Legal
Privacy policy
This page is the site's privacy policy. It says what personal data this site stores, why, on which legal basis and for how long, who else is involved, and what rights you have over it.
Data controller
| Controller | Neos Eureka S.r.l., Via Giotto 78, 90145 Palermo, Italy. The company is the controller for the purposes of the GDPR and of the data protection laws applicable in the member states of the European Union, and it is the same company that sells the licenses on this site. |
|---|---|
| Requests about your data | Send requests through Support: each request is stored with a reference before it is emailed, and you can ask us to show, correct or delete the data we hold about you. The terms name the same company for orders and licenses. |
| Complaints | A complaint may be lodged with the data protection supervisory authority of the country you live in; in Italy that is the Garante per la protezione dei dati personali. |
What the site stores, why and for how long
| Data | Why | Legal basis | Kept |
|---|---|---|---|
| Account: name, email, company | To sell a license, deliver it and support it | Contract | As long as the account exists |
| Password, and the authenticator secret and recovery codes when two-factor sign-in is enabled | Sign-in and account security; a password is stored only as a hash, never in readable form | Contract | Until changed or the account is closed |
| External sign-in: the provider, the provider's account identifier and the address it asserts | Signing in with Google or Microsoft, when you choose that instead of a password | Contract | As long as the link to that provider exists on the account |
| Signed-in sessions: the IP address and browser of the session | Keeping you signed in and protecting the session from takeover | Contract | Until the session ends — sign-out, or about two hours without activity |
| Billing details: name, address, email, tax identifiers | Invoicing and tax duties; a business buyer's tax number is what makes the reverse charge on the invoice possible | Contract and legal obligation | As long as the law requires for invoices; the current profile until changed or the account is closed |
| Licenses, purchases, payments and invoices, and the payment notifications that confirm them | Entitlement, invoices, tax and accounting duties; a refund or chargeback is answered months later from these records, so the notification the provider sent is kept with them as part of the record | Contract and legal obligation | As long as the law requires for accounting records |
| License maintenance expiry and renewals | A service message about something you bought, not marketing: it says when the maintenance on a license is ending and when the license changes. It can be stopped under Preferences or from the message itself, and a license owner may add a second mailbox, which is invited to agree on its own and is emailed only if it does | Contract | Until you stop it, or the account is closed |
| New releases for the product you own | A service message to license holders about the product they hold: a new release, or a beta they can try. It goes only to accounts that hold a license, and it can be stopped under Preferences or from the message itself | Contract | Until you stop it, or the account is closed |
| Discounts and partner offers | To send only what was asked for, with each category kept separate: discounts and promotions, and offers from our partners | Consent | Until changed or withdrawn |
| Support requests | To answer them, with the reference the customer is given | Contract, or your request when nothing was bought | 12 months from the request, then deleted |
| Files attached to a support request | To answer the request with the report it is about — a crash report is machine data a customer sends on purpose, not something the site collects. The file lives on the application's own storage, never a public one, and is read through a signed link that expires | Contract, or your request | 180 days from the request: the file is deleted, the request stays |
| Web server and application logs | Running and securing the service: finding faults, answering abuse and attacks. The access log records the method and path, the IP address, the referrer, the browser, the status and the response time | Legitimate interest | About two weeks: fourteen daily files |
180 days is the life of the signed link the notification carries, so the file and the link end together. The request itself is kept for 12 months — the maintenance the site sells, so the reference can be quoted for as long as the warranty it may be about — and is then deleted; the conversation with support continues in our mailbox without it. A file that support removed earlier is gone in the same way.
Providing this data is part of what the service is: an account needs an email address to sign in with, an invoice cannot be issued without the billing details, and a support request needs the message it is about. The notification preferences are the one optional part — the account works without them — and they can be changed at any time.
What the site deliberately does not do
- No telemetry: the license and update requests of the installed client are answered with fixed, non-personal data, and no machine, OS, user or network data is collected, stored or logged there.
- No third-party analytics, no advertising cookies, no external fonts, and no third-party scripts except Paddle's checkout script on the payment page. The site's own cookies are the ones it needs to work; the cookies page lists them.
- No sale or rental of personal data: it is shared only with the processors named below, and nothing else receives it.
- No request-content logging on the routes that carry credentials or machine identifiers.
- No use of personal data to build advertising profiles.
Who processes what
| Google and Microsoft | External sign-in, only when you choose it: the provider authenticates you and hands this site an identifier and an address it has verified, and the provider sees that this site asked. Nothing else about the account is shared, and the ordinary password sign-in involves neither company. See Google's privacy policy and Microsoft's privacy statement. |
|---|---|
| Paddle | Merchant of record: it sells the license, takes the payment, issues the invoice and handles the taxes. Card details are entered in Paddle's own form and never reach this site. See Paddle's privacy policy. |
| AlphaVPS | The server the site runs on, in Nuremberg, Germany, European Union. |
| Infomaniak | The private object storage that keeps the installers, in Switzerland, a country the European Commission recognizes as providing adequate protection. A download there is served under a URL that expires in minutes. Downloads of paid editions require account and license authorization; public Trial and Freeware downloads require no account. |
| Amazon SES | Delivery of the site's own email (account mail, license notices and support notifications), in region eu-central-1, Frankfurt, European Union. |
These are the recipients. Our own staff see customer data only through role-scoped back-office screens, and the decisions staff make about customer data are recorded with the actor, the change and the reason.
How it is protected
- The connection is TLS end to end, and card details never touch this site's server: they are entered in Paddle's form.
- Passwords are stored only as hashes.
- Support attachments live on private storage and are served through a signed link that expires; there is no public URL for them.
- Downloads of paid editions are authorized per account and per license before the object storage serves them. Public Trial and Freeware downloads require no account. Download URLs expire in minutes.
- Backups are taken nightly and kept for 30 days; a record deleted just before a backup ages out with it.
Your rights
Write through support, saying what you want done with which of your data, and the same reference system applies as for any other request.
- Confirmation of whether personal data concerning you is being processed.
- Access to that data, with a copy, and the information around the processing: the purposes, the categories of data, the recipients, and how long it is kept.
- Rectification of inaccurate or incomplete data.
- Erasure of the data, the so-called right to be forgotten.
- Restriction of processing, where the grounds in the regulation apply.
- Portability: to receive your data in a structured, commonly used and machine-readable format, and to have it transmitted to another controller where that is technically possible.
- Objection to processing that rests on legitimate interests, and to processing for direct marketing at any time — the notification preferences in the account are the quickest way for the latter.
- Withdrawal of consent at any time, where the processing rests on consent.
- Not to be subject to a decision based solely on automated processing, profiling included: this site states that it does not use automatic decision-making or profiling.
Changes to this page
When this policy changes, the new version is published here with a new date. If a change materially affects how your data is used, account holders are told by email before it applies.
Last updated: November 9, 2026.