Effective [DATE]
This policy explains what personal data WispFX, our licence server and our website collect, why, and what rights you have.
Controller: ET "STIVAN-M - Stoyan Georgiev" (ЕТ "СТИВАН-М - СТОЯН ГЕОРГИЕВ"), EIK 101052668, registered office 4 Georgi Kazepov Str., 2800 Sandanski, Bulgaria. Contact: [email protected]. No data protection officer is appointed (not required for this scale of processing; lawyer to confirm).
1. The short version
- Your footage and mattes stay on your computer. WispFX processes video locally on your GPU and does not upload your footage, frames or Output to us.
- The free version sends us nothing. When you activate a licence we process your email address, your licence key, a machine fingerprint made of one-way hashes, and the dates of activation and check-ins.
- We do not sell your data and do not use it for advertising.
2. What the software and licence server collect
| Data | When | Why (purpose) | Legal basis (GDPR Art. 6) | Kept for |
|---|---|---|---|---|
| Email address | Receiving and activating a licence key | Identify the licence, email your key, support | Contract (6(1)(b)) | Life of the licence + [X] years |
| Licence key, licence type, number of seats, status, order ID and the store it came from (e.g. Gumroad, Paddle, aescripts) | Purchase; activation | Deliver and manage the licence; handle refunds and chargebacks | Contract; legal obligation for accounting records (6(1)(c)) | Life of the licence + statutory retention under Bulgarian accounting and tax law ([X] years, accountant to confirm) |
| Machine fingerprint: three one-way SHA-256 hashes derived from your Windows Machine GUID, NVIDIA GPU UUID and system volume serial number | Activation, check-in | Bind a licence to a computer and count its computers, detect shared keys | Contract; legitimate interest in preventing licence abuse (6(1)(f)) | Until deactivation + [X] months |
| Activation and check-in timestamps ("created", "last seen") | Every check-in (about every 3 days while online for Gumroad keys; [interval] for keys from our own licence server, if used) | Keep offline grace periods working; detect abuse | Contract; legitimate interest | As above |
| Software version | Activation | Support, compatibility | Legitimate interest | As above |
| IP address | Each request to the licence server | Rate limiting against abuse; held in memory only, not written to the licence database. [Check: hosting provider / reverse proxy access logs, retention X days] | Legitimate interest | [In memory only / X days in server logs] |
| Event log entries (e.g. "activated key", "refund received"), only if our own licence server is used | Licence events | Audit trail, fraud and dispute handling | Legitimate interest; legal obligation | [X] years |
| Support emails | When you contact us | Answer your request | Contract / legitimate interest | [X] years |
The raw Machine GUID, GPU UUID and volume serial are read on your computer and only their hashes are sent. Reading these identifiers is necessary to provide the licence you asked for.
Gumroad licence check (launch build): if you bought on Gumroad, your licence key and our product ID are sent to Gumroad's licence API (api.gumroad.com) when you activate and at each re-check. Gumroad returns purchase details (including the buyer email and refund status), which are stored in a sealed activation file on your computer. In this mode no data is sent to a server of ours.
Free version: using WispFX without a licence key sends no licence data to us or to Gumroad.
What we do not collect: no footage, frames, mattes, project files, file names, usage analytics or crash reports are sent to us by the software. [If telemetry or crash reporting is ever added, update this policy and ask for consent where required.]
3. Purchases
Payments are handled by the store you buy from, which acts as merchant of record and reseller: [Gumroad, aescripts + aeplugins, Paddle / Lemon Squeezy]. They process your payment details, billing address and tax information under their own privacy policies. We receive order data needed to issue your licence (typically name, email, order ID, product, country and price). We never receive your full card details.
4. Third parties you deal with directly
These are separate controllers, and their own privacy policies apply:
- Hugging Face: you download the AI models with your own Hugging Face account. The Hugging Face access token you enter stays on your computer and is used only to download models; we never receive it.
- Lightricks: accepting the gated LTX model licence on Hugging Face shares your contact information with Lightricks, who may send you offers and updates according to their terms.
- GitHub, PyPI, download.pytorch.org: the setup program downloads open-source components from these sites, which see your IP address like any download.
5. Processors we use
We use service providers who process data on our behalf under data processing agreements:
- licence key checks and sales: Gumroad, Inc. (USA), which also acts as merchant of record
- transactional email: Zoho Mail (Zoho Corporation B.V., Netherlands; EU data centre)
- website hosting and DNS: Cloudflare, Inc. (USA; EU-US Data Privacy Framework)
- support mailbox: Zoho Mail (Zoho Corporation B.V., Netherlands; EU data centre)
6. Website
[Placeholder: describe the website's cookies and analytics once decided. Preferred: a cookieless, privacy-friendly analytics tool with no personal data, which avoids a consent banner. If you use cookies or tracking for analytics or advertising, list each tool, purpose, retention and obtain consent before setting them (ePrivacy rules), with a way to withdraw consent.]
7. International transfers
Some providers (for example Gumroad, Paddle, aescripts, Lemon Squeezy, Hugging Face) are based outside the EU/EEA, mainly in the US or UK. Where data goes outside the EEA, transfers rely on an adequacy decision (such as the EU-US Data Privacy Framework for certified companies, or the UK adequacy decision) or on Standard Contractual Clauses. [Check each provider.]
8. Your rights
Under the GDPR you have the right to:
- access your personal data and get a copy;
- have inaccurate data corrected;
- have data erased, where we have no legal reason to keep it. Deleting licence data may end your ability to use the licence;
- restrict processing;
- data portability for data you gave us under a contract;
- object to processing based on legitimate interest;
- withdraw consent at any time where processing is based on consent;
- lodge a complaint with a supervisory authority, in particular in your country of residence or with our lead authority, the Bulgarian Commission for Personal Data Protection (Комисия за защита на личните данни, КЗЛД), www.cpdp.bg.
To exercise a right, email [email protected]. We answer within one month. We may need to verify your identity, for example by asking for your licence key or order email.
You can deactivate a computer at any time from the WispFX panel (Licence > Deactivate), which removes that machine's activation from the server.
9. Security
Licence files are signed (Ed25519) and checked offline; the server's signing key never leaves the server. Communication with the licence server uses HTTPS. Access to the licence database is restricted to us.
10. Children
WispFX is a professional tool and is not directed at children under 16. We do not knowingly collect their data.
11. Changes
We will post changes here and update the effective date. For material changes we will notify licence holders by email.
12. Contact
ET STIVAN-M, 4 Georgi Kazepov Str., 2800 Sandanski, Bulgaria, [email protected]