Legal Document
$ cat ./privacy.md

Privacy Policy

Last updated: May 18, 2026

This Privacy Policy explains how ScriptMasters (“we”, “us”, or “our”) collects, uses, and protects information when you purchase or use our software products and related services. We are committed to protecting your privacy and complying with applicable data protection laws, including the EU General Data Protection Regulation (GDPR).

1Data Controller

ScriptMasters is the data controller for personal data collected through our website and software products. For privacy inquiries, contact us at privacy@scriptmasters.dev.

2Data We Collect

We collect the following categories of personal data:

Account and purchase data

When you purchase a licence, we may collect your email address, name, and payment transaction identifiers provided by the payment processor (e.g. Gumroad order ID). We do not store full payment card numbers — payment processing is handled by third-party processors.

Licence activation data

When you activate a licence, we collect the hardware identifier bound to your licence (USB Volume Serial Number for SETup; device fingerprint for other products). This is necessary for licence verification and anti-piracy enforcement.

Heartbeat telemetry

Licensed software periodically sends a heartbeat signal to verify licence validity. This signal includes your licence key hash and IP address. We retain heartbeat logs for up to 90 days for security and debugging purposes.

Communication data

If you contact us by email, we retain your correspondence to respond to your inquiry and for our records.

3How We Use Your Data

We use your personal data to:

  • Fulfil your licence purchase and deliver your licence key.
  • Verify licence validity and enforce licence terms.
  • Detect and prevent fraud, abuse, and unauthorised use.
  • Respond to your support inquiries.
  • Send transactional communications (licence expiry notices, order confirmations).
  • Comply with our legal obligations.

Legal basis (GDPR): We process your data on the basis of contractual necessity (to deliver and operate the licence you purchased), legitimate interests (fraud prevention and security), and legal obligation where applicable. We do not use your data for advertising or sell it to third parties.

4Data Retention

We retain your personal data for as long as necessary to provide our services and comply with legal obligations:

  • Account and purchase data: retained for the duration of your licence and for 3 years thereafter for tax and legal compliance.
  • Heartbeat logs: retained for up to 90 days.
  • Support correspondence: retained for 2 years after the last interaction.

5Data Sharing

We do not sell, rent, or share your personal data with third parties, except in the following limited circumstances:

  • Payment processors: We share purchase information with our payment processor(s) to fulfil your transaction. These processors have their own privacy policies.
  • Hosting providers: Our infrastructure is hosted on cloud platforms (including Vercel and Neon). Data is processed on servers within the EU or under appropriate transfer safeguards.
  • Legal requirement: We may disclose your data if required by law or to protect our legal rights.

6Your Rights (GDPR)

If you are located in the European Economic Area (EEA), you have the following rights regarding your personal data:

  • Access: You may request a copy of the personal data we hold about you.
  • Rectification: You may request correction of inaccurate data.
  • Erasure: You may request deletion of your data, subject to our legal retention obligations.
  • Restriction: You may request that we restrict processing of your data in certain circumstances.
  • Portability: You may request a machine-readable copy of data you have provided to us.
  • Objection: You may object to processing based on legitimate interests.
  • Complaints: You have the right to lodge a complaint with your local supervisory authority.

To exercise any of these rights, contact us at privacy@scriptmasters.dev. We will respond within 30 days.

7Cookies and Tracking

Our website does not use advertising or analytics cookies. We use a single session cookie to authenticate admin users. No third-party tracking or advertising pixels are present on our website.

8Security

We implement appropriate technical and organisational measures to protect your data against unauthorised access, disclosure, alteration, and destruction. Licence keys are stored as SHA-256 hashes. Passwords are hashed using bcrypt. All data in transit is encrypted via TLS. Despite these measures, no internet transmission is completely secure and we cannot guarantee absolute security.

9Children's Privacy

Our services are not directed to individuals under the age of 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected such data, please contact us immediately and we will delete it.

10Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by updating the “Last updated” date. Your continued use of our services after changes constitutes acceptance of the updated policy.

11Contact

For privacy-related inquiries or to exercise your rights, contact: privacy@scriptmasters.dev