DRAFT FOR LEGAL REVIEW — not yet effective. Items marked [[ … ]] require confirmation by counsel, or verification on the deployed production site, before publishing. Remove this banner and all flags before this page goes live.
Legal

Privacy Policy

Last updated: [[ DATE ON PUBLICATION ]] · Version 1.0 (draft)

This Privacy Policy explains what personal data we process when you use the Slim Archiver software and the slimarchiver.com website, why we process it, and the rights you have. We aim to collect as little as possible: the software performs compression, encryption, and archiving entirely on your own device, and does not send your files or their contents to us.

1. Who we are

The data controller responsible for your personal data is [[ LEGAL IDENTITY — legal name / registered form (individual or SRL), and registered address if applicable; to be settled with an accountant or lawyer ]] ("we", "us", "our"). For any privacy question or to exercise your rights, contact us at privacy@slimarchiver.com (or use our contact form).

2. Scope

This Policy covers the Slim Archiver software, the slimarchiver.com website, licensing and activation, and customer support. Payments are processed by Lemon Squeezy as Merchant of Record; your payment-card and billing details are handled by Lemon Squeezy under their own privacy policy, and we do not receive or store your card data.

3. What we collect, and what stays on your device

It is important to distinguish three categories, because most of the data the software handles never reaches us.

3.1 Data we receive and control (licensing)

When you activate a paid license, the software sends two pieces of information to our licensing service (hosted on Cloudflare): your license key and a hardware identifier ("HWID"). The HWID is a one-way hash: the software combines characteristics of your computer (such as motherboard and system serial numbers and CPU information) and produces a 32-character hexadecimal value. The underlying serial numbers themselves never leave your device — only the hash is transmitted, and it cannot be reversed back into your hardware details.

Our licensing service stores one record per activated device, containing: the license key, an activation instance identifier, and the customer email address associated with the purchase. The email address is provided to our service by Lemon Squeezy from your order; it is not collected from your device by the software. During routine licence checks and when you deactivate a device, only the HWID hash is sent.

We do not store your IP address, hardware specifications, file names, archive contents, or usage logs on our licensing service. Your IP address is briefly processed by Cloudflare for rate-limiting and security (see section 5), but is not written to our records.

3.2 Website data

When you visit the website, our hosting provider Cloudflare processes technical request data (including IP address, approximate country, browser type, and pages requested) to deliver and secure the site. We also use Cloudflare Web Analytics, a privacy-focused, cookieless analytics tool that gives us aggregate page-view and visit counts. It does not use cookies, does not track you across other websites, and does not build a profile of you as an individual.

3.3 Support data

If you contact support (by email, or via the support form), we process the information you choose to provide — typically your email address, your license key, and the content of your message — in order to respond and assist you. Support email is handled through Google (Gmail).

3.4 Data that stays on your device and never reaches us

The following are stored only on your own computer. We have no access to them and they are never transmitted to us:

Data-loss prevention (Enterprise) and your file contents. The Enterprise edition includes an optional data-loss-prevention (DLP) feature that, when enabled, inspects the contents of files being archived to detect sensitive patterns, and records matches to a local log on your own machine. Where a sensitive value is recorded, it is masked. This inspection happens entirely locally: neither the file contents nor the DLP log are sent to us. If an administrator configures forwarding to an internal logging system, that data goes to the organisation's own systems, not to us (see section 4).

3.5 Optional integrations you configure (third-party destinations)

The software can connect to third-party services that you choose to configure. When you use these, your data goes directly from your device to that third party under your control and their terms — it does not pass through us:

For these integrations, the third-party provider (and, in an organisation, your employer) is the party responsible for the data at the destination. The Outlook add-in is an exception in one respect: its code is hosted by us (on Cloudflare Pages at outlook.slimarchiver.com), but it processes your attachments inside Outlook and does not transmit their content to us.

4. Why we process your data (legal bases)

Under the GDPR, we rely on the following legal bases:

5. Where your data is processed, and international transfers

The parties that process data on our behalf are:

Some of these providers may process data outside the European Union. Where that occurs, the transfer is protected by appropriate safeguards as required by the GDPR. [[ LAWYER — confirm the transfer mechanism to cite (e.g. Standard Contractual Clauses / provider Data Processing Addenda) for Cloudflare, Lemon Squeezy, and Google ]]

6. How long we keep your data

Because a Pro license is perpetual for its major version, we may retain the minimum licence record needed to honour that entitlement for as long as it applies.

7. Your rights

Under the GDPR you have the right to access your personal data; to have it corrected or erased; to restrict or object to its processing; to data portability; and, where processing is based on consent, to withdraw that consent. To exercise any of these, contact privacy@slimarchiver.com.

You also have the right to lodge a complaint with a supervisory authority. In Romania this is the National Supervisory Authority for Personal Data Processing (ANSPDCP).

8. Security

Data transmitted between the software and our licensing service is sent over an encrypted (HTTPS/TLS) connection. Licensing requests are cryptographically verified by our service. Locally, secrets you configure are stored using the Windows Credential Manager. No method of transmission or storage is completely secure, but we take reasonable measures appropriate to the limited data we process.

9. Cookies

Our website aims to use no cookies. Our analytics is cookieless, and on testing the site set no cookies. Cloudflare, as our security and hosting provider, may in some circumstances set a strictly-necessary cookie used for bot-management and security purposes; such cookies, if set, are essential to delivering the site securely and are not used for advertising or cross-site tracking. [[ VERIFY ON PRODUCTION — re-check cookies via browser dev-tools on the live slimarchiver.com deployment before publishing; if a Cloudflare security cookie (e.g. __cf_bm) is set, name it here; if none, state plainly that the site sets no cookies ]]

10. Children

Slim Archiver is a professional software product and is not directed at children. We do not knowingly collect personal data from children.

11. Changes to this Policy

We may update this Policy from time to time. When we do, we will revise the "last updated" date above and, where changes are material, take reasonable steps to make them known.

12. Contact

For any question about this Policy or your personal data: privacy@slimarchiver.com.