Privacy Policy for oncut Apps

This is the shared privacy notice for oncut's application software (each an "app"), published at apps.oncut.gr/privacy and referred to in each app's End-User License Agreement (EULA). It explains how oncut ("oncut", "we", "us") handles personal data in connection with those apps and the purchase and support of licenses for them.

Scope: sections that describe processing specific to one app are marked with that app's name (for example, "(KeyLang)"); the remaining sections apply to all oncut apps. The app currently covered is oncut KeyLang ("SOFTWARE"). This notice is informational and does not form part of any EULA.

1. Who we are (data controller)

The controller responsible for the processing described in Section 3 is:

Michail Oikonomou (ΟΙΚΟΝΟΜΟΥ ΜΙΧΑΗΛ), sole proprietor, trading as "oncut"
Nikolaou Gennimata 20, 11524 Athens, Greece
Email: support@oncut.gr
Website: www.oncut.gr

We have not appointed a Data Protection Officer. As a provider established in the European Union, we are not required to appoint an EU representative under Article 27 GDPR (that requirement applies to controllers not established in the Union).

2. The most important point: your typing stays on your device

KeyLang works by observing your keyboard so it can warn you when you type on the wrong layout. All of that processing happens locally on your computer, in memory, in real time. We do NOT receive, collect, transmit, or store the content of what you type, and KeyLang makes no automatic network connections. Because that content never reaches us, oncut is not a controller or processor of it; you remain in control of it on your own device.

The following are stored ONLY on your device and never sent to us:

• your settings (config.json);
• words you explicitly teach the app (learned_words.json), which may include personal terms you enter and which you can review or delete;
• the trial marker and a machine-specific identifier (see Section 4);
• a diagnostic log, which records only word lengths, language codes, and error information, never the text you type.

3. Personal data we do process, and why

We process personal data only when you interact with us, principally to sell and support licenses, and to operate our website.

a) License purchase and activation

Data: your name, email address, billing country and, where required, billing address, VAT or tax identification information where you provide it, payment method type, transaction identifier, amount, currency, payment status, invoice details, and the machine identifier (Section 4) where you request a machine-locked license. Your full payment-card details are processed by the selected payment provider and are not received or stored by oncut.

Purpose: to provide the license and perform our agreement with you, and to keep the records we are legally required to keep.

Lawful basis: performance of a contract (Article 6(1)(b) GDPR) for issuing and validating the license; compliance with a legal obligation (Article 6(1)(c) GDPR) for invoicing, tax, and accounting records.

Retention: for the duration of the license relationship and thereafter as necessary for support, fraud prevention, and the establishment, exercise, or defence of legal claims. Accounting, invoicing, tax, and transaction records are retained for at least five (5) years from the end of the relevant reporting period, or for a longer period where required by applicable law.

Merchant of record: where a purchase is completed through Stripe Managed Payments, Stripe or Link acts as the merchant of record and is responsible for processing the payment, collecting and remitting applicable indirect taxes, handling payment-related disputes, and providing payment-related customer support. oncut processes the order and customer information it receives in order to deliver the license, provide product support, prevent misuse, and maintain legally required accounting and business records.

b) Support and correspondence

Data: your email address and the contents of messages you send us.

Purpose: to answer your questions and resolve issues.

Lawful basis: performance of a contract (Article 6(1)(b) GDPR) where support relates to your license, otherwise our legitimate interest in responding to enquiries (Article 6(1)(f) GDPR).

Retention: as long as needed to handle the matter and a reasonable period afterwards.

c) Website and cookies

When you visit apps.oncut.gr, our hosting and security providers process technical information such as your IP address, date and time of access, requested page, browser and device information, referring page, HTTP status, and security or error information. This processing is necessary for the operation, security, integrity, and troubleshooting of the website. The lawful basis is our legitimate interest in operating and protecting the website (Article 6(1)(f) GDPR).

We do not sell your personal data, and we do not use it for advertising.

4. The machine identifier

If you request a license locked to a specific computer ("node-locked"), KeyLang derives a machine identifier from a stable value on your device (the Windows MachineGuid). Before it ever leaves your computer this value is combined with a fixed salt and put through a one-way cryptographic hash (SHA-256) and truncated, so the identifier we receive does not reveal your hardware, serial numbers, or any directly identifying information, and cannot be reversed back to them. We use it solely to issue a license bound to that machine and to validate that license on it. The trial version computes a similar identifier that stays on your device and is never sent to us.

5. Recipients and service providers

We disclose personal data only where necessary to operate the website, process purchases, issue licenses, provide support, comply with legal obligations, and protect against fraud or misuse.

Depending on the service and the processing activity, the following providers may process personal data either on our behalf as data processors or for their own purposes as independent data controllers:

• Stripe and Link, where Stripe Managed Payments is used, Stripe or its affiliated Link service acts as the merchant of record for the transaction and processes payment, billing, tax, fraud-prevention, dispute, invoicing, refund, and customer-support information in accordance with its own privacy notice, and may act as an independent data controller for these activities. oncut receives only the transaction, customer, and order information necessary to fulfil the purchase, issue the software license, provide product support, and maintain legally required business records;
• Pointer (pointer.gr), for website hosting, hosting of the oncut.gr email mailboxes used for support correspondence, server security, and technical logs;

Payment providers receive and process payment and transaction information in accordance with their own privacy notices. oncut does not receive or store your full payment-card number or card security code.

We may also disclose personal data to professional advisers, public authorities, courts, tax authorities, or law-enforcement bodies where this is required by law or reasonably necessary to establish, exercise, or defend legal claims.

We do not sell your personal data.

6. International data transfers

We operate from Greece and may offer the SOFTWARE to customers worldwide.

Some of the service providers identified in Section 5 operate internationally or may process or make personal data accessible from countries outside the European Economic Area ("EEA"). These countries may not provide the same level of data protection as the country in which you reside.

Where personal data protected by the GDPR is transferred outside the EEA, we rely on an applicable lawful transfer mechanism, which may include:

• a decision by the European Commission recognising that the recipient country provides an adequate level of protection;
• the European Commission's Standard Contractual Clauses;
• the EU-U.S. Data Privacy Framework, where the recipient is currently certified and the framework is applicable; or
• another transfer mechanism or permitted derogation provided by applicable data-protection law.

Our payment, hosting, and email providers may use infrastructure or subprocessors located outside the EEA. Further information about their international-transfer safeguards is available in their respective privacy notices and contractual data-protection terms.

You may contact us at support@oncut.gr to request further information about the safeguard applicable to a particular transfer and, where available, a copy of the relevant contractual safeguard. Certain commercial or security information may be redacted.

7. Your rights

Subject to the conditions in applicable data-protection law, you have the right to: access your personal data; have it corrected; have it erased; restrict or object to its processing; data portability; and, where processing is based on consent, to withdraw that consent at any time without affecting prior processing. To exercise any of these, contact us at support@oncut.gr.

You also have the right to lodge a complaint with a supervisory authority. In Greece this is the Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα), dpa.gr. You may also contact the authority in your country of residence.

8. Automated decision-making

We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects.

9. Security

We apply appropriate technical and organisational measures to protect personal data. On your device, KeyLang stores its trial marker using the Windows Data Protection API (DPAPI, bound to your Windows user), verifies license keys with public-key cryptography, and never transmits the content of what you type.

10. Children

The SOFTWARE is a productivity tool for general audiences and is not directed at children, and we do not knowingly collect personal data from children.

11. Changes to this policy

We may update this Privacy Policy from time to time. The version number and effective date at the top indicate the current version; material changes will be notified by appropriate means, such as a notice on apps.oncut.gr.

12. Contact

Questions about this Policy or your personal data:

Michail Oikonomou, trading as "oncut"
Email: support@oncut.gr
www.oncut.gr