Privacy
Notice.

Data controller

[TO COMPLETE: legal name, registered office, contact email; data protection officer if one has been appointed.]

What is actually collected

This site collects the following, and nothing else:

• Email address. Entered before payment and confirmed by Stripe, used to register the license and deliver the key.
• Billing details. Address and, where supplied, Tax Identification Number (TIN), including VAT numbers where applicable. Collected by Stripe to determine tax treatment and generate the invoice.
• Transaction identifiers. Stripe checkout session, customer and payment references, amount and currency. These link a license to its purchase and support refunds and disputes.
• License key and its status. With issue date and revocation date where applicable.

Card details never pass through our systems: payment is handled entirely by Stripe.

Measurement and advertising

The site loads Google Tag Manager, which in turn may load measurement and advertising tags. These tags can set cookies or similar identifiers on your device and record the pages you open, the licence you select and whether a purchase completes, so that advertising performance can be measured.

[TO COMPLETE: list the tags actually published in the container, naming each provider. At the time of writing the container is being configured for Meta advertising.]

For visitors in the European Economic Area, the United Kingdom and Switzerland these tags start in a denied state and set no advertising identifiers until consent is given. [TO COMPLETE: a consent banner is still required to collect and record that consent. Until one is in place, consent is never granted and advertising measurement stays limited for those visitors.]

Purposes and legal bases

• Performance of a contract (Art. 6(1)(b) GDPR): issuing and delivering the license, support, handling refunds.
• Legal obligation (Art. 6(1)(c) GDPR): retention of accounting and tax records.
• Legitimate interests (Art. 6(1)(f) GDPR): fraud prevention and detection of shared keys.
• Consent (Art. 6(1)(a) GDPR): measurement and advertising tags, where consent is required.

Processors and recipients

• Stripe. Payments and tax compliance.
• Cloudflare. Site hosting and license records.
• Google. Tag Manager, which delivers the measurement and advertising tags described above.
• Email delivery provider. Delivery of the license key. [TO COMPLETE: name the provider actually in use.]

Some of these providers may process data outside the European Union. [TO COMPLETE: state the safeguards relied on, typically standard contractual clauses.]

Retention

[TO COMPLETE: set the periods. Known constraint: tax records must be retained for ten years under Italian law.]

Your rights

You may request access, rectification, erasure, restriction and portability of your data, and object to processing based on legitimate interests, by writing to [contact email]. You also have the right to lodge a complaint with your national data protection authority.

Erasing the data tied to a purchase results in revocation of the license, because without it validity can no longer be verified.

Last updated: [date]