Privacy

What this site collects

This site is a static site. It sets no cookies of its own and asks for no account.

• Newsletter: your email address, when you submit the subscription form.
• Analytics: aggregate page and interaction counts, with no cookie and no cross-site identifier.
• Purchase: Paddle collects your name, email and payment details as the Merchant of Record. It sends our licensing service the customer and purchase information described below.
• Licence: if you buy a licence, our activation service holds the records needed to activate it. They are listed below.

Who processes it

• MailerLite — newsletter delivery. The subscription form posts directly to MailerLite.
• GitHub Pages — website hosting, which records standard server request logs.
• Paddle.com Market Ltd — our reseller and Merchant of Record. Paddle takes the order, the payment details and the tax, and issues the receipt. Payment details are entered through Paddle checkout.
• Amazon Web Services (AWS) — hosting for the activation service, its database and encrypted processing queues, and setup and recovery email delivery through Amazon SES. Access is restricted to service roles and authorized support and operations staff.

• MailerLite privacy policy
• GitHub privacy statement
• Paddle privacy policy
• AWS privacy notice

What we do not do

• This site does not run advertising or cross-site tracking of its own.
• We do not sell or rent personal data.
• We do not use your licence data for advertising or profiling. Purchase, refund and chargeback notifications are processed automatically to update licence access.

What we cannot speak for

These statements describe our use of the services above. Providers also describe their own handling of personal data, cookies and service logs in their policies, linked above. Those policies should be read alongside this notice.

What a licence record holds

Buying a licence creates a record in our activation service. It holds:

• A customer identifier, which products you bought, and how many of your three computers are in use.
• Your Paddle customer identifier and initial checkout email, retained as the setup and recovery email. The account is bound to that customer identifier; accounts are not merged because they share an email address. Later checkout email changes do not automatically change this binding or recovery email.
• Paddle transaction and adjustment identifiers, the product price identifier, purchase, refund and chargeback status, and relevant timestamps, to keep licence access consistent with your purchase.
• A one-way hash of your licence code. The code itself is never stored, which is why we cannot read it back to you.
• For each activated computer: a device fingerprint, the name you choose for that computer, and the activation identifiers and times.
• Records of activation requests and their signed results, so a retry or a seat replacement cannot go wrong.
• Your IP address is used during a request to limit abuse. The activation application does not store or log the raw address; hosting providers may handle request data under their own policies.

Purchase notifications and setup

After a confirmed purchase, checkout offers secure licence setup in the same browser tab. We also email a one-time setup link to the retained initial checkout email as a backup. Your activation code is shown once in your browser after you confirm setup in the tab or use a setup or recovery link; we do not email the code in plaintext.

The licence database and ordinary application logs do not retain payment-card details, billing addresses or tax details. Authenticated notifications from Paddle can contain personal data while they await processing or failure investigation in encrypted queues. They are not copied into the licence database or ordinary logs.

Retention

Newsletter addresses are kept until you unsubscribe. Paddle retains payment and receipt records under its own policy and applicable tax and accounting requirements.

Licence records, including the Paddle account binding, retained email, purchase status, grants and revocations, are kept while the licence exists. They are what makes activation work: without them we cannot activate a new computer for you, move a seat, or recognize the licence you paid for. Ask us to delete them and the licence stops being usable on any new computer.

Paddle event-processing receipts and ordinary application logs have a 14-day retention period. Receipt expiry is set from creation; database expiry deletion is asynchronous and may occur later. Successfully processed notifications are deleted from the encrypted queue; failed notifications can remain in encrypted queues for up to 14 days.

Setup and recovery email jobs remain in the delivery queue for up to one day; failed jobs can remain in its encrypted failure queue for up to 14 days. Recovery links expire after 15 minutes; deletion of their database records is asynchronous.

A licence already installed on a computer keeps working offline even after we delete our records. Removing the record prevents future activations; it does not reach into a machine and remove what is already there.

Your requests

You can ask for a copy of your data, ask for corrections, or ask for deletion through the contact below. We verify the request and explain any required retention or backup limitations. Requests concerning payment records may also need Paddle’s own process. Every newsletter email also carries a one-click unsubscribe link.

Contact

Send privacy requests to info@studiocucurbits.com.