Privacy policy

Controller

The operator of Exort, see the legal notice. E-mail: admin@exort.eu

What we process

• Account: e-mail address, display name, password (hash only), time of registration and last sign-in, and a two-factor key if you turn it on.
• Coins, vouchers, license: ledger entries, bought and redeemed codes, license period.
• Payments: amount, status and the provider's reference number. We never receive card or bank details.
• Device: a random device id, a hash of the Windows machine id, the device name, the IP address of the link request and the time of the last license check.
• Security: IP address and time of sign-ins, failed sign-in attempts and a log of changes to coins, licenses and devices.

Purposes and legal bases

Account, coins, vouchers, license and devices are processed to perform our contract with you (Art. 6 (1) (b) GDPR). Security logs protect against abuse and attacks (Art. 6 (1) (f) GDPR). Payment records are kept where the law requires it (Art. 6 (1) (c) GDPR).

Payment providers

Payments are handled by Stripe Payments Europe Ltd. (Ireland) or PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg). Their privacy notices apply to the payment.

Cookies

We only use cookies that are technically necessary: for sign-in, form protection and your language. There is no tracking, no analytics and no content loaded from other sites.

Hosting

The website runs on a server of OVH SAS (France) in a data centre in the EU.

Retention

Account data is kept until you ask us to delete your account. Payment records are kept for the statutory periods. Security logs are kept only as long as needed to protect against abuse.

Your rights

You have the right of access, rectification, erasure, restriction, data portability and objection, and you may lodge a complaint with a data protection authority. Write to the address above.