Privacy Policy

1 Controller and contact

SCHNEIDER DESIGN, organisation number 919 772 298 MVA, Sundsdalen 277, 6819 Førde, Norway, is the controller for personal data described in this policy.

For privacy requests, email support@cadivari.com. We may need to verify that a request relates to you before disclosing or changing account or licence information.

2 Data we process

Purchases

Stripe collects payment and billing details such as your name, email, billing address, tax information and card or payment-method data. We do not receive or store your full card number. We receive and retain the customer and order details needed to fulfil and document the purchase, including name, email, Stripe identifiers, amount, currency, payment status and purchase time.

When your purchase is sold through Link, Stripe and its Sold through Link service also process payment, tax, invoicing, fraud-prevention, refund and transaction-support information under their own privacy terms. See Link’s Privacy Policy and the terms displayed at checkout. We collect your billing country before checkout to determine purchase availability.

Licensing and downloads

We store the purchaser email, licence key, licence status, purchase and updates-through dates, activation limit, and download history. For each activated computer we process:

• a one-way SHA-256 identifier derived locally from the Windows MachineGuid;
• the Windows computer name and Cadivari version;
• activation, last-validation and deactivation times; and
• the release and installer downloaded and the download time.

The original Windows MachineGuid is not sent to us. The derived identifier is used to enforce the computer limit and bind the signed local entitlement to that computer.

Website security and support

Our hosting and security providers may process IP address, request headers, browser/device information, requested URL, timestamps and error or security logs. Short-lived rate-limit records use hashed email, device or IP identifiers where practical. If you contact us, we process the contact details, message, attachments and correspondence you provide.

Data Cadivari does not upload

The desktop application does not upload your Cadivari project files, imported reference images, CAD geometry, CAM setup, G-code or ordinary local editing activity. Automatic update checks send only the signed entitlement, derived device identifier, platform/architecture and current application version needed to determine eligibility.

3 Why we process it

• Contract: to take payment, issue and validate a licence, deliver eligible installers and updates, and provide requested support.
• Legal obligation: to keep accounting, tax, fraud-prevention and consumer-contract records where required.
• Legitimate interests: to secure the service, prevent abuse, diagnose failures and maintain reliable purchase and download systems.
• Consent: where we specifically ask for it, such as optional communications. You may withdraw consent without affecting earlier lawful processing.

We do not sell personal data and do not use Cadivari purchase or activation data for third-party behavioural advertising.

4 Service providers and recipients

We use service providers only where needed to operate Cadivari:

• Stripe for payment, tax, invoicing and fraud prevention;
• Resend for licence, recovery and support-related email delivery;
• Vercel for website, API and private installer hosting;
• Neon for the hosted licence and commerce database; and
• Upstash for short-lived abuse-prevention rate limits when enabled.

We may disclose information to professional advisers, public authorities or law enforcement where legally required, or as necessary to establish, exercise or defend legal claims.

5 International transfers

Some providers may process data outside Norway or the EEA. Where required, transfers rely on an adequacy decision, approved standard contractual clauses or another lawful safeguard. Provider privacy information describes their specific processing locations and safeguards.

6 Retention

• Order, invoice and tax records are retained for the period required by accounting and tax law.
• Licence, eligibility, activation and essential download records are retained while the perpetual licence remains valid and afterwards where needed for contractual, fraud-prevention or legal claims.
• Rate-limit keys expire automatically after their short security window, normally between 15 minutes and one hour.
• Support correspondence is retained only as long as reasonably needed to resolve the request, maintain a useful support history and meet legal obligations.

We may retain minimal information about a blocked, refunded or transferred licence to prevent reactivation, document the transaction and protect legal rights.

7 Cookies and local storage

The public Cadivari marketing website does not currently use advertising or analytics cookies. The owner download portal uses a strictly necessary, secure session cookie after you sign in. It expires after 12 hours or when you sign out. Stripe may use necessary cookies and similar technologies on its hosted checkout under its own policy.

8 Security

We use access controls, encrypted transport, signed entitlements, private installer storage and restricted service credentials. No method of transmission or storage is completely secure, so we cannot promise absolute security. Please keep your licence key private and contact us if you suspect misuse.

9 Your rights

Subject to applicable law, you may request access, correction, deletion, restriction, objection or portability of your personal data. You may also withdraw consent where consent is the legal basis. Some information cannot be deleted immediately where it is required for accounting, licence integrity, fraud prevention or legal claims.

You may complain to the Norwegian Data Protection Authority (Datatilsynet) or your local supervisory authority.

10 Changes

We may update this policy when the product, providers or legal requirements change. The effective date at the top identifies the current version. Material changes will be communicated where required.