Privacy Policy

This policy explains what personal data CrystalKarat collects, why, and what you can ask us to do with it. Richard Ackroyd, trading as CrystalKarat, of Lytchett House, 13 Freeland Park, Wareham Road, Poole, Dorset, BH16 6FA, is the controller of your personal data under the UK General Data Protection Regulation and the Data Protection Act 2018. Write to support@crystalkarat.com about anything in this policy.

1. What we collect

• Account details: your name, email address and sign-in information when you create an account.
• Order details: what you bought, when, the amount, and the billing details our payment provider needs.
• License and activation data: your license keys and, for each computer you activate, an identifier derived from its hardware, the computer's name, and when it was activated and last checked in. Each time a plugin activates or checks its license it also reports its version, your operating system and the application it runs in, which we log to diagnose problems.
• Technical data: standard server logs, such as IP addresses and browser details, when you use the site or download an installer.
• Error reports: when something on the site fails, a report of the failure and the page it happened on is sent to our error-tracking provider so we can fix it. A small sample of page loads is also timed for the same purpose. These reports do not include your IP address, cookies, account details or anything you typed into a form.
• Update checks: once a day, each of our plugins asks this site whether a newer version exists for your operating system. The request carries your IP address and is logged like any other visit; it carries no license key, email or machine identifier.
• Messages: anything you send us when you ask for help.

The site uses cookies to keep you signed in and to take payment securely; these are needed for it to work. If you choose a currency, the ck_currency cookie remembers your choice for a year; until you do, we use the country of your IP address to show prices in your currency. If you accept analytics cookies, it also uses Google Analytics, which sets the _ga and _ga_* cookies for up to two years, to count visits and see which pages are used. Nothing is loaded from Google until you accept. You can change your choice at any time with Cookie settings at the foot of each page. We do not use advertising cookies.

2. Why we use it

• To sell you software, let you try it and provide it: creating your account, taking payment, issuing and managing your licenses and trials, and delivering downloads. This is necessary to perform our contract with you.
• To keep records we are required to keep, such as tax and accounting records. This is a legal obligation.
• To prevent fraud and misuse of licences, to enforce our licence terms, to keep the service secure, and to establish, exercise or defend legal claims. These are our legitimate interests, and we have balanced them against your rights.
• To tell you when a new version of software you bought is available: by a notice in the plugin, and by email with an unsubscribe link in every message. These emails are about software you own, not marketing. This is part of providing that software.
• If you start a free trial, to email you now and then about CrystalKarat's own plugins, updates and offers, unless you ticked the box to opt out when you started it. The law allows this for products like the one you are trying (the "soft opt-in" in the Privacy and Electronic Communications Regulations), and it is in our legitimate interests. Every one of these emails has an unsubscribe link, and you can also write to us to stop them.
• To find and fix faults, by collecting error reports and timings. This is in our legitimate interests, and the reports are limited to technical data.
• To answer your questions and support you.
• If you accept analytics cookies, to understand how the site is used so we can improve it. This is based on your consent, which you can withdraw at any time.

We do not sell your data, and we send no other marketing email without your consent.

3. Who processes it for us

We use these providers, each bound by a data processing agreement:

Where data is transferred outside the UK, it is protected by UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework, where a provider is certified under it), or by the UK International Data Transfer Agreement or Addendum.

4. How long we keep it

We keep your account and license records while your account is open, so your licenses keep working and you can download your software. Order records are kept for six years for tax purposes. Activation records for a computer are deleted when you deactivate it. Server logs are deleted after 14 days, and error reports within 90 days. Messages you send us are kept for three years after the matter is resolved. Where we need data to establish, exercise or defend a legal claim, or to show that a licence was misused, we keep it for as long as that claim could be brought, normally six years.

5. Your rights

You can ask for a copy of your data, ask us to correct or delete it, object to or ask us to restrict how we use it, and ask for it in a portable format. Where we rely on your consent, you can withdraw it at any time. Deleting your account ends access to your licences. Write to support@crystalkarat.com and we will respond within one month. We may need to confirm your identity first.

Activation checks are automated: a licence that has expired, been refunded or been suspended stops working. This is how the licence you agreed to works, and if you think a check has gone wrong, you can ask for a person to review it.

6. Complaints

If you are unhappy with how we handle your data, please complain to us first at support@crystalkarat.com. We will acknowledge your complaint within 30 days and tell you the outcome without undue delay. You can also complain to the Information Commissioner's Office at ico.org.uk.

7. Children

Our site and software are not intended for anyone under 18, and we do not knowingly collect data about children.

8. Security

We use providers with recognised security standards, encrypt data in transit, and limit access to personal data to what is needed. No system is completely secure; if a breach affecting your data is likely to put you at high risk, we will tell you.

9. Changes to this policy

We may update this policy. The date at the top shows when it last changed, and we will tell you by email about any change that significantly affects how we use your data.