1. Controller
- Controller: Rafael Guerrero Chueca.
- NIF: 25179706L.
- Address: Avenida Logroño 78, Casetas, 50620 Zaragoza, Zaragoza, Spain.
- Privacy contact: [email protected].
2. Local application data
Boxes, pallets, labels, configurations, distributions and logistics documents created or imported in LoadMosaic are processed locally on the user’s computer during ordinary use. They are not uploaded to the LoadMosaic owner, Lemon Squeezy or the licensing service unless the user deliberately attaches them to a support request.
The application creates local interface and licence-state files beside the executable. The licence state is protected with Windows DPAPI for the current Windows user. Users control where their imported and exported documents are stored.
3. Website and language preference
Cloudflare infrastructure may process the IP address, date and time, requested URL, HTTP headers, approximate browser or operating-system information, and security or network diagnostics needed to deliver and protect the website.
The website stores only the selected language code under loadmosaic-lang in browser localStorage. It currently contains no first-party advertising, behavioural tracking or analytics.
4. Trial, activation and licence validation
For Trial control, the application derives a contextual SHA-256 identifier from a Windows machine identifier, without sending that source value in clear text. The licensing service hashes the received identifier again before storing trial dates in Cloudflare D1.
For activation, validation and deactivation, the system processes the licence key transiently, a non-descriptive technical installation alias, the instance identifier supplied by Lemon Squeezy, product or variant identifiers, timestamps, status and result. D1 audit events contain hashes of the key and installation or instance identifiers, operation type, result and UTC date—not the key in clear text. Validly signed Lemon Squeezy webhooks store their event identifier, type and receipt date.
Network infrastructure may additionally process the source IP and technical request metadata. Hashes and aliases are treated as pseudonymous data because they can distinguish licences or installations.
5. Purchase and support
Lemon Squeezy, as Merchant of Record, may process name, email, billing and tax information, country, order, licence, amount, currency, tax, payment status, refund and fraud-prevention data. The LoadMosaic owner may access the order and customer information needed to administer the licence and support, but does not receive the full payment-card number.
Messages to [email protected] are handled through Gmail and may contain the sender’s address, message, technical information and attachments voluntarily supplied. Do not send full card details, passwords, identity documents or unrelated confidential data.
6. Purposes and legal bases
- Provide the website, demo, licence and support; perform the contract or pre-contractual steps.
- Activate and validate licences, prevent repeated Trials, fraud and abuse, and secure the service; performance of the contract and legitimate interests in protecting the product and users.
- Process billing, tax, consumer and accounting obligations; compliance with legal obligations.
- Answer privacy requests and legal claims; legal obligations and establishment, exercise or defence of claims.
- Consent, where a specific optional processing operation requires it. Consent can be withdrawn prospectively.
7. Recipients and international processing
Data may be processed by Lemon Squeezy and its payment providers for sales, Cloudflare for hosting, security, Workers and D1, and Google for support email. Public authorities may receive data when legally required. These providers may process data outside the European Economic Area under their applicable safeguards, such as an adequacy decision or standard contractual clauses. Their current notices provide the applicable details.
8. Retention criteria
- Local logistics documents remain under the user’s control until the user deletes them.
- The language preference remains until the user clears site data or replaces the preference.
- Trial identifiers and dates are kept for as long as needed to enforce the one-Trial rule and protect against abuse. No fixed automatic deletion deadline is promised for the current D1 trial table.
- Licence audit and webhook metadata are kept while needed to operate the licence, investigate security or fraud, meet legal duties and deal with claims. They are not kept for advertising.
- Support correspondence is kept while the request is handled and afterwards only while needed for follow-up, legal obligations or possible claims.
- Checkout, platform logs and provider backups follow Lemon Squeezy, Cloudflare and Google retention rules. Legal blocking may apply where deletion is not yet permitted.
9. Rights and complaints
You may request access, rectification, erasure, restriction, portability where applicable, or object to processing by writing to [email protected]. Identity may be verified proportionately. You may also complain to the Spanish Data Protection Agency (AEPD) or the competent supervisory authority in your country. These rights are subject to lawful exceptions and retention duties.
10. Security and changes
Proportionate technical and organisational safeguards are used, including HTTPS, restricted secrets, hashing for remote identifiers and DPAPI for local licence state. No system is completely risk-free. This policy may be updated when processing, providers or the law change; the effective date and version identify the current text.