Privacy policy

Last updated: [DATE]

1. Controller

1.1. Who we are

The controller is [RAISON SOCIALE], with its registered office at [ADRESSE]. For any question about your data, write to [EMAIL].

1.2. Representative in the European Union

Representative in the European Union, within the meaning of article 27 of the General Data Protection Regulation: [REPRESENTANT UE].

2. What this policy covers

It covers the data processed by the site https://sms-gateway.araylab.com, by the customer area and by our licence server.

It does not cover the data you process with the software installed on your premises: your messages, your contacts and your logs never leave your server, and we have no access to them. For that data, you are the controller.

3. The data we process

3.1. Your account

• your email address;
• the language and currency in which you browse the site;
• the session data of your customer area: a session token, and the single-use token of your sign-in link until it has been used.

3.2. Your orders

• your order history: tier, amount, currency, payment method, status and dates;
• the IP address of the order, truncated then hashed, never stored in clear;
• the identifier of the browser used to order;
• the payment notifications sent by Gumroad or by the Mobile Money operator, kept as received so that a dispute can be settled. They may include your email address, your country and, for Mobile Money, the phone number that paid.

3.3. Your licence

• your licence key, stored encrypted so that it can be shown to you again in your customer area;
• a non-reversible digest of that key, and the issuance and update dates of the licence.

3.4. The emails we send you

A log of transactional emails, in which your address appears only as a digest, with the delivery status.

3.5. Your payment details

The details of your card or payment account are processed by Gumroad only, or by your Mobile Money operator. We never have access to them.

3.6. Licence verification

The installed software periodically contacts our licence server. This verification sends only:

• your licence key, to verify it, of which we keep only a non-reversible digest;
• the software version and its major version line;
• a non-reversible digest of the machine fingerprint;
• the number of connected phones;
• a technical counter used to detect a clock that has been set back.

The IP address of the machine, which any connection reveals, is kept only truncated then hashed, to detect abuse. No phone number, no message content and no contact is sent.

4. Purposes and legal bases

• Selling and delivering a licence to you, managing your account, showing your key again, checking activations: performance of the contract.
• Keeping the accounts and meeting tax obligations: legal obligation.
• Preventing fraud and abuse, securing the site and the licence server, settling a payment dispute: legitimate interest.
• Remembering your language and currency: legitimate interest, to show you the site as you chose it.

We send you no marketing message without your prior consent, we sell no data, and we do no advertising profiling.

5. Recipients and processors

Your data is shared only with the providers needed for the service, and only for what concerns them:

• Gumroad, merchant of record: it collects the payment, issues the invoice and collects the tax. It processes your payment data under its own responsibility, according to its own privacy policy;
• the Mobile Money operators (MVola, Orange Money, Airtel Money), for a payment made in Madagascar, under their own responsibility;
• Resend, which delivers the sign-in emails and the transactional emails;
• [HEBERGEUR], which hosts the site, the customer area and the licence server;
• UploadThing, when a file you download is stored there: it then sees the IP address of your download.

6. Retention periods

• Account: [DUREE COMPTE].
• Orders, payment notifications and licences: [DUREE COMMANDES].
• Technical logs (emails, activations, hashed IP addresses): [DUREE JOURNAUX].
• Customer area session: until you sign out, and at most thirty days without activity.
• Sign-in link: it expires twenty-four hours after being sent, and works only once.

7. Transfers outside the European Union

Gumroad and Resend are established in the United States, and your data may be processed there. These transfers are covered by the following safeguards: [GARANTIES DE TRANSFERT].

8. Security

• Your licence key is encrypted at rest, and never appears in our logs.
• The IP address is truncated then hashed before being stored.
• In the email log, your address is kept only as a digest.
• There is no password to steal: sign-in works through a single-use link, and a session can be revoked immediately on the server side.

9. Your rights

9.1. The rights you have

You have the right of access, rectification, erasure, restriction of processing, portability and objection regarding your data.

9.2. How to exercise them

Write to [EMAIL] from the address of your account. We answer within one month. Erasure cannot cover data we are required to keep, in particular for our accounting and tax obligations.

9.3. Complaints

You may lodge a complaint with the data protection authority of your country of residence, or with the authority we fall under: [AUTORITE DE CONTROLE].

10. Cookies

The site uses no advertising or audience measurement cookies. It sets only strictly necessary or preference cookies:

• session: the session cookie of your customer area, and the technical sign-in cookies that come with it (protection against request forgery, return page after sign-in);
• language: it remembers the language you chose;
• currency: it remembers the currency in which prices are displayed, for one year.

The site's fonts are served by the site itself: your browser contacts no third-party service to display them. During payment, Gumroad's pages set their own cookies, governed by Gumroad's policy.

11. Changes to this policy

We may change this policy. The applicable version is the one published on this page, dated at the top of the document.