L2FARM Privacy Policy
Last updated: [insert date]
1. Controller
[Insert controller identity and contact, DPO if applicable.] Contact: see the Support page.
2. Data we process
Account data (email, name), order and payment status (card data is handled solely by our payment provider), license data (keys, plan, activation and expiry dates), device identifiers (see below), technical logs (IP address in hashed form, app version, timestamps of license checks), support messages, and a keyed email hash recording a used free trial.
3. Device identification
To enforce device limits, the app computes salted hashes of several hardware attributes on your PC. Raw hardware identifiers are not transmitted or stored; the server additionally hashes them with a secret pepper.
4. Purposes and legal bases (GDPR Art. 6)
Contract performance (accounts, orders, licenses, delivery emails); legitimate interests (fraud and abuse prevention, security logging, trial abuse prevention); legal obligation (accounting and tax records); consent where required (non-essential cookies, if any).
5. Processors
Supabase (database/auth/storage), payment provider (Viva.com and/or Stripe), Resend (email delivery), hosting provider (e.g. Vercel). [List exact providers, locations and transfer safeguards such as SCCs.]
6. Retention
Account and license data while your account exists; order records as long as tax law requires; license-check logs up to 180 days; support tickets for [X] months. A used-trial record with keyed email/device hashes may remain after account deletion to prevent another free trial; deleting an account does not reset trial eligibility.
7. Your rights
Access, rectification, erasure, restriction, portability, objection, and withdrawal of consent, and the right to complain to your supervisory authority. Contact us via the Support page.
8. Security
HTTPS, access controls, row-level security, hashed identifiers, audit logging. No system is perfectly secure.