Legal

Privacy
Notice.

Draft pending legal review. What follows is a precise inventory of what this site actually processes, so a lawyer has something concrete to complete. As it stands it is not a GDPR-compliant notice.

Data controller

[TO COMPLETE: legal name, registered office, contact email; data protection officer if one has been appointed.]

What is actually collected

This site collects the following, and nothing else:

Email address. Entered before payment and confirmed by Stripe, used to register the license and deliver the key.
Billing details. Address and, where supplied, VAT number. Collected by Stripe to determine the applicable tax.
Transaction identifiers. Stripe checkout session, customer and payment references, amount and currency. These link a license to its purchase and support refunds and disputes.
License key and its status. With issue date and revocation date where applicable.

The site uses no profiling cookies and no analytics. Card details never pass through our systems: payment is handled entirely by Stripe.

Purposes and legal bases

Performance of a contract (Art. 6(1)(b) GDPR): issuing and delivering the license, support, handling refunds.
Legal obligation (Art. 6(1)(c) GDPR): retention of accounting and tax records.
Legitimate interests (Art. 6(1)(f) GDPR): fraud prevention and detection of shared keys.

Processors and recipients

Stripe. Payments and tax compliance.
Cloudflare. Site hosting and license records.
Email delivery provider. Delivery of the license key. [TO COMPLETE: name the provider actually in use.]

Some of these providers may process data outside the European Union. [TO COMPLETE: state the safeguards relied on, typically standard contractual clauses.]

Retention

[TO COMPLETE: set the periods. Known constraint: tax records must be retained for ten years under Italian law.]

Your rights

You may request access, rectification, erasure, restriction and portability of your data, and object to processing based on legitimate interests, by writing to [contact email]. You also have the right to lodge a complaint with your national data protection authority.

Erasing the data tied to a purchase results in revocation of the license, because without it validity can no longer be verified.

Last updated: [date]