Privacy Policy

1. Who is responsible for your data

[COMPANY LEGAL NAME], trading as CarveSoft, registered at [REGISTERED ADDRESS], is the data controller for the information described below. You can reach us at [email protected].

2. What the software does not collect

To be explicit, the Software does not transmit any of the following:

• The contents of any file you scan, preview or recover
• Filenames, folder names or directory structures from your disks
• Serial numbers or identifiers of the drives you connect
• A list of your hardware, other than what is needed to activate your licence
• Keystrokes, screenshots, or clipboard contents

Recovery is performed entirely on your own machine. There is no cloud component to it.

3. What we do collect

When you buy a licence

Payments are handled by our merchant of record, Paddle (Paddle.com Market Limited and its affiliates), which acts as the seller of record for your purchase. Paddle collects and processes your name, email address, billing address and payment details, and handles sales tax and invoicing. We receive from Paddle the information needed to provide you with a licence: your email address, the product and plan purchased, the order reference, and the licence status (active, expired or perpetual). We never see your full card number. No plan renews automatically, so no payment details are kept for future charges.

Paddle's own privacy practices are described in Paddle's privacy policy, which applies to the data Paddle collects directly from you.

When you activate the software

Activation sends a one-way fingerprint of your computer's hardware, together with your licence key and the network address you connect from, so that we can confirm the licence is in use on the permitted number of machines and detect abuse. The fingerprint is a hash: it cannot be reversed to reveal your hardware details, and it is not used for advertising or tracking of any kind.

When you contact us

We keep the emails you send us, including your address and anything you choose to include, so that we can answer you and keep a record of the issue.

When you visit this website

We collect aggregate, non-identifying analytics — page views and referral sources — to understand which parts of the site are useful. [SPECIFY YOUR ANALYTICS PROVIDER, OR STATE "We do not run third-party analytics."]

4. Why we are allowed to hold it

Where the GDPR applies, we rely on the following legal bases:

• Performance of a contract — issuing your licence, providing support, and handling refunds.
• Legitimate interests — preventing licence abuse and piracy, and keeping our systems secure.
• Legal obligation — retaining financial records where tax law requires it.
• Consent — for anything optional, such as marketing email, which you can withdraw at any time.

5. Who we share it with

• Paddle — as merchant of record, for payment, tax and invoicing.
• Our email provider — to deliver licence keys and transactional messages. [NAME PROVIDER]
• Our hosting and infrastructure providers — to run this website and the licence service. [NAME PROVIDERS]
• Professional advisers and authorities — where we are legally required to disclose, or need to establish or defend legal claims.

We do not sell your personal information, and we do not share it for third-party advertising.

6. Where your data is held

Our providers may store data outside your country, including in the United States and the European Union. Where personal data is transferred out of the UK or EEA, we rely on appropriate safeguards such as standard contractual clauses. [CONFIRM CURRENT PADDLE AND HOSTING TERMS BEFORE PUBLISHING.]

7. How long we keep it

• Licence and activation records — for as long as the licence is active, and for a reasonable period afterwards to handle support and dispute requests.
• Purchase records — retained by Paddle and by us for as long as tax and accounting law requires. [SPECIFY PERIOD FOR YOUR JURISDICTION.]
• Support emails — typically three years from the last exchange.
• Website analytics — in aggregate form only.

8. Your rights

Depending on where you live, you may have the right to access the personal data we hold about you, to have it corrected or deleted, to restrict or object to certain processing, to receive it in a portable format, and to withdraw consent where consent is the basis for processing.

To exercise any of these, email [email protected]. We will respond within the time required by applicable law. You also have the right to complain to your local data protection authority.

Note that deleting your licence records may mean we can no longer activate the software for you or verify a future support or refund request.

9. Cookies

This website uses only the cookies necessary for it to function and, where applicable, aggregate analytics. [IF YOU ADD ADVERTISING OR TRACKING COOKIES, YOU MUST ADD A CONSENT BANNER AND UPDATE THIS SECTION.]

10. Children

The Software is not directed at children, and we do not knowingly collect personal data from children.

11. Security

Licence keys and activation data are transmitted over encrypted connections, and activation fingerprints are stored as irreversible hashes. No system is perfectly secure, but we limit what we hold precisely so that a breach would expose as little as possible.

12. Changes

We may update this policy. The current version is always on this page, with the date shown at the top. Material changes will be announced on the website.

13. Contact

[COMPANY LEGAL NAME]
[REGISTERED ADDRESS]
Email: [email protected]