Privacy Policy

Effective Date: February 14, 2026

Last Updated: November 6, 2026

This page also exists in French (version française). In France, the French version prevails.

Changes on November 6, 2026: We no longer record whether you open our emails or which links you click in them (6.5). The transfer of your contact record to Encharge, in the United States, now relies on the European Commission's standard contractual clauses, which are part of the data processing agreement we signed with Encharge that day; Section 10 also says where Encharge stores your record and how it sends our emails (6.5 and 10). Nothing else changes in what we collect or how we use it.

Changes on November 5, 2026: Meta now receives nothing from us, from your browser or from our server, unless you accept our cookie banner (3.2, 4, 5, 6.4, 8.3 and 8.4); the email box on the downloads page is optional (6.5); the affiliate and ad-click references kept in your browser expire after 30 days (8.5). This policy also gives our legal name, address and email (1), names the French supervisory authority (9.9), gives the legal period for keeping accounting records (7) and says what the transfer to Encharge relies on (10). A Cookie settings link at the bottom of every page now reopens our cookie banner, so that you can change your answer at any time (8.6 and 9.7). Each change gives you more control over your data; none takes anything away.

UB DSP ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, share, and protect your personal data when you visit our website ubdsp.com (the "Website"), create an account, purchase our audio plugin products, or interact with our services.

This policy is designed to comply with the General Data Protection Regulation (GDPR) (EU Regulation 2016/679) and applicable French data protection laws, including the Loi Informatique et Libertés.

1. Data Controller

The data controller responsible for your personal data is:

• Name: Benoit Scarwell EI (entrepreneur individuel, a sole proprietorship), trading as UB DSP
• Address: Chemin de Lestanquet, 64100 Bayonne, France
• Email: support@ubdsp.com
• Contact: Contact page

As a sole proprietorship, Benoit Scarwell serves as both the data controller and the data protection point of contact. For any privacy-related inquiries, write to support@ubdsp.com or use our contact page.

2. What Data We Collect

2.1 Account Data

When you create an account on our Website, we collect:

• Name: Your first and/or last name.
• Email address: Used for account identification, communications, and license delivery.
• Sign-in tokens: UB DSP accounts have no password. You sign in either with a one-time link we email you, or with Google Sign-In. Those links are single-use, expire (typically within 24 hours, up to 7 days for a link included with a purchase), and are stored only as a cryptographic hash — the link itself cannot be recovered from our database. If you use Google Sign-In, we store the identifier Google gives us, never your Google password.
• Download links: On a phone or tablet, you can ask us to email you the download link of a plugin, to open on your computer. We then create your account with that email address if you do not have one, and send you one email with the link. The link downloads that plugin only, works for 14 days, opens no session on your account, and is stored only as a cryptographic hash; we record when it was sent and when it was first used. When you open it, our page removes it from the address bar before any analytics tool loads. Asking for the link does not, by itself, put you on our email list or send anything to Encharge (Section 6.5): that happens only if you then download the plugin, as for any trial, and marketing emails only if you tick the box at that moment.

2.2 Purchase Data

When you purchase a product, the following data is associated with your account:

• Order details: Product purchased, date of purchase, order reference number.
• Where the purchase came from: If you reached us through a link carrying campaign labels (in a newsletter, an article, a video description or one of our ads), those labels, meaning the name of the publication and of the campaign, are recorded with your order, so that we can tell which publications actually lead to sales. They describe the link you followed, not you (see Section 8.5).
• Payment information: All payment data (credit card numbers, billing address, etc.) is collected and processed exclusively by Paddle.com, our Merchant of Record. We do not receive, store, or have access to your payment card details.

2.3 License Data

• License keys: Generated upon purchase and tied to your account.
• Contents of your license file: The .ubkeyfile we send you contains the product name, a license identifier, the date, your first name and your email address, all covered by a cryptographic signature. The email address is what identifies the license as yours, which is why it is included and why it cannot be edited without invalidating the file. Keep in mind that this file is yours to store: if you share it, or place it in a project folder you send to someone else, you are sharing that email address too.
• Activation: Your license file is checked on your computer. We do not collect machine identifiers.
• Reseller codes: If you bought a plugin from a reseller and redeemed its code on this site, we keep a hashed form of that code (not the code itself) linked to the license it unlocked, so that a code works once and so that we can reconcile the reseller's statement. The reseller holds its own record of your purchase under its own privacy policy.

2.4 Technical Data

• IP address: Automatically recorded in server logs when you access our Website. Used for security and abuse prevention.
• Session data: We use a session cookie to maintain your login state (see Section 8: Cookies).

3. What We Do NOT Collect

Transparency about what we do not collect is just as important. UB DSP does not collect:

• No payment card data: All payment processing is handled by Paddle. We never receive, store, or have access to your credit card details.
• No biometric data: We do not collect fingerprints, voice recordings, facial recognition data, or any other biometric information.

3.1 Optional Plugin Telemetry (Opt-In)

Our audio plugins include an optional, opt-in telemetry feature that is disabled by default. If you choose to enable it, the plugin sends anonymous usage data (such as DAW name, OS version, session duration, and feature usage) to help us improve our products. This data cannot be linked to your personal identity. You can disable telemetry at any time from the plugin settings. Telemetry data is retained for 90 days (raw events) and aggregated monthly statistics are retained permanently in anonymized form.

3.2 Website Analytics and Marketing

We use Google Analytics 4 and Google Ads (both via Google Tag Manager), and the Meta Pixel together with Meta's Conversions API, to understand how visitors use our Website, to measure whether our advertising works, and — only if you accept advertising cookies — to show our ads again to people who have already visited our Website (Sections 6.3 and 8.3). Analytics and advertising cookies are only set if you explicitly accept them through our cookie consent banner. If you decline, no analytics or advertising cookies are stored on your device and you are not added to any advertising audience. Nothing is sent to Meta, from your browser or from our server (Section 8.4). Two things still happen, and Section 8 describes each in full: Google may receive a cookie-less signal used only for aggregate modelling (Section 8.2), and if you arrived through an affiliate link, one of our ads or a link carrying campaign labels, a reference to that link is kept in your browser for 30 days at most, so that a later purchase can be credited to it (Section 8.5). You can change your answer at any time with the Cookie settings link at the bottom of every page (Section 8.6).

4. Legal Basis for Processing (GDPR Article 6)

We process your personal data under the following legal bases:

Where we rely on legitimate interest, we have conducted a balancing test to ensure our interests do not override your rights and freedoms. You may object to processing based on legitimate interest at any time (see Section 9).

5. How We Use Your Data

We use the personal data we collect for the following purposes:

• Account management: To create and maintain your user account, authenticate your identity, and provide access to your purchases and licenses.
• License delivery: To generate, deliver, and manage your .ubkeyfile license files.
• Customer support: To respond to your support requests and troubleshoot issues.
• Transactional emails: To send essential communications including:
  • Welcome emails upon account creation
  • Purchase confirmation emails, including your license file
  • Download links, sent when you ask for one from a phone or tablet
  • One-time sign-in links, sent when you ask to log in
• Security: To protect our Services against unauthorized access, fraud, and abuse.

We do not carry out automated decision-making that produces legal effects concerning you, or that similarly significantly affects you (GDPR Article 22). We do group customers according to what they own and have purchased, so that we can decide which of our own emails are relevant to send you — for example, not offering you a plugin you already own (see Section 6.5). If you accept our cookie banner, we use hashed (irreversible) versions of your email address for ad conversion measurement via Meta, which helps us understand whether our advertising is effective (see Sections 6 and 8 for details). If you accept advertising cookies, the pages you visit here are also used to place you in a broad advertising audience held by Google — for example, people who read a plugin page without downloading the trial — so that we can show our ads to that group again. That is a grouping by pages visited, not an individual profile: we cannot see who is in it or single anyone out, we send Google no name and no email address, and we do not upload our customer or mailing lists to any advertising platform (see Sections 6.3 and 8.3). If you decline our consent banner, none of this happens.

6. Data Sharing

We share your personal data only with the following third parties, and only to the extent necessary to provide our Services:

6.1 Paddle.com (Payment Processing)

Paddle is the seller of our products (Merchant of Record): when you make a purchase, you buy from Paddle, which collects and processes your payment information directly. On our product pages, Paddle's checkout script is loaded from cdn.paddle.com only when you click the Buy button, not while you read the page; your account page, where signed-in customers can buy at their owner's price, loads it on arrival. From that moment Paddle, and Cloudflare, which delivers Paddle's files, receive your IP address and browser user-agent and may set their own cookies on paddle.com (for example Cloudflare's __cf_bm, a 30-minute bot-protection cookie). Paddle has its own privacy policy, which governs how they handle your payment data: Paddle Privacy Policy.

6.2 PlanetHoster (Hosting Provider)

Our Website and database are hosted on servers provided by PlanetHoster, located in France and Switzerland. PlanetHoster acts as a data processor on our behalf and stores the data described in this policy. Your data remains within the European Economic Area and Switzerland, ensuring full GDPR compliance without the need for additional transfer safeguards.

6.3 Google (Analytics, Ads and Sign-In)

We share data with Google for four distinct purposes:

• Google Analytics 4 (via Google Tag Manager) collects anonymous, aggregated usage data about how visitors interact with our Website. Analytics cookies are only set if you accept them through our consent banner. For this analytics processing Google acts as a data processor on our behalf. If you accept, that same data — and no additional data — is also used to build the advertising audiences described below; sharing an audience with our Google Ads account is a disclosure to Google in its own right, and rests on your consent rather than on our processor agreement.
• Google Ads conversion tracking (via Google Tag Manager) tells Google when a visit that began with one of our ads led to a free-trial download or a purchase. For a purchase we send the amount, the currency and the order reference; the order reference is there so that the same sale is never counted twice. We do not send your name, your email address, or any hashed form of them, to Google. Advertising cookies are only set if you accept them through our consent banner.
• Google Ads remarketing audiences let us show our ads again to people who have already been here. If you accept advertising cookies, the pages you viewed are used to place you in an audience — for example, people who read a plugin page without downloading the trial — which we share with our Google Ads account so that we can advertise to that group. This collects nothing new: it re-uses the Google Analytics data described above, adds no cookie beyond those already listed in Section 8, and never carries your name or your email address. An audience is a group, not a named list: we can choose to advertise to it, but we cannot see who is in it or pick out an individual. Membership expires automatically after at most 540 days, and sooner if you clear your browser's site data. We do not upload our customer or mailing lists to Google (no “Customer Match”). If you decline our consent banner, you are never added to an audience.
• Google Sign-In lets you sign in with your Google account instead of an emailed link. Google's sign-in button is loaded from accounts.google.com only when you open our sign-in dialog or our sign-in page, never while you simply browse our pages. At that moment Google receives your IP address, your browser user-agent and the address of the page, together with any cookies your browser already holds for Google, and Google's script sets the g_state cookie described in Section 8.1. This happens whether or not you accepted our consent banner, because it is part of the sign-in you asked for. If you then choose to sign in with Google, Google sends us your email address, your first name and an account identifier; we store that identifier, never your Google password. Google acts as an independent controller for its sign-in service.

See Google's Privacy Policy.

6.4 Meta (Facebook) — Advertising

We share data with Meta for advertising measurement purposes:

• Client-side (Meta Pixel): Page views and interaction events, only when you accept marketing cookies. If you decline cookies, nothing is sent to Meta from your browser, and nothing from our server either.
• Server-side (Conversions API): Only if you accepted marketing cookies. For completed purchases and account registrations, we send hashed (SHA-256, irreversible) versions of your email address and first name to Meta to measure ad conversion effectiveness; for purchases, we also send the transaction value and currency. Our server also sends Meta page-view events. We rely on your consent (GDPR Article 6(1)(a)) for all of it; Section 8.4 lists the pages concerned and what each event contains.

See Meta's Privacy Policy.

6.5 Encharge (Customer Relationship Management)

We use Encharge, operated by PXCH Holding I, LLC (Miami, Florida, United States), as our customer relationship management and email platform. Encharge acts as a data processor on our behalf, under a data processing agreement signed on November 6, 2026 (see Section 10).

We send Encharge your email address and first name, together with the following account activity, so that we can manage customer communications and send you only messages that are relevant to you:

• Account events: account creation, sign-in, and changes to your email address.
• Product activity: installer downloads (product and platform), completed purchases, licenses we grant directly, refunds, and checkouts started from your account page.
• Customer summary fields: which plugins you own, how many purchases you have made, the date of your last purchase, and your total spend. These let us avoid offering you a plugin you already own, and exclude you from purchase-related messages after a refund.
• Email consent: if you ticked the email box on the downloads page, the date you ticked it and which version of its wording you agreed to.

Who gets our marketing emails. Customers, about plugins like the ones they bought, and people who ticked the email box on the downloads page. That box is optional: your trial downloads whether or not you tick it, and it is never ticked for you. Every marketing email has an unsubscribe link, and unsubscribing never stops your trial or affects a license. When you tick the box, we keep the date, the wording you agreed to and the page where you ticked it, as proof of your consent.

No open or click tracking. Since November 6, 2026, open and click tracking are switched off in Encharge: our emails no longer record whether you open them or which links you click. Encharge still records what it needs to deliver them, such as a delivery, a bounce, an unsubscribe or a spam complaint. Links to our website carry campaign labels (source encharge, the name of the email sequence and the email's subject), which tell us which email a visit or a purchase came from, as for any other labelled link (Section 8.5).

We deliberately do not send Encharge your IP address, and no plugin telemetry is ever linked to your contact record (see Section 3.1). See Encharge's Privacy Policy.

Because Encharge cannot delete a contact through the interface we use to send it data, erasure requests are carried out manually on your Encharge record whenever you delete your account (see Section 9.3).

6.6 No Selling of Data

We do not sell, rent, trade, or otherwise share your personal data with third parties for their marketing purposes. We will never monetize your data.

7. Data Retention

• Account data: Retained for as long as your account remains active. If you request account deletion, we will erase your personal data within 30 days, except where we are required by law to retain certain records.
• Purchase and license records: Retained for as long as your account is active to enable license re-downloads and support. Accounting records, such as orders and payout statements, are kept for up to 10 years, the period French law sets for accounting documents (Article L.123-22 of the French Commercial Code).
• Server logs (IP addresses): Automatically deleted after 90 days.
• Session data: Session cookies expire when you log out or after a period of inactivity as configured on the server.

8. Cookies and Browser Storage

8.1 Essential Cookies

We use three strictly necessary cookies. The third one is only set if you open our sign-in dialog or sign-in page:

These cookies are essential for the functioning of user accounts and for respecting your cookie choice. ubdsp_sid and ubdsp_consent are ours: they do not track you, contain no personal data, and are not shared with any third party. g_state belongs to Google's sign-in script, which writes and reads it on our pages; it is only there because you opened our sign-in dialog or sign-in page. Under the GDPR and ePrivacy Directive, strictly necessary cookies do not require consent — recording a refusal is itself a strictly necessary operation.

8.2 Analytics Cookies (Opt-In)

We use Google Analytics 4 (via Google Tag Manager) to collect anonymous usage data such as pages visited, session duration, and general geographic region. These cookies are only set if you click "Accept" on our cookie consent banner.

If you decline or ignore the banner, no analytics or advertising cookies are stored on your device: Google Tag Manager is told through Google Consent Mode v2 that analytics storage, advertising storage, advertising user data and advertising personalisation are all denied, and that instruction stays in force until you change it (Section 8.6). In that state Google may still receive a cookie-less signal — your IP address, your browser user-agent and the address of the page — which it uses only to model aggregate statistics. Nothing is written to your device, so that signal cannot be used to recognise you on a later visit or across websites.

Our consent banner offers a single combined choice, so accepting it grants analytics and advertising consent together. The analytics data described here is then also used to build the Google advertising audiences described in Section 8.3; nothing extra is collected for that purpose. Declining leaves both denied.

Google Analytics data is anonymous and aggregated. We do not combine it with any personally identifiable information. You can learn more about how Google processes data at Google's Privacy Policy.

8.3 Marketing Cookies (Opt-In)

We use the Meta (Facebook) Pixel to measure ad performance and understand how visitors interact with our Website after seeing our ads. The Meta Pixel sets cookies (_fbp, _fbc) only if you accept cookies through our consent banner. If you decline, no Meta Pixel code is loaded and no data is sent to Meta, from your browser or from our server (Section 8.4).

When enabled, the Meta Pixel collects page views and interaction events (such as viewing a product page or completing a purchase). This data is sent to Meta in a pseudonymised form to help us measure ad effectiveness.

Google Ads conversion tracking sets its own cookies through the Google Conversion Linker (names beginning with _gcl_), again only if you accept cookies through our consent banner. Their primary purpose is to remember that your visit began with one of our ads, so that a download or a purchase can be attributed to it; as the next paragraph describes, they also contribute to the remarketing audiences. They contain no name, no email address and no account reference.

If you accept cookies, we also build Google remarketing audiences: the pages you viewed place you in a group — such as people who read a plugin page without downloading the trial — which we share with our Google Ads account so that we can show our ads to that group again. This relies on the Google Analytics cookie already described in Section 8.2 together with the _gcl_ cookies above, and sets no further cookie of ours on your device; Google may in addition use its own advertising cookies, as described in its privacy policy. Membership lapses automatically after at most 540 days, or as soon as you clear site data for ubdsp.com. We never put your name or email address into an audience, we never upload our customer list to Google, and if you decline the banner you are not added to any audience at all.

8.4 Meta Conversions API (Server-Side)

We use Meta's Conversions API to send certain events to Meta from our own server rather than from your browser, so that they do not depend on the Meta Pixel being loaded. We send them only if you accepted marketing cookies in our consent banner: if you declined, or never answered, none of them is sent. Your answer reaches our server in a strictly necessary first-party cookie (ubdsp_consent), and, for a purchase, with the order we pass to Paddle, since Paddle's confirmation of the payment is what tells our server about it.

• Page views: When you visit our home page, a plugin page, one of our manuals, our blog, or our About, Downloads and FAQ pages, we send a server-side PageView event containing your IP address and browser user-agent string. On the plugin pages the same request also sends a ViewContent event naming the plugin and its price. These events are sent by our server, but they are triggered by the page you loaded asking it to: if you block scripts on our site, they are not sent. This helps us measure ad performance when the Meta Pixel is blocked.
• Counted once, not twice: If you accepted marketing cookies, the Meta Pixel in your browser reports the same page view. Both copies carry the same random one-time event identifier, generated for that page load only, so that Meta recognises them as one event. The identifier is not stored on your device and cannot be used to recognise you on any other page or visit.
• Page views while signed in: If you are signed in to your account, that PageView event also carries an internal account reference and hashed (SHA-256, irreversible) versions of your email address and first name, so Meta can match the visit to the right ad.
• Purchases and registrations: For completed purchases and account registrations, we send hashed (SHA-256, irreversible) versions of your email address and first name to Meta. No plaintext personal data is transmitted, only irreversible hashes.

We rely on your consent (GDPR Article 6(1)(a)) for all of this server-side processing. You may withdraw it at any time with the Cookie settings link at the bottom of every page (Sections 8.6 and 9.7): from then on, none of these events is sent.

You can learn more about how Meta processes data at Meta's Privacy Policy.

8.5 Information Stored in Your Browser (Local Storage)

Besides cookies, our Website keeps a small amount of information in your browser's local storage. It never leaves your device except where stated below, and you can erase all of it at any time by clearing site data for ubdsp.com in your browser settings.

The three attribution values are written when you arrive from an affiliate link, one of our ads or a link carrying campaign labels, before you answer the cookie banner. They are a reference to the link you clicked, not a profile of you: they contain no name, no email address and no browsing history, they are never read by any third-party script, and each is replaced by the next link of the same kind you follow. The campaign labels are the same for everyone who followed that link, so they say where a visit came from, never who made it. If you go on to buy, these values are attached to that transaction so the sale can be credited to the right affiliate, ad or publication, and the campaign labels are also recorded with your order (Section 2.2). Otherwise all three stop being used after 30 days and are deleted on your next visit. You may object to this processing at any time (see Section 9.6), and clearing site data removes them immediately.

8.6 Changing Your Cookie Choice

You can change your answer to our cookie banner at any time, as easily as you gave it: the Cookie settings link at the bottom of every page reopens the banner and shows your current choice. Your new answer applies at once, on the page you are on and on every page after it:

• Declining after accepting: Google Tag Manager is told through Google Consent Mode v2 that analytics storage, advertising storage, advertising user data and advertising personalisation are denied again (Section 8.2); the Meta Pixel stops sending anything from that page and is no longer loaded on the next ones (Section 8.3); the ubdsp_consent cookie switches to “declined”, so our server stops sending events to Meta (Section 8.4); and the analytics and advertising cookies already set on ubdsp.com (_ga, _ga_…, _gcl_…, _fbp and _fbc) are deleted from your browser.
• Accepting after declining: the same signals are switched back on, and those cookies may be set again from then on.

Withdrawing your consent does not affect what was sent while you had given it (Section 9.7). Cookies that Google or Meta keep on their own domains are beyond the reach of our pages; your browser settings can remove them. Your answer and its date are kept in your browser (Section 8.5), and clearing site data for ubdsp.com also brings the banner back.

9. Your Rights Under the GDPR (Articles 15–22)

If you are located in the European Economic Area (EEA), the United Kingdom, or where otherwise applicable, you have the following rights regarding your personal data:

9.1 Right of Access (Article 15)

You have the right to request a copy of the personal data we hold about you. We will provide this in a commonly used, machine-readable format.

9.2 Right to Rectification (Article 16)

You have the right to request correction of any inaccurate or incomplete personal data we hold about you.

9.3 Right to Erasure (Article 17)

You have the right to request deletion of your personal data ("right to be forgotten"). Upon receiving a valid erasure request, we will delete your account and personal data within 30 days, subject to any legal obligations that require us to retain certain records.

9.4 Right to Restrict Processing (Article 18)

You have the right to request that we restrict the processing of your personal data in certain circumstances, such as when you contest the accuracy of the data or object to processing.

9.5 Right to Data Portability (Article 20)

You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller.

9.6 Right to Object (Article 21)

You have the right to object to the processing of your personal data where we rely on legitimate interest as the legal basis. Upon receiving an objection, we will cease processing unless we demonstrate compelling legitimate grounds that override your interests.

9.7 Right to Withdraw Consent (Article 7(3))

Where processing is based on your consent (such as the marketing emails you agreed to receive when downloading a free trial), you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

This includes your answer to our cookie banner: the Cookie settings link at the bottom of every page reopens it, and choosing Decline withdraws your consent to analytics and advertising cookies and to the events we send to Meta (Section 8.6).

9.8 How to Exercise Your Rights

To exercise any of these rights, please use our contact page.

We will respond to your request within 30 days, in accordance with GDPR requirements. We may ask you to verify your identity before processing your request. There is no fee for exercising your rights, unless requests are manifestly unfounded or excessive.

9.9 Right to Lodge a Complaint

If you believe we have not handled your personal data properly, you have the right to lodge a complaint with a supervisory authority. If you are in the EU, you can contact the data protection authority in your country of residence. In France, the authority is the CNIL (Commission nationale de l'informatique et des libertés, cnil.fr). A list of EU data protection authorities is available at: European Data Protection Board — Members.

10. International Data Transfers

Your data is stored on servers located in France and Switzerland, provided by PlanetHoster. As both countries are within or recognized by the European Economic Area, no additional transfer safeguards are required under the GDPR for this hosting.

Some of our service providers may transfer data outside the EEA:

• Meta (Facebook): Hashed personal data sent via the Conversions API may be processed on Meta servers in the United States. Meta participates in the EU-U.S. Data Privacy Framework and relies on Standard Contractual Clauses for transfers.
• Google: Analytics data and advertising conversion data (the fact of a download or a purchase, and for a purchase its amount, currency and order reference) may be processed on Google servers in the United States, as may the technical data Google receives when you open our sign-in dialog (Section 6.3). Google participates in the EU-U.S. Data Privacy Framework.
• Paddle.com: Payment data transfers are governed by Paddle's own privacy policy and applicable transfer mechanisms.
• Encharge (CRM): Your contact record and the account activity described in Section 6.5 are stored by Encharge on Amazon Web Services servers in Ireland and processed by PXCH Holding I, LLC, a United States company. Encharge sends our emails through Twilio SendGrid, also in the United States. Encharge is not on the EU-U.S. Data Privacy Framework list, so no adequacy decision covers this transfer. It relies on the European Commission's standard contractual clauses (Implementing Decision (EU) 2021/914, module two, controller to processor), which are part of the data processing agreement we signed with Encharge on November 6, 2026, and which Encharge must also include in its contracts with its own subprocessors. You can ask us for a copy.

11. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including:

• HTTPS encryption: All communications between your browser and our Website are encrypted using TLS/SSL.
• No passwords at all: We do not use passwords, so there are none to leak. Signing in relies on a single-use link sent to your email address, or on Google Sign-In. Those links are stored only as a cryptographic hash and are invalidated the moment they are used.
• RSA-signed licenses: License files are cryptographically signed and cannot be forged or tampered with.
• Access controls: Database access is restricted to the application server and is not publicly accessible.
• Regular updates: Server software and dependencies are kept up to date to patch known vulnerabilities.

While we take reasonable precautions to protect your data, no method of transmission over the internet or method of electronic storage is 100% secure. We cannot guarantee absolute security.

12. Children's Privacy

Our Services are not directed to children under the age of 16. We do not knowingly collect personal data from children under 16. If we become aware that we have collected personal data from a child under 16 without verification of parental consent, we will take steps to delete that data promptly. If you believe a child under 16 has provided us with personal data, please contact us.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Update the "Effective Date" and "Last Updated" date at the top of this page.
• Notify registered users by email at least 30 days before material changes take effect.
• Post a notice on our Website.

We encourage you to review this policy periodically. Your continued use of our Services after the updated policy takes effect constitutes your acknowledgement of the changes.

14. Contact Us

If you have any questions about this Privacy Policy, wish to exercise your data protection rights, or have a privacy-related concern, please reach out via our contact page.

We aim to respond to all privacy-related inquiries within 30 days.