Privacy Notice

Who we are

Fixed Frame Ltd., a company registered in Ireland (company number 820747, registered office 77 Lower Camden Street, Dublin D02 XF80, Ireland), is the data controller for the processing described here.

Contact: [email protected]. We have not appointed a Data Protection Officer; please direct any data-protection query to that address.

The short version

What the apps send us

If you have opted in, then when you install or launch Konformer, Konformista, or Kontroller, the app sends one small message to our collector (and nothing at all if you have not):

What this is not: it contains no name, no email address, no account, no file names, no project contents, and no media. The installation identifier is a randomly generated code created on your machine; it is not derived from you or your hardware.

IP addresses. Like any internet request, the message reaches our infrastructure provider (Cloudflare) with your IP address. Our collector does not read or store it; the approximate location is inferred by Cloudflare at the network edge and only the two-letter country code and city name are kept by us. Cloudflare may process IP addresses transiently to deliver and secure the service, as described in its own policies. We do not retain your IP address.

Your choice, and how to change it

Usage data is off until you turn it on. The first time you run each app, we ask whether you want to share it — if you say no, or don't answer, nothing is ever sent. You can change your choice at any time in Preferences › Privacy. (For automated, self-hosted, or air-gapped deployments, administrators can also force it off with the environment variable KONFORMISTA_NO_TELEMETRY=1; machines without internet access never send anything and the apps work fully offline.)

Our lawful basis

We process usage data on the basis of your consent (Article 6(1)(a) GDPR), which you give through the in-app prompt and can withdraw at any time in Preferences without affecting the software. Because the installation identifier is stored on and read from your device, this is also consent for the purposes of Article 5(3) of the ePrivacy Directive. Withdrawing consent does not affect the lawfulness of processing before withdrawal. The data is minimal and pseudonymous, and involves no profiling, no advertising, and no sharing for anyone else's purposes.

For license activation (paid products, when performed online): we process your license identifier and a hashed machine fingerprint to issue and verify your license. This is strictly necessary to provide the licensing service you explicitly requested — so it is exempt from the Article 5(3) consent requirement and processed for the performance of a contract (Article 6(1)(b) GDPR). Offline activation sends us nothing; the license file is verified entirely on your machine.

If you contact support, we process the details you send us to answer you (legitimate interests / contract, as applicable).

If you join the beta programme

If you take part in a Konformista or Konformer beta, we process the email address you sign up with and any feedback, bug reports, or diagnostic details you choose to send us — so we can run the programme, contact you about it, and fix and improve the software. Our lawful basis is our legitimate interest in developing and supporting our products and, where you have a beta agreement with us, the performance of that agreement. Taking part is voluntary and you can leave at any time by emailing [email protected]. We keep beta sign-up details for the duration of the programme and a short period afterwards; feedback you send may be retained and incorporated into our products as described in the Beta Test Agreement. Any usage-data signal from a beta build is still opt-in and is covered above — accepting a beta agreement is not consent to usage data.

We are not a processor of your media, or of your time-tracking and billing data

Your media, projects, and edit data stay on your machine and are never transmitted to us or to any processor acting for us. We are not a data processor of your production content, and no data processing agreement is required for it.

The same is true of the time-tracking, billing, and invoicing tools in Kontroller: the sessions you record, the rates you set, and any invoice details you enter — including your own clients' or contacts' names — are held only on your device and in the files you export to your own accounting software. They are never sent to us. We are neither controller nor processor of them; where they include personal data of your clients, you remain the controller of that data and decide what to record.

Where the data lives and who processes it

The telemetry signal is received and stored using Cloudflare (Workers and a D1 database in an EU region) under the Cloudflare Data Processing Addendum. Our other processors are Stripe (payment and license-purchase records) and the provider that hosts our [email protected] mailbox. We do not sell your data or share it with anyone for their own purposes.

International transfers

Our processors are established outside the EU/EEA (for example, Cloudflare, Inc. and Stripe, Inc. are US companies) and may process data outside the EEA even where storage is in an EU region. Where that happens, transfers are covered by the European Commission's Standard Contractual Clauses and the relevant processor's Data Processing Addendum, together with supplementary measures where appropriate.

How long we keep it

Raw telemetry events are kept for no longer than 24 months, after which they are deleted or reduced to aggregate statistics (counts that no longer contain the installation identifier). License and purchase records are kept for as long as needed to honour your license and to meet legal and tax obligations (invoicing and VAT records are retained for six years as Irish tax law requires, or longer where an ongoing legal or tax matter requires it). Support correspondence is kept only as long as needed to handle your query and a short period afterwards. Beta programme sign-up details are kept for the duration of the programme and a short period afterwards, as described in the beta section above.

Your rights

Under the GDPR you have the right to access, rectify, or erase personal data we hold about you, to object to or restrict processing, to data portability where applicable, and — where we process on the basis of your consent — to withdraw that consent at any time (in Preferences › Privacy for usage data), without affecting the lawfulness of processing before you withdraw. We do not carry out any automated decision-making or profiling that produces legal or similarly significant effects. Providing usage data is entirely optional and is never a condition of using the software; the limited data needed for license activation is required only if you choose online activation. Because the telemetry identifier is not linked to your name, we may need you to tell us the identifier (visible in the app's log file) to locate data relating to your installation.

To exercise any right, email [email protected]. You also have the right to lodge a complaint with the Irish Data Protection Commission (www.dataprotection.ie) or your local supervisory authority.

Changes

We will post any changes to this notice at konformista.com/privacy and update the date above. Material changes will be noted in the apps' release notes.