This notice covers our software — what happens after you install a program of ours. For your visit to this shop, your order, your account and payment, see the shop privacy policy.
1. Controller
Peter Bauch, Autenova
Waldstraße 15
04105 Leipzig
Germany
E-mail: support@autenova.com
2. What the software transmits
Software of ours that unlocks a paid tier or fetches updates contacts our server to do so. What it sends is:
- the licence key,
- an installation identifier — a derived value that makes your installation recognisable without naming it,
- the address of the installation (the website address the software runs on),
- the version numbers of the program and of the environment it runs in (for WordPress extensions: the program, WordPress and PHP versions).
Nothing else. No content, no usage or behavioural data, and no data about your own visitors is transmitted. The software does not keep count of what you do with it.
Fetching an update additionally creates a connection to our server — as any file download does — in the course of which your IP address occurs.
3. Why, and on what basis
| Verifying entitlement, unlocking paid features, delivering updates and support | Art. 6(1)(b) GDPR — performance of the contract you entered into with us. Without this data there is no way to tell whether an installation belongs to a current licence. |
|---|---|
| Rate-limiting requests per key, detecting plainly abusive use | Art. 6(1)(f) GDPR — our legitimate interest in operating the licence service safely, and in a published key not coming at the expense of everyone else. |
| Retention of invoices and contract records | Art. 6(1)(c) GDPR — statutory retention obligations under German law (§ 147 AO, § 257 HGB). |
We do not ask for your consent to any of this, and none is required. Accepting our terms of use is not a data protection consent.
4. What is stored, and for how long
For each activated installation we store the installation identifier, the address of the installation, the time of the first and the most recent contact, and the version numbers last reported. Alongside that, the licence itself and the order it belongs to.
- Activations are deleted when you release the activation — which you can do at any time yourself — and at the latest when the licence ends and is not renewed.
- Licence data is kept for the duration of the contractual relationship and beyond it for as long as claims may arise from it.
- Invoices and accounting records are subject to statutory retention periods of up to ten years. Such data is restricted for the duration of the retention period and not used for any other purpose.
- Server logs occur as a technical necessity of operation, are not analysed, and are kept only for as long as secure operation requires.
Where data is needed beyond performance of the contract — for debugging or statistics, say — we use it only in anonymised or aggregated form, with no reference to any particular person, installation or customer.
5. Who receives the data
The licence service runs on our own webspace with our hosting provider, who acts as a processor on our behalf in that respect (contract under Art. 28 GDPR). The same applies to the sending of e-mail.
Beyond that we do not pass this data on. It is not sold, not rented out, not used for advertising, not combined into profiles, and not used to train AI models. There is no transfer to countries outside the EU.
Purchase and payment are handled by Paddle as the seller (“merchant of record”). That is a separate process with a separate contracting party; it is described in the shop privacy policy.
6. If our server is unreachable
If the check fails because our server does not answer, the licence is treated as valid. A fault on our side does not cost your installation any functionality — and it does not cause us to collect more data either.
7. Your rights
In relation to us you have the right of access to the data stored about you (Art. 15 GDPR), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18) and to data portability (Art. 20).
Right to object: where we process data on the basis of our legitimate interest (section 3, second row), you may object to that processing under Art. 21 GDPR on grounds relating to your particular situation.
An informal message to support@autenova.com is enough for any of these.
If you are unhappy with how we handle your data, please tell us first — the same address will do, and we answer within one month.
Independently of that, and without having to contact us beforehand, you may lodge a complaint with a data protection supervisory authority (Art. 77 GDPR) — for instance the authority where you live, where you work, or where the alleged infringement took place.
8. What the terms of use say
This notice states what we process and why. In addition, we have committed ourselves contractually in § 10 of the terms of use to a particular way of handling your data — data minimisation, anonymisation instead of retention, no secondary use, deletion when the contract ends. Those commitments sit alongside this notice; they do not replace it.