Privacy policy

Data controller

The data controller is Ulysses Horkan (Nexal IT), 6 rue de la Source, 31280 Drémil-Lafage, France. For any question about your data: contact@nexalit.fr.

Two separate processing operations

This document describes two distinct operations. The first covers browsing the site and sending a message through the contact form. The second covers buying and using a Cram Studio licence.

Browsing the site triggers no licence-related processing. The two sections below are independent of one another.

Site — data collected

We only collect the data you voluntarily provide through the contact form: your name, your email address and the content of your message. No account creation, no profiling.

Site — purpose and legal basis

This data is used solely to handle and reply to your request. The legal basis is our legitimate interest in responding to enquiries addressed to us. You may object to this processing at any time by writing to us.

Site — cookies and analytics

This site uses no tracking cookies and no third-party analytics. Fonts are hosted on our own domain: no request is sent to external services while you browse.

Software download links point to GitHub (GitHub Inc., a Microsoft company, United States). No request is made until you click; when you do, your IP address is disclosed to GitHub, which applies its own privacy policy.

Site — hosting and processors

The site is hosted by Cloudflare, Inc. (United States) on its Cloudflare Pages service. Technical logs containing your IP address are processed as part of that. The resulting transfers outside the European Union are governed by the European Commission’s standard contractual clauses, as set out in Cloudflare’s data processing agreement.

Contact-form messages are delivered by Mailjet, a French provider whose data is hosted in the European Union, and received in our Proton mailbox in Switzerland. Switzerland is covered by a European Commission adequacy decision. These providers only access your data in order to transmit your messages.

Site — retention

Your messages are kept for twelve months from our last exchange, then deleted.

If your enquiry leads to a contractual relationship, the resulting records fall under the statutory retention periods that apply, in particular for accounting and commercial purposes.

Cram licences — data collected

Buying a Cram Studio Pro licence records your email address, the order reference supplied by Stripe, the activation key issued, and the record of your consent to immediate performance of the contract (date, version of the text accepted, and display language).

Activating the software adds, for each of the three permitted machines, an installation identifier and a date of last use.

That installation identifier is a random value. It is not a hardware fingerprint: it describes neither your machine, nor its components, nor its configuration. The choice is deliberate, since a hardware fingerprint stops working the moment hardware changes.

We have no access to card details. The software transmits no file contents and no information about the archives you work with.

Besides licence activation and renewal, the software periodically queries GitHub’s API to check whether a newer version exists. That request discloses your IP address to GitHub (GitHub Inc., a Microsoft company, United States) and sends no other data.

When you ask the software to download a file, it contacts the address you give it, along with any mirror servers that address advertises. Those exchanges happen at your own initiative, and no other server is contacted.

Cram licences — purpose and legal basis

This data is used to issue your key, to activate and renew your licence, to enforce the three-machine limit, to answer support requests, and to revoke a licence in the event of a refund.

The legal basis is performance of the sales contract. Retaining the record of consent to immediate performance answers a legal obligation, as does retaining accounting records.

Cram licences — processors and transfers

Payment is handled by Stripe Payments Europe. Key issuance and verification run on Cloudflare Workers with Cloudflare KV storage. The email carrying your key is delivered by Resend.

These providers belong to groups established in the United States. Transfers outside the European Union are governed by the European Commission’s standard contractual clauses, set out in the data processing agreement held with each of them.

Cram licences — retention

Because the licence is perpetual, the record that makes it valid is kept for as long as the licence itself. Deleting it would mean preventing activation of software that has been paid for.

Per-machine dates of last use are kept for 180 days, after which an inactive machine automatically releases its seat.

The record of your consent is kept for five years, the applicable limitation period.

Refunded or revoked licences are deleted automatically five years after revocation.

Accounting records fall under the longer statutory periods set by the French commercial code.

Your address is inside your licence file

The signed authorisation the software stores on your computer contains your email address in readable form. This is deliberate: it makes it possible to identify the origin of a key that has been shared.

It follows that your address sits in a file on your own disk. Deleting our records does not affect that copy, which only you can remove, by deactivating the software or deleting its local data.

Your rights

Under the GDPR, you have the right to access, rectify, erase, restrict, object to and port your data. To exercise these rights, write to contact@nexalit.fr. You may also lodge a complaint with the French CNIL (www.cnil.fr).

An erasure request concerning a licence is handled without deactivating it: your email address is removed from our records, while the mapping between key and product is kept in a form that no longer identifies you. Your software keeps working. The trade-off is that we can no longer find your key from your address if you lose it.