Privacy policy

1. Who is responsible

The controller is Philipe Bueno, trading as Bueno Labs, in Brazil, who also acts as the data protection contact. Any request about your data goes to philipebueno@gmail.com.

2. Browsing the site

• No tracking cookies and no advertising. The public pages set no cookie at all.
• Hosting: the site is served by Cloudflare, which processes your IP address to deliver the pages and protect them from attacks.
• Visit counts: Cloudflare Web Analytics counts visits in aggregate, without cookies and without identifying you.
• Fonts: the pages load their typefaces from Google Fonts, so your browser connects to Google servers, which see your IP address.

3. When you write to me

If you send an e-mail — a question, an early-access request, a security report — I keep your address and the message to answer it and, if you asked, to send you the one e-mail announcing a release. Nothing else is sent. E-mail is handled by Google (Gmail).

4. When you buy

Payment goes through PayPal. I receive your name, e-mail, the amount and the transaction number — never your card or bank details. Purchase records are kept for five years, as Brazilian tax law requires.

5. The customer area

If you have a licence, your account holds:

• name, company, e-mail and preferred language;
• your password only as a salted one-way hash (PBKDF2) — nobody can read it, me included;
• your licences, their dates and the transaction they came from;
• a record of each download: which file and when, with the IP address stored only as a keyed hash.

Signing in sets one cookie, strictly necessary, that keeps you logged in for up to seven days; the server stores only a hash of it. Failed sign-in attempts are kept, as keyed hashes of the IP and of the e-mail, to stop password guessing, and are deleted after 24 hours. The account and its records are deleted when you ask, except the purchase records of section 4.

6. Why, and on what legal basis

• To deliver what you bought — account, downloads, support: performance of a contract (LGPD art. 7, V · GDPR art. 6(1)(b)).
• To keep the site and accounts secure — hashing, brute-force protection, download records: legitimate interest (LGPD art. 7, IX · GDPR art. 6(1)(f)).
• To keep purchase records: legal obligation (LGPD art. 7, II · GDPR art. 6(1)(c)).
• To answer you: your request, and legitimate interest.

7. Who else processes data

Only the providers named above — Cloudflare (hosting, analytics, customer-area database and file storage), PayPal (payment) and Google (fonts and e-mail). They act on their own published terms and may store data outside Brazil and outside your country. Your data is never sold, rented or used for advertising.

8. Your rights

You can ask to confirm whether I hold data about you, access it, correct it, have it deleted or anonymised, receive a copy, know who it was shared with, and object to its use. Write to the address in section 1; you get an answer within 15 days. You can also complain to the Brazilian authority (ANPD) or, in Europe, to your local data protection authority.

9. Security

The site is served only over HTTPS, passwords and session tokens are stored only as hashes, the customer area pages run no third-party script, and the download files are never exposed at a public address.

10. Changes

This policy may be updated; the date at the top changes with every update. If a change affects customer accounts, account holders are told by e-mail.