Privacy Policy

1. Scope and guiding principle

This Privacy Policy explains how FramePacker ("we", "us", "our") collects, uses, stores and protects personal data when you use the Service at https://www.framepacker.com. It should be read together with our Terms of Service.

We follow a data-minimisation principle: the Service is designed to run entirely inside your browser, and we collect only what is necessary to operate the Service, to verify Pro entitlements and to fix faults.

2. Personal data we collect

Category	What it is	Source
Account data	Email address, password (stored hashed), and an optional display name.	Provided by you at registration.
Device identifier	A non-reversible hash derived from a limited set of hardware characteristics, used to bind and verify a Pro Licence. It cannot be used to identify your exact device model.	Generated automatically when you use Pro features.
Licence and entitlement data	Pro entitlement state, plan type, activation status and related timestamps.	Generated by the Service when a Pro Licence or activation code is redeemed.
Client diagnostics	Redacted error type, error stack summary (without absolute file paths) and app version. It contains no content of the media you process.	Generated automatically when a client-side error occurs.
Local preferences	Interface language preference and similar settings.	Stored in your browser's local storage; not transmitted to us.

3. Why we use it and our legal bases

We use the data above only to:

• (a) provide, maintain and improve the Service;
• (b) verify Pro entitlements and device binding;
• (c) diagnose and fix faults; and
• (d) show you relevant notices and prompts inside the Service.

Where the EU or UK GDPR applies, our legal bases are: performance of a contract (operating your account and the Pro Licence you purchased), our legitimate interests (keeping the Service secure, preventing licence abuse and fixing faults), and consent where we ask for it. Where we rely on consent, you may withdraw it at any time.

4. Payments — Paddle as Merchant of Record

Payments on the international site are processed by Paddle (Paddle.com Market Ltd and its affiliates), which acts as our reseller and Merchant of Record. Paddle is the party that sells the Pro Licence to you and that collects and processes the payment data.

• Payment card details are collected and processed by Paddle, not by us. We do not receive or store your full card number.
• Paddle also processes the billing and tax information required to issue invoices and receipts.
• We may receive limited transaction information from Paddle (for example plan purchased, order status and a customer identifier) so that we can activate and maintain your Pro Licence.
• Paddle's own privacy policy governs its processing; please review it for details of its legal bases and retention periods.

5. Cookies and local storage

We do not use advertising or cross-site tracking cookies. We use your browser's local storage to remember your language preference, your recent-project list and session preferences. This data stays in your browser and can be cleared at any time through your browser settings. Paddle may set its own cookies when you open its checkout, under its own policy.

6. Sharing and disclosure

We do not sell, trade or transfer your personal data to third parties. We disclose data only:

• (a) with your prior consent or at your request;
• (b) where required by law, judicial process or a competent government authority;
• (c) to service providers who process data on our behalf and under contract — for example our cloud hosting and database provider, and Paddle for payments; and
• (d) where necessary to protect the security and stability of the Service.

7. International transfers

Our servers and those of our service providers may be located outside your country. Where we transfer personal data across borders, we rely on appropriate safeguards under applicable law, such as standard contractual clauses, and we require our processors to protect the data to an equivalent standard.

8. Retention

We keep personal data only for as long as necessary for the purposes described above, and in line with legal requirements. Account data is kept while your account is active; licence and entitlement records are kept for as long as needed to verify entitlements and to comply with tax and accounting rules; diagnostics are kept for a limited period and then deleted or aggregated. Inactive non-Pro accounts may be deleted as described in the Terms of Service.

9. Your rights

9.1 GDPR and UK GDPR

Where the GDPR or UK GDPR applies, you have the right to: access your personal data; rectify inaccurate data; erase data (the "right to be forgotten"); restrict or object to processing; receive your data in a portable format; and withdraw consent at any time. You also have the right to lodge a complaint with your local supervisory authority.

9.2 California residents (CCPA / CPRA)

Under the California Consumer Privacy Act as amended by the CPRA (CCPA), you have the right to know what personal information we collect, to request its deletion or correction, and to be free from discrimination for exercising those rights. We do not sell or share your personal information as those terms are defined by the CCPA, and we do not use it for cross-context behavioural advertising.

9.3 Exercising your rights

To exercise any of these rights, email [email protected]. We will respond within the timeframe required by applicable law. We may ask you to verify your identity before acting on a request. Note that for purchase records held by Paddle as Merchant of Record, requests should be directed to Paddle as well, so that the sale record can be handled by the party that holds it.

10. Security

We apply reasonable technical and organisational measures to protect personal data, including hashed password storage, transport encryption and access controls. No method of transmission or storage is completely secure, so we cannot guarantee absolute security; we nonetheless work continuously to protect your data.

11. Children

The Service is not directed at children. It is intended for users who are at least 18 years old; users below that age may use it only with the involvement and consent of a parent or legal guardian, as described in the Terms of Service. If we learn that we have collected personal data from a child without the required consent, we will delete it.

12. Changes to this policy

We may update this Privacy Policy to reflect changes to the Service or to the law. The effective date at the top of this page will be updated, and material changes will be announced within the Service or by email to your registered address.

13. Contact

For any question or complaint about privacy, email [email protected].