Last updated
Who is responsible
The data controller is Paperwolf Studio.
In short
This site has no accounts, no forms and no analytics, and it sets no cookies of its own. The data we handle comes from three places: the servers that deliver the site, your purchase through Lemon Squeezy, and the Studio app when it activates a licence. Two optional trackers run only if you accept them: one for affiliate referrals, and the Meta Pixel, which measures our ads on Instagram and Facebook.
Visiting the site
The site is hosted by Vercel. To deliver pages and keep the service secure, its servers process technical data such as your IP address, browser, the page requested and the time. We don’t use this data to identify you. Legal basis: our legitimate interest in running a secure site (GDPR art. 6(1)(f)). It is kept only as long as the hosting provider keeps its logs.
Buying
Lemon Squeezy runs the checkout as merchant of record. It collects your name, email, billing address and country, your tax number if you give one, and your payment details, and processes them as an independent controller under its own privacy policy. We never see your payment details.
Lemon Squeezy shares with us what we need to deliver and support your order: name, email, country, products, amounts, the licence key, and the checkout data we record ourselves (that the order came from this site, your confirmation about the right of withdrawal and the version of the terms you accepted). Legal basis: performing the contract and our legal obligations, such as accounting (GDPR art. 6(1)(b) and (c)). We keep order records for as long as tax and accounting law requires.
If you reached the site through one of our ads or links, the order also records which one: the campaign names in that link’s address (its utm_ parameters), carried from page to page without cookies. We use them only to know which ads lead to sales. Legal basis: our legitimate interest in measuring our own advertising (GDPR art. 6(1)(f)).
Licence activation
When you activate, renew or deactivate a licence, the Studio app sends your licence key, an identifier of the Mac, the Mac’s name (which the service doesn’t store or pass on) and the app version to our activation service (api.paperwolf.it); like any internet request, it also carries your IP address. The service checks the key with Lemon Squeezy’s licence service and returns a signed licence file that includes the name on your order: the plugins show it as “Licensed to …” in DaVinci Resolve. Legal basis: performing the contract (GDPR art. 6(1)(b)), and our legitimate interest in keeping the service secure and preventing misuse of licences, such as key sharing, which is why we apply rate limits per network and the activation limits in the Licence terms (GDPR art. 6(1)(f)). We keep activation records while the licence is in use, and for a limited time after that to handle support and misuse.
The Studio app also checks our download server for updates and news; that request carries no licence key or identifier, only what any web request carries, such as your IP address. The plugins themselves don’t connect to the internet and never send your images or projects.
Affiliate referrals, only with consent
If you accept “Affiliate referral” in the cookie banner, the site loads Lemon Squeezy’s affiliate script. When you arrive through an affiliate link (an address containing ?aff=), the script computes an identifier from your browser’s characteristics and sends it to Lemon Squeezy with the page address and the referring page; it then stores the ls_aff_ref cookie, so the affiliate gets credit if you buy. Legal basis: your consent (GDPR art. 6(1)(a); Italian Privacy Code, art. 122). Without your consent the script never loads. Change your choice at any time with Cookie settings in the footer. Details are in the Cookie policy.
Ad measurement, only with consent
If you accept “Ad measurement” in the cookie banner, the site loads the Meta Pixel from Meta Platforms Ireland Ltd. It tells Meta which pages you view, when you download the free trial, when you go to checkout and when you complete a purchase, with the product, the amount excluding VAT, the currency and the order number; never your name, email or payment details. With each event it sends your IP address, details of your browser, the page address and the identifiers in the _fbp and _fbc cookies. If you are signed in to Facebook or Instagram in the same browser, Meta can link the events to your account. We use what Meta reports to us to see which of our ads lead to visits, trials and sales, and to show our ads to people who visited this site or are likely to be interested in it. Legal basis: your consent (GDPR art. 6(1)(a); Italian Privacy Code, art. 122). Without your consent the pixel never loads and purchase data is not sent from our server. If you withdraw consent, further tracking stops, pending server sends are cancelled and the advertising cookies are deleted from this site.
For purchases we also use Meta Conversions API: the same order ID prevents the browser and server copies being counted twice. When you open checkout with consent, our server keeps the browser identifiers, IP address and page address for up to 7 days, linked to a random checkout reference. They are removed after successful delivery; a failed send is retried for up to 36 hours. We retain only an order-ID delivery marker for 90 days to prevent duplicate sends. Browser storage pw-measurement retains checkout references and sent order IDs for up to 7 days and is cleared when consent is withdrawn. If the withdrawal request cannot reach our server, pw-measurement-revocations retains only the random references, for up to 7 days, to retry that request on a later visit or when connectivity returns. We do not send your name, email, licence key or payment details to Meta.
For collecting these events on this site and sending them to Meta, we and Meta Platforms Ireland Ltd are joint controllers under the Meta Controller Addendum, which makes Meta responsible for answering requests about its own processing. What Meta does with the data afterwards, including transfers to Meta Platforms, Inc. in the United States under the EU-US Data Privacy Framework, is described in its privacy policy. Change your choice at any time with Cookie settings in the footer. Details are in the Cookie policy.
If you write to us, we use your address and message to reply, and keep the conversation for as long as support needs it. We send no newsletter.
Who else handles data
Vercel (hosting of the site and of the activation service), Upstash (the activation service’s database), Cloudflare (downloads and DNS) and our email provider process data on our behalf. Lemon Squeezy acts as an independent controller for the purchase. Some of these providers are based in the United States; transfers rely on the safeguards the GDPR provides, such as the EU-US Data Privacy Framework or standard contractual clauses. We don’t sell personal data or use it for automated decisions; the only profiling is Meta’s ad measurement, and only with your consent (above).
Your rights
You can ask to access, correct or delete your data, to restrict or object to its processing, and to receive it in a portable format, and you can withdraw consent at any time (GDPR art. 15–22). You can also complain to the Italian data protection authority, the Garante per la protezione dei dati personali, or to the authority where you live.