Privacy notice
Version 2026-11-14
Controller
SELENA STUDIO. SAMONOVA, Knutvegen 6, 6270 Brattvåg, Norway, organisation number 934 418 891. Contact for privacy questions: [email protected].
What we collect and why
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Email address | Sign-in links, your account, receipts | Contract, Art. 6(1)(b) |
| Plan, orders, license key hints (never the full key) | Delivering what you bought, preventing abuse | Contract; legitimate interest, Art. 6(1)(f) |
| Consent records (terms, optional update emails) | Proof of what you agreed to | Legal obligation and legitimate interest |
| Optional update emails | Announcing library updates | Consent, Art. 6(1)(a); withdraw at any time in your account |
| Messages you send through the contact form | Answering you | Legitimate interest; contract when it is about an order |
We do not store IP addresses or browser user agents with sessions. Rate limiting uses short-lived hashed identifiers. Application logs contain account ids, not email addresses.
Cookies
We set one essential session cookie after you sign in, and one for admin two-factor confirmation. No advertising or tracking cookies.
Processors and recipients
- Stripe (payment processing). Card data goes directly to Stripe; we never see it.
- Scaleway SAS, France (sending email).
- Cloudflare, Inc. (receiving email to our domain).
- Contabo GmbH, Germany (hosting of the application and database).
Where a processor is outside the EEA, transfers rely on the EU Standard Contractual Clauses or an adequacy decision.
How long we keep data
Account data is kept while your account exists. Order records are kept as long as the bookkeeping law of Norway requires. When you delete your account, it is removed from our database at once; backups are overwritten on their normal rotation.
Your rights
You can ask for access, correction, deletion, restriction, portability, and object to processing. In your account you can export your data as JSON and delete your account yourself. You can also complain to your data protection authority.