Airlock
Privacy Policy
This Privacy Policy explains how JMS Media Group LLC (“we,” “us,” “our”) handles information in connection with Airlock (the “App”), a digital-product delivery application that a Wix site owner installs from the Wix App Market to sell downloadable files to their customers. This policy is written specifically for Airlock and its Wix and Stripe integrations; it is not a generic template.
Throughout this policy, the Wix site owner who installs the App is the “Seller” and the person who buys a file from that Seller is the “Buyer.” Airlock is a business tool for Sellers; it is not directed to consumers for personal use.
1. Who we are and our role
JMS Media Group LLC, 30 N Gould St Ste N, Sheridan, WY 82801, United States, operates Airlock. For a Seller’s own account data we act as a data controller. For the Buyer personal data that a Seller processes through Airlock, the Seller is the controller and Airlock acts as a processor / service provider on the Seller’s behalf. Sellers who require a Data Processing Addendum may request one at the contact address below.
2. Data we process
From Sellers
- Wix workspace identity (platform and instance/external id) and the Airlock plan in effect.
- Seller contact email, resolved from Wix or provided in the App, used for trust-policy warnings and export links.
- Uploaded files and their metadata (filename, size, type), and product details (name, price).
- Stripe connected-account id. We do not store card numbers or bank details — Stripe does.
From Buyers (processed on the Seller’s behalf)
- Email address, entered at Stripe Checkout, used to deliver the download link.
- Order and payment references (Stripe session and payment-intent ids, amount). We do not store card data.
- IP address at download time, used only to enforce optional per-network download locking and rate limits, and stored as the first-download network on the grant.
Automatically
- Basic logs (request metadata, timestamps) for operating and securing the service.
3. Why we process it (purposes and legal bases)
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Deliver purchased files; enforce limits, expiry, and IP lock | Buyer email, order references, IP address, files | Performance of contract / legitimate interest |
| Process payments | Stripe references | Contract (via Stripe) |
| Send transactional email (delivery, warnings, export) | Email addresses | Contract / legitimate interest |
| Storage accounting, plan enforcement, fraud and abuse prevention, security | Workspace, logs, IP address | Legitimate interest |
| Trust-policy retention and warnings | Contact email, workspace state | Legitimate interest / contract |
4. Service providers (sub-processors)
We share information only with providers that help us run the App, under confidentiality obligations:
- Wix — App distribution, installation and authentication, and the Seller relationship.
- Stripe — payment processing. Buyer email and payment data go to Stripe under Stripe’s own policy.
- Cloudflare R2 — encrypted file storage.
- Resend — transactional email delivery (recipient address and message).
- Fly.io — application hosting and Postgres database storage (United States).
We do not sell personal data, use it for advertising, or use it for any purpose other than providing Airlock.
5. Data retention
- Files follow the trust policy: they are retained while your plan is active, and if a subscription lapses we send escalating warnings (at 30, 90, and 330 days) and keep your files for a 12-month retention period before any deletion.
- Order and delivery records are kept as long as needed for the service and for accounting and legal obligations.
- Logs are kept for a limited operational period of up to 90 days.
6. International transfers
Airlock’s application, database, and file storage are operated in the United States, and our sub-processors may process data in the United States and the European Union. Where personal data is transferred out of the EEA or the United Kingdom, transfers rely on appropriate safeguards, such as the European Commission’s Standard Contractual Clauses.
7. Your rights
Depending on your location (GDPR, UK GDPR, CCPA/CPRA, and others), you may have rights to access, correct, delete, port, restrict, or object to the processing of your personal data, and to withdraw consent. Buyers should generally contact the Seller they purchased from; we assist Sellers in responding to those requests. To exercise rights directly with us, contact johan@struijk.it. You may also complain to your local data-protection authority.
8. Security
Data is transmitted over encrypted connections (HTTPS/TLS). Downloads are served through time-limited presigned URLs valid for no more than 15 minutes, with no database identifiers exposed; access is granted through opaque signed tokens. We apply rate limiting, access controls, and keep secrets in environment configuration, never in code or logs. No method of transmission or storage is 100% secure, but we apply reasonable administrative, technical, and physical safeguards appropriate to the data involved.
9. Cookies and tracking
The Airlock dashboard runs inside Wix and uses only what is necessary for authentication and operation. The buy widget and the download pages use no advertising or cross-site tracking.
10. Children
Airlock is a business tool intended for Sellers and is not directed to children. We do not knowingly collect data from children under 16.
11. Changes to this policy
We may update this policy from time to time. Material changes will be reflected by the “Last updated” date above and, where appropriate, communicated to installed Sellers through the App or by email.
12. Contact
Questions or requests regarding this policy or your data, including data-protection enquiries:
JMS Media Group LLC — Airlock
30 N Gould St Ste N, Sheridan, WY 82801, United States
Email: johan@struijk.it