Privacy

What this notice covers

It covers this website and its Account area, the Windows application, licence activation and its periodic confirmation, purchases, the emails the service sends, the optional link between Account and Discord, the move of customers from the previous store, updates, support and the community server.

Who is responsible

The controller of the processing described here is Simona Gioia, who can be contacted at the address shown on the support page. Orders are sold by our authorised reseller, which is the Merchant of Record and is named at checkout: this is why its name appears at checkout and on the receipt. What you enter to pay, the tax treatment and the invoice for an order are handled by the reseller as an independent controller, under its own privacy notice.

You can make a privacy request through a ticket on the VaxTweaker Discord server, or by writing to the address shown on the support page. You do not need a VaxTweaker account to make a request, and if you write to that address you do not need Discord either. The competent supervisory authority is the Italian data protection authority, and you may also complain to the authority of the country where you live or work.

No data protection officer is appointed. That assessment is reviewed if the scale or the nature of the processing changes.

Paid licences are for people aged 18 or over. A person aged 16 or 17 may use the product only under the supervision of a parent or legal guardian who holds the licence.

This website

The pages of this site load no analytics and embed no advertising or tracking technology. Fonts are served from this origin. There is one exception for third-party scripts: the payment page in Account loads the payment script of our authorised reseller (Merchant of Record), on that page only, so that the checkout can open. That script talks to the reseller directly, under the reseller's own notice.

A first-party language cookie is created only after you explicitly choose a language, and it stores only that choice. Account uses three technically necessary cookies and no others: a session cookie, which lasts at most 12 hours; a security cookie, which protects forms against requests sent from other sites and lasts no longer than the session; and a sign-in cookie, which lasts as long as the code is valid, at most 10 minutes. The sign-in cookie also holds the email address you typed, so you do not have to type it again if you ask for a new code; it is removed when sign-in ends or when you sign out. The other two hold only opaque references and tokens, not your email. They are all technically necessary cookies: they are not used for analytics or advertising and do not require consent. When you request or verify a code, this site's server passes your email or the code to the VaxTweaker account service, which runs on the same server.

This site, Account and the account service are hosted by our hosting provider, on servers in the European Union. The domain's DNS is managed by a DNS provider. The hosting provider necessarily receives what is needed to deliver a page: the request time, the address requested, the IP address the request came from, ordinary browser and network headers, and security logs. That processing rests on our interest in delivering and securing the site (legitimate interest, Art. 6(1)(f) GDPR).

Account

Account is where you sign in, buy, see your licence key, manage your devices and link Discord. To create and run it we process: your email address; the display name and preferred language you choose; and the record that you accepted the Terms, meaning the version, the date, the language and a fingerprint of the accepted text. They are needed to provide the service you ask for (performance of a contract, Art. 6(1)(b) GDPR). The acceptance record is kept to prove what was agreed, so that we can defend ourselves if a claim arises (legitimate interest, Art. 6(1)(f) GDPR).

You sign in with a 6-digit code sent to your email. The code is valid for 10 minutes and can be used once. It is never stored in readable form: the service keeps only a fingerprint of it made with a secret key, and deletes it within 24 hours.

To stop abuse, code requests and checks are limited per email and per IP address. For this the IP address is stored only as a fingerprint made with a secret key. Server logs that contain IP addresses are kept for 90 days. That processing rests on our interest in keeping accounts secure (legitimate interest, Art. 6(1)(f) GDPR).

A session lasts at most 12 hours. You can sign out of one device or of all of them. Session records are deleted 30 days after they expire.

If you never buy anything and do not sign in for 12 months, the account is deleted. You receive an email 30 days before.

What stays on your computer

Most of what the application handles never leaves the machine. The licence file is stored in your user profile and protected with the Windows data-protection service. Operation records, captured values and cleanup journals are local files.

Each installation creates its own device key; only its public part leaves the machine. To recognise the device, the application reads some hardware identifiers in read-only mode (for example the motherboard and disk serial numbers) and sends only keyed fingerprints of them, computed with a different key for each licence: the original values never leave the computer and the fingerprints cannot link different licences. They are needed for the licence to work and to recognise the same computer after a reinstall of Windows (performance of a contract, Art. 6.1.b GDPR).

Local storage on your machine is not a statement that the application never contacts a server. The next section lists every case in which it does.

What the application sends

Activation sends the licence key, the application version and a request signed with the device key to the VaxTweaker account service, together with the connection metadata any network request carries. The service checks the licence, registers the device in our licensing service and returns a signed proof that keeps Premium working offline for up to 72 hours. While the application is open and online with Premium active, it checks the licence status with the account service about once a minute, and it renews the licence about every 24 hours and after it starts. Deactivation, from the application or from Account, ends the device session and frees a device slot. This is necessary to perform the licence contract (performance of a contract, Art. 6(1)(b) GDPR) and to prevent replay and automated abuse (legitimate interest, Art. 6(1)(f) GDPR).

An update check downloads the signed update record from the update origin, and an update downloads its installer from there. The installed version is compared with the record on your computer and is not sent.

A support package is created only when you ask for one, and it leaves your computer only when you send it yourself: attached to a ticket on the VaxTweaker Discord server, or to an email sent to the address shown on the support page. It contains the application version, the summary and findings of the diagnostic check you selected, the Windows build and the administrator state. Known keys, identifiers, tokens, credentials, account names and personal paths are removed or masked before the file is written. What happens after you send it is explained in the Support section.

Nothing else is sent. There is no usage telemetry, no behavioural profile and no advertising identifier.

Licence and devices

When you buy Premium, the licence is created in our licensing service, which runs on our own server in the European Union. It holds the licence key and counts the devices on which it is active, two at most. It does not hold your email: the licence owner is recorded there under a pseudonymous address derived from an internal reference, and each device under a pseudonymous identifier. This data is needed to give you the licence you bought (performance of a contract, Art. 6(1)(b) GDPR).

The licence key is not stored in the account service's database. It is kept only by the licensing service and read from it when Account shows it to you, after you confirm a code, and when it is sent to you by email.

For each device the service keeps an internal reference, its status and its activation dates. It also records the date of the first successful activation, because that decides whether the 30-day refund on the refunds page still applies. Device records are kept while the device is active and for 90 days after it is deactivated.

If you delete your account, the licence is suspended at once and then deleted together with the account.

Orders and payments

You buy in Account. The payment page opens on this site, but the payment form is run by our authorised reseller, the Merchant of Record for all orders, named at checkout. What you enter to pay goes directly to the reseller, under the reseller's own notice: neither this site nor the account service ever receives a card number or a payment credential.

To prepare the payment, the service sends the reseller your email and an internal reference to your account, so that the order and its receipt stay linked to your account. From the reseller the service receives what an order needs: the customer and transaction references, the plan, the amount, the currency, the country used for tax, and the state of the payment, renewal, refund or dispute. That is used to give you Premium and to answer a support request (performance of a contract, Art. 6(1)(b) GDPR), and to keep the records the law requires (compliance with a legal obligation, Art. 6(1)(c) GDPR). The reseller issues and keeps the invoice as Merchant of Record. To cancel a plan or change the payment method, Account opens the reseller's customer portal.

Emails

The service sends emails through an email delivery provider. They are service emails only: sign-in codes, the licence key after a purchase, the invitation and the notices about the move for customers of the previous store, and the notice before an inactive account is deleted. They are needed for the service you use or bought (performance of a contract, Art. 6(1)(b) GDPR). We do not send promotional emails. Some technical alerts go only to our own staff. The email delivery provider receives the address and the content of each email.

Invitations to customers of the previous store only concern moving their purchase, that is, the same service they bought. We send them because you are already our customer (soft opt-in; legitimate interest, Art. 6(1)(f) GDPR). Each invitation has a link to stop receiving them. For any other content we first ask for your explicit consent.

Emails waiting to be sent are stored encrypted and deleted 7 days after they are sent.

Community

Linking Discord is optional, and Free users can link too. When you choose ‘Link Discord’ in Account, Discord asks you to authorise the link. The service then receives your Discord user ID, your username and your display name. If you also choose to join the community server, the service adds you to it. This is your choice: the box is never ticked in advance, and without your choice you do not join the server. The access Discord grants for this is used once and revoked straight away; it is not stored.

The community bot reads the link to give the Premium role while your plan is active, and to remove it when Premium ends or when you unlink. When it gives the role, the bot may send you a private welcome message in the language of your Account. This processing takes place because you ask for the link (performance of a contract, Art. 6(1)(b) GDPR).

When you unlink, the role is removed at once and your Discord username and display name are deleted. For 30 days you can link the same Discord account again; after that, the Discord ID is deleted too. If you delete your account, the link is deleted at once, except the Discord ID and the server ID, which are kept for at most 30 days and only to remove the role.

If you join the community server, that platform processes your account identifier, your display name, your messages, attachments and roles under its own terms and notice. Moderators see what the platform shows them and keep moderation records for community safety.

The community server has a support channel with private tickets, described in the Support section. In public channels, do not write licence keys, payment details or passwords, and do not post a diagnostic file or an order detail.

Customers of the previous store

Before Account existed, VaxTweaker was sold on Sell.app. To move those customers, the service imported from Sell.app, for each order: the order and invoice numbers, the plan, the date paid up to, the purchase date, the country, the email (stored as a fingerprint made with a secret key, to recognise you) and a fingerprint of the old licence key. The old key itself is not stored.

To send you the invitation to claim your licence, the email is also kept in readable form until you claim the licence, and at most until 90 days after Account launches.

The other imported data is kept until you claim your purchase, and in any case for at most 12 months.

If you sign in with the same email, the licence is found automatically. If your email has changed, you can claim it with the order number and the old key; at most 5 attempts a day are allowed. We import this data and write to you so that you keep what you paid for (legitimate interest, Art. 6(1)(f) GDPR). When you claim the licence, the data is needed to give it to you (performance of a contract, Art. 6(1)(b) GDPR).

Support

Support goes through two channels: private tickets on the VaxTweaker Discord server, and the email address shown on the support page.

In a ticket we process what you write, the files you attach (for example a support package) and your Discord username. In an email we process your email address, what you write and any attachments.

Tickets on the Discord server are processed by Discord, under its own terms and notice, and by the ticket service we use on the Discord server. A ticket can be seen by the person who opens it, the moderators, the administrators and the owner of the server. Emails pass through our domain's email forwarding service and arrive in our support mailbox, held by a mail provider in Switzerland.

We use this data because you ask for support: it is needed to answer you before or after a purchase and, for a request about an order or a licence, to perform the contract (pre-contractual steps or performance of a contract, Art. 6(1)(b) GDPR).

The messages of a ticket are kept while the ticket is open and deleted when it is closed: we keep no ticket transcripts. Support emails are kept for 24 months, then deleted.

Who receives data

Personal data is not sold. Only these recipients receive it, each for a specific job:

• our hosting provider: hosts this site, the account service, the community bot and the database in the European Union, and stores the encrypted backups;
• our authorised reseller (Merchant of Record), named at checkout: runs checkout, payment, tax, invoice, refunds and the customer portal as an independent controller, under its own privacy notice, linked at checkout; it receives your email and an internal reference to your account;
• the email delivery provider: sends the service emails; it receives the address and content of each email;
• Discord: if you link your account, for the Premium role and, if you choose it, joining the server; and if you open a support ticket on the Discord server. Discord processes this data as an independent controller, under its own notice;
• the ticket service we use on the Discord server: runs the support tickets you open there;
• our domain's email forwarding service, in the United States, and our mailbox provider, in Switzerland: they forward and store the emails you send to the address shown on the support page;
• the DNS provider: manages the domain's DNS.

Providers that process data on our behalf (processors) are bound by a data processing agreement (Art. 28 GDPR).

Our authorised reseller and Discord process data as independent controllers, under their own notices.

Discord's privacy policy

Your rights

Subject to the conditions and exceptions that apply to each right, you may ask for:

• access to the personal data held about you;
• correction of data that is inaccurate or incomplete;
• erasure, where no lawful ground requires the data to be kept;
• restriction of processing;
• a copy in a commonly used machine-readable format, where portability applies;
• objection to processing based on a legitimate interest; and
• withdrawal of a consent you gave, at any time, without affecting what was lawful before.

How to exercise a right

Open a ticket on the VaxTweaker Discord server or write to the address shown on the support page, and describe the order, the licence or the support interaction concerned. Proportionate information may be requested to confirm who you are before data is disclosed or deleted, so that a request cannot be used against you.

In Account you can download a copy of your account data and delete your account yourself. Deletion removes the link to Discord, ends sessions and devices, and anonymises the account; for the periods below we keep the orders the law requires us to keep and the proof that you accepted the Terms, which we keep to defend ourselves in case of a dispute.

You can also ask for your account to be deleted by writing to the address shown on the support page.

A request is answered within one month. Where the law allows an extension for a complex request, you are told before the month ends.

How long information is kept

Each kind of information is kept for these periods:

• sign-in codes: at most 24 hours, and only as a fingerprint;
• sessions: 30 days after they expire;
• logs containing IP addresses: 90 days;
• backups: encrypted, replaced on a 30-day rotation;
• proof that you accepted the Terms: for the life of the account and 10 years after;
• account data (email, name, language): for the life of the account; an account that has never made a purchase is deleted after 12 months without a sign-in, with 30 days' notice by email;
• orders: for the period the law requires; our authorised reseller keeps the invoices as Merchant of Record;
• licence: for its term; if you delete your account, the licence is suspended at once and deleted together with the account;
• devices: while active and for 90 days after deactivation;
• Discord link: until you unlink; on unlinking, the Discord username and display name are deleted at once and the Discord ID within 30 days;
• emails waiting to be sent: deleted 7 days after sending;
• emails of customers of the previous store, kept readable for the invitation: until you claim the licence, at most until 90 days after Account launches;
• other data imported from the previous store: until you claim your purchase, for at most 12 months;
• support tickets on the Discord server: while the ticket is open, then deleted when it is closed, with no transcripts;
• support emails: 24 months.

The local licence file, operation records and journals on your machine are yours: they stay until you remove them.

Where information is processed

The service's server, database and backups are in the European Union. Some of the recipients listed above process data outside the European Economic Area. This is what each transfer relies on:

• email delivery provider, in the United States: certification under the EU–US Data Privacy Framework, plus standard contractual clauses;
• DNS provider, based in the United States with a global network: standard contractual clauses and certification under the EU–US Data Privacy Framework;
• Discord, in the United States: certification under the EU–US Data Privacy Framework and standard contractual clauses, as stated in its notice;
• our authorised reseller (Merchant of Record): its transfers outside the European Economic Area, if any, and the safeguards they rely on are described in its own privacy notice, linked at checkout;
• the ticket service on the Discord server, in the United Kingdom, with backups in Switzerland: adequacy decisions for the United Kingdom and for Switzerland;
• the support mailbox provider, in Switzerland: adequacy decision for Switzerland;
• Emails you send to the support address pass through our domain's email forwarding service in the United States, which delivers them to our mailbox in Switzerland. The transfer is needed to receive and handle your request (Art. 49(1)(b) GDPR).

We do not claim that data never leaves the European Economic Area. You can ask support for a copy of the safeguards used.

Security

In place today: connections use TLS 1.3; the account service cannot be reached from the internet except through the site; sign-in codes and the IP addresses used for limits are stored only as fingerprints; the licence key is kept only by the licensing service, not in the account service's database; emails waiting to be sent are encrypted; backups are encrypted with a key that is not kept on the server. On your computer the licence is protected with the Windows data-protection service, network requests are bounded and signed, and a support package is redacted before it is written.

No measure removes all risk. Personal data is not sold.

Changes to this notice

When this notice changes, the updated date and a summary of the material change are published on this page.

What is not in place yet

To be clear, this is what does not happen.

• This site and the account service process no payment and store no payment instrument: payments are handled by our authorised reseller (Merchant of Record), shown at checkout.
• The pages of this site load no analytics, tag manager or advertising technology. The only third-party script is our authorised reseller's, on the payment page.