commercial services and optional communications subscription are not specifically directed at children.

Where consent is required to process a minor's data, it must be given or authorised by the holder of parental responsibility under the conditions provided by applicable law.

17. Links to external services

The website may contain links to Stripe, Link, Discord, Autodesk, YouTube, LinkedIn, or other external websites. Bear of Spades does not control processing performed by those services when a user chooses to visit them. Users are encouraged to read their respective privacy policies.

Website pages may include embedded YouTube videos using YouTube's privacy-enhanced youtube-nocookie.com service. When a page containing a video opens, the browser connects to that service. Product pages offering multiple videos also load selector thumbnails from YouTube's i.ytimg.com service. YouTube may therefore receive technical connection data such as the IP address, browser information, and the requested video or thumbnail. Videos do not play automatically.

18. Changes to this Policy

Bear of Spades may amend this Policy to reflect changes to the website, mcSkinningBee, service providers, processing activities, or applicable law.

The date or version number identifies the applicable Policy. In the event of a material change, appropriate notice will be provided where required or reasonably practicable.

19. Language

This Policy may be provided in French and English.

In the event of any discrepancy, the French version prevails, without prejudice to the mandatory rights of data subjects.

20. Contact

For any questions about this Policy or the processing of personal data: