Privacy

Who controls your data

stms is the controller for the personal data described here. The identity behind that word is on the about page and at the foot of this document. Write to support with any question or request.

What we process, and why

Account: your email address, and a password that is stored only as a hash, so nobody at stms can read it. For each browser you are signed in on we keep a coarse description of it (its user agent) and when it was last used, so you can see and end your sessions.

Orders: your email, what you bought, and the serial issued, so a purchase can be supported and re-sent. Paddle processes the payment itself as merchant of record; stms only holds what is needed to fulfil the licence.

Licence sessions: your account, a salted machine fingerprint, the computer name you see in your account, the plugin and version that signed in or refreshed its licence, and the time, so the plugin can check your licence and you can manage your machines. We do not store your network address. Never your projects, never your audio, never usage data. The fingerprint is a hash; the raw hardware id never leaves your computer.

Newsletter: your email address, kept once you confirm it with a double opt-in, so release notes can be sent to people who asked for them.

Support: if you write to us we process your email address and what you tell us, to answer you.

Trial requests: your email address, when you agreed to the Terms and the EULA, and whether you also asked for news, so we can send the download links and show what you agreed to.

Downloads: when an installer is downloaded we record the time, the plugin, its version and platform, the account or the emailed link it came through, and a keyed hash of the network address (never the address itself), to spot shared links and abuse, and we delete each record after twelve months.

Security: our servers use your network address for a short time, held in memory, to limit abuse, for example how often someone can try a password. It may appear in a server log line when a limit is hit.

You do not have to give us any of this. Without an email address we cannot sell you a licence or support it.

Our legal bases

If you are in the EU or UK, these are the legal bases we rely on.

Contract (GDPR Article 6(1)(b)): your account, your orders, and your licence sessions. We need them to give you the licence you bought and to support it.

Legal obligation (Article 6(1)(c)): the order and licence records we are required to keep for accounting and tax.

Legitimate interests (Article 6(1)(f)): keeping the service secure and limiting abuse, and answering the messages you send us. You can object to this, see your rights below.

Consent (Article 6(1)(a)): the newsletter. You give it with the confirmation link and can withdraw it at any time with the unsubscribe link in every email.

Who receives your data

We use a small number of service providers. We do not sell your data, and we do not share it for advertising. The site runs no analytics and loads no advertising or tracking script.

Paddle: the merchant of record for every purchase, through the Paddle entity shown at checkout for your region. Paddle collects your payment and billing details at checkout and handles payment, tax and refunds. It is a controller of that data in its own right, and its privacy policy applies. We receive your email, what you bought and the order reference.

Resend: sends the emails we send you, such as your serial, password resets, the newsletter confirmation and release notes. It receives your email address and the content of each message. If Resend is not available, we send through our own mail server instead.

Hetzner Online GmbH (Germany), our hosting provider: the website, the licence server, the database and the installer files run on a server we rent from Hetzner in its Helsinki data centre, in the EU. Hetzner acts for us and stores everything described in this document.

Cloudflare: sits in front of stms.app and api.stms.app and passes traffic through to our server. It sees the network address and the details of each request.

We may also disclose data where the law or a court requires it.

seePaddle privacy policy (opens in a new tab)Cloudflare privacy policy (opens in a new tab)

Transfers outside your country

stms is in Israel, so data from the EU and UK reaches us there. The European Commission has decided that Israel gives personal data an adequate level of protection (Decision 2011/61/EU), and we rely on that for transfers to us.

Some of the providers above are in, or use servers in, other countries, including the United States. Where a provider is outside the EU and UK, we rely on the safeguard in our contract with it: the standard contractual clauses approved by the European Commission and, for the UK, the UK addendum to them, or an adequacy decision such as the EU-US Data Privacy Framework where the provider is certified under it. Write to support if you want to know which safeguard applies to which provider.

How long we keep it

Account data is kept while your account exists.

Orders are kept for seven years from the day of purchase, because Israeli tax law requires us to keep our accounting records. After seven years we remove your email address from the order. The order reference, the serial and the amount stay, with nothing that says who bought it. The licence server keeps its own copy of each order and follows the same rule. Credit purchases and credit use are kept as accounting records.

Newsletter addresses are kept while you are subscribed and deleted when you unsubscribe.

Your rights

You have the right to: see the personal data we hold about you (access); have it corrected (rectification); have it deleted (erasure); have us limit how we use it (restriction); receive it in a common machine-readable format and move it elsewhere (portability); object to processing that rests on our legitimate interests; and withdraw consent you have given, at any time, without affecting what happened before.

When you delete your account, we delete your account, your licences, your machines, your sign-ins, your newsletter subscription, your update-email records, your trial requests, and any files you uploaded to our tools. Your orders stay for the seven years above, and the serials that were issued stay used, without your account attached. If you asked us not to email you about product updates, your address stays on that opt-out list so that we keep honouring it. Paddle, which takes payments, and Resend, which delivers our email, keep their own records under their own policies.

To use any of these, write to support. You can delete your account yourself in your account settings. We answer within one month. We may ask you to confirm you are the person the data is about.

You can also complain to a supervisory authority. In Israel that is the Privacy Protection Authority. In the EU, it is the data protection authority of the country where you live, work or think the problem happened. In the UK, it is the Information Commissioner’s Office. We would like the chance to put it right first, but you do not have to ask us first.

seeIsrael: Privacy Protection Authority (opens in a new tab)EU: your national authority (opens in a new tab)UK: Information Commissioner’s Office (opens in a new tab)

Email and unsubscribing

Every release-notes email has a one-click unsubscribe link. Using it deletes your address from the newsletter list straight away. There is no account, no login and no confirmation step. If you sign up again later, you confirm again by email.

Update emails about a plugin you bought have their own switch in your account. Turning it off keeps your address on a short opt-out list so that we do not email you again.

Cookies and storage

What the site stores in your browser, and why there is no cookie banner, is its own page.

seecookies and storage

Contact

Write to the support address for anything in this document: a question, a correction, or a request to see or delete your data.