1. Data controller
The controller is Loreta Burmistrova, trading as DigDeScript, an individual activity operator registered in Lithuania under individual activity certificate number 866241.
Business address: Raudondvario pl. 288F-22, 47164 Kaunas, Lithuania
Privacy enquiries: support@digdescript.com
2. Data covered by this policy
Depending on how you use the website and SFX Catalog, we may process:
- your email address and purchase details, including the payment provider, order reference, price, currency and purchase status;
- a cryptographic hash of your license key and a short key hint; the complete key is processed when needed for activation and may be included in a transactional email, but is not stored in the licensing database;
- a one-way device identifier created from the operating system's stable device identifier, activation identifiers, activation status and activation dates;
- the operating-system family, device-identifier method, processor architecture, SFX Catalog version, license-service event type, result information and technical error codes;
- the computer name and operating-system account name supplied when a new activation is created, to help you distinguish your devices in license self-service. The computer name may be refreshed during license checks; the activating account name is retained as historical information. These descriptive names do not determine activation limits. Older clients may not supply them;
- a protected hash derived from the network address used for licensing or self-service requests, together with limited browser or application identification supplied with the request;
- license recovery and transfer records, including the old and new holder email addresses, confirmation status and timestamps;
- messages and other information you choose to provide when contacting us; and
- ordinary web-server security and access logs, which may include an IP address, request time, requested page and browser information.
SFX Catalog keeps local catalog and application data on your computer. That local database is not automatically uploaded to DigDeScript as part of normal catalog use.
3. Why we use personal data
| Purpose | Legal basis |
|---|---|
| Complete purchases, issue licenses, activate or deactivate devices, provide license self-service and deliver version information. | Performance of a contract or steps requested before entering into a contract. |
| Protect license keys and services, enforce the three-device limit, prevent abuse, diagnose errors and preserve an audit trail for disputes. | Our legitimate interests in operating and securing the service and establishing, exercising or defending legal claims. |
| Keep invoices, payment records and other records required by tax, accounting or consumer law. | Compliance with a legal obligation. |
| Answer support and other enquiries. | Performance of a contract, steps taken at your request, or our legitimate interest in responding to communications, depending on the enquiry. |
4. When data is required
An email address and the necessary purchase and device identifiers are required to issue, activate, recover or transfer a Pro license. If they are not provided, those services cannot be completed. Browsing public pages and using the application in Free mode do not require a Pro license.
5. Sharing and service providers
We use service providers only where needed to operate DigDeScript. They may process personal data on our instructions or, where stated in their own terms, as independent controllers:
- website and licensing-service hosting: UAB "Universalūs sprendimai", Lithuania (provider privacy information);
- business email hosting: UAB "Universalūs sprendimai"; email access and delivery may also be processed using Google Gmail;
- payment, order, tax and refund processing: the provider selected through the SFX Catalog product page, identified with its privacy terms before checkout; only the provider actually used for the transaction receives the relevant transaction data;
- software release hosting and downloads: GitHub, Inc., which receives ordinary connection data when you visit GitHub or download a release; and
- accounting, legal or technical advisers, if their professional services are required.
We may also disclose data where required by law, to protect legal rights, or as part of a lawful transfer of the DigDeScript project to a successor that assumes the relevant obligations.
6. International transfers
Some service providers, including Google, GitHub and the selected payment or sales platform, may process personal data outside Lithuania or the European Economic Area. Depending on the provider and destination, transfers are based on an applicable adequacy decision, approved standard contractual clauses or another transfer mechanism permitted by data-protection law. The provider selected for a transaction processes the data needed to complete that transaction under its own published privacy terms.
7. How long data is kept
- Purchase and accounting records are kept for at least 10 years, or longer where applicable law requires it.
- License, activation and essential license-audit records are kept while the perpetual license remains valid. If the license is permanently terminated, the records are kept for up to 10 further years where needed for legal claims, fraud prevention and proof of the license history.
- License recovery links expire after 30 minutes. Used or expired recovery-request records are kept for up to 12 months for security and abuse prevention.
- License transfer confirmation links expire after 24 hours. Completed transfer records form part of the license history and are retained for the same period as the license record. Uncompleted transfer requests are kept for up to 12 months.
- Rate-limit and ordinary web-server security records are kept for up to 12 months unless a longer period is needed to investigate a specific security incident.
- Support correspondence is kept for up to 3 years after the matter is closed, or longer where it is part of an active dispute or license record.
Data may be retained longer where reasonably required for an active dispute, legal claim or binding legal obligation.
8. Cookies and local storage
The public website does not currently use advertising or cross-site tracking cookies. The license self-service and support question forms use a strictly necessary session cookie to protect submissions and keep the process secure. The website does not currently store interface preferences in browser local storage. If analytics, advertising or other optional storage is introduced, this policy and any required consent controls will be updated before it is used.
9. Automated license decisions
The licensing service automatically accepts or refuses an activation by checking whether the license is valid and whether fewer than three devices are currently active. The result determines access to Pro features but does not involve profiling. You may deactivate a device through the application or license self-service. If you believe an automated result is wrong, contact support@digdescript.com for review.
10. Your rights
Subject to the conditions and exceptions in applicable law, you may request access to your personal data, correction of inaccurate data, deletion, restriction of processing, data portability, or object to processing based on legitimate interests. Where processing relies on consent, you may withdraw that consent at any time without affecting earlier lawful processing.
Send a request to support@digdescript.com. We may ask for information needed to verify your identity. You may also lodge a complaint with the Lithuanian State Data Protection Inspectorate or another competent supervisory authority. Current Lithuanian authority details are available at vdai.lrv.lt.
11. Security
We use proportionate technical and organisational measures intended to protect personal data. License keys and confirmation links should be kept private. No internet transmission or storage system can be guaranteed to be completely secure.
12. Changes to this policy
Material changes will be published on this page. Where the law requires notice or consent, it will be obtained through an appropriate channel before the change applies.