Sebastian Behrendt, Secret VIP, Marienthaler Str. 145, 20535 Hamburg, Germany, email [email protected], phone +49 40 37415446. No data protection officer has been appointed because the legal requirements for one are not met. This policy covers this website (plugins.secret.vip), our software (Secret Future EQ 2, Secret Audio Normaliser) and support.
When you visit this website we set no cookies, use no analytics or advertising services and load no content from third parties (no external fonts, no CDNs). That is why there is no cookie banner. Only when you click Buy does the page load the payment service Paddle (section 4). We do not sell data and make no automated decisions within the meaning of Art. 22 GDPR.
This website is hosted on GitHub Pages (GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA). When you visit, GitHub processes technically necessary connection data (IP address, time, requested address, browser details) to deliver the page and protect it against attacks. Legal basis: our legitimate interest in a secure, reliable website (Art. 6(1)(f) GDPR). GitHub is certified under the EU-US Data Privacy Framework (adequacy decision, Art. 45 GDPR). We have no access to these logs. Download files are also hosted on GitHub (github.com).
Seller, payment processor and invoicing party is Paddle (Paddle.com Market Limited, 30 Old Bailey, London EC4M 7AU, United Kingdom) as Merchant of Record. Paddle processes your order and payment data as an independent controller: Paddle privacy notice. The EU Commission has adopted an adequacy decision for the United Kingdom.
Only when you click Buy (or open a Paddle payment link) does this page load Paddle's checkout (cdn.paddle.com). Paddle's security service then sets a cookie against bot attacks (__cf_bm, lifetime 30 minutes). Legal basis: your wish to buy (Art. 6(1)(b) GDPR); this cookie is necessary for the payment you requested (section 25(2) no. 2 TDDDG). Paddle may also load a script from public.profitwell.com in the checkout (ProfitWell, a Paddle service); it is part of Paddle's checkout, details are in Paddle's privacy policy.
After the purchase Paddle sends us name, email address, order number, product, country and amounts and – if the link contained one – a campaign tag (e.g. utm_source). We use this to send you the license key, manage the license and see which campaign led to a purchase (Art. 6(1)(b) and (f) GDPR). For bookkeeping we store order number, country and amounts without name or email address and keep these records for 8 years (section 147 German Fiscal Code, section 257 German Commercial Code; Art. 6(1)(c) GDPR).
Links in our posts may carry a tag in the address (e.g. ?utm_source=instagram&utm_content=clip12). It only shows which post you came from, not who you are. We use no cookies and no pixels for this. When you click Buy, the tag is passed to Paddle and stored with the order. We only evaluate it in aggregate, as purchases per channel and per post. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in knowing which posts work). If you do not want this, open the page without the tag.
Our license server license.secret.vip runs at Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, in Germany (processor, Art. 28 GDPR). It only stores what the license needs:
To prevent trial-license abuse, we process the IP address when a new trial is requested. New trial events store a non-reversible verification value for each day and product instead of the IP address itself. This enforces the limit of two new trials per address, day and product. The verification value is pseudonymous data. Purpose and proposed legal basis: our legitimate interest in preventing repeated trial abuse (Art. 6(1)(f) GDPR). These verification values currently have no automatic deletion or fixed retention limit. Older trial events may still contain IP addresses in plain text; these entries are not automatically deleted or converted either. The license server writes no access logs with IP addresses. Purposes for the other license data: performing the contract (Art. 6(1)(b) GDPR) and protecting license keys against misuse (Art. 6(1)(f) GDPR). Retention of the other license data: as long as the license exists, because you may use it without time limit. On request we delete name, email address and activations earlier; the key is then blocked. Daily backups of the database are kept on the same server and deleted after 30 days.
We send license keys and download links via Brevo (Sendinblue SAS, 17 rue Salneuve, 75017 Paris, France; processor, Art. 28 GDPR). Processed: name, email address, order number and the key. The same applies when you ask for your key again on the Lost key page; we then only send to the address stored at purchase. Legal basis: Art. 6(1)(b) GDPR.
When you write to us (e.g. to [email protected]), we process your address and the content to answer your request (Art. 6(1)(b) or (f) GDPR). Our mailbox is hosted by Zoho Mail in the EU data centre (Zoho Corporation B.V., Beneluxlaan 4B, 3527 HT Utrecht, Netherlands; processor). We delete requests once they are resolved unless statutory retention applies (business letters 6 years, section 257 German Commercial Code).
We use voluntary refund feedback to improve our products on the basis of our legitimate interests (Art. 6(1)(f) GDPR). We store the order number, reason and optional comment without an email address for 12 months; afterwards, only anonymous statistics by product, month (YYYY-MM) and reason category remain.
At most every 12 hours the software reads a public version list from GitHub Pages (zitrmb.github.io, GitHub, Inc., see section 3). Only the normal connection with your IP address is made; no ID is sent. Legal basis: Art. 6(1)(f) GDPR (pointing out bug fixes).
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). Right to object: you may object at any time, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR). An informal email to [email protected] is enough.
You may also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the one responsible for us: Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit, Ludwig-Erhard-Str. 22, 20459 Hamburg, Germany.
Name and email address are required for the purchase and for sending the license key; without them we cannot issue a license. Otherwise you do not have to give us any data.