Privacy Policy for oncut Apps

This is the shared privacy notice for oncut's application software (each an "app"), published at apps.oncut.gr/privacy and referred to in each app's End-User License Agreement (EULA). It explains how oncut ("oncut", "we", "us") handles personal data in connection with those apps and the purchase and support of licenses for them.

Scope: sections that describe processing specific to one app are marked with that app's name (for example, "(KeyLang)"); the remaining sections apply to all oncut apps. The app currently covered is oncut KeyLang ("SOFTWARE"), together with the oncut License Manager, the companion app that activates oncut licenses (Section 4). This notice is informational and does not form part of any EULA.

1. Who we are (data controller)

The controller responsible for the processing described in Section 3 is:

Michail Oikonomou (ΟΙΚΟΝΟΜΟΥ ΜΙΧΑΗΛ), sole proprietor, trading as "oncut"
Nikolaou Gennimata 20, 11524 Athens, Greece
Email: support@oncut.gr
Website: apps.oncut.gr (legal notice)

We have not appointed a Data Protection Officer. As a provider established in the European Union, we are not required to appoint an EU representative under Article 27 GDPR (that requirement applies to controllers not established in the Union).

2. The most important point: your typing stays on your device

KeyLang works by observing your keyboard so it can warn you when you type on the wrong layout. All of that processing happens locally on your computer, in memory, in real time. We do NOT receive, collect, transmit, or store the content of what you type, and KeyLang itself makes no network connections. License activation is done by the separate oncut License Manager and involves only the data described in Section 4. Because the content of what you type never reaches us, oncut is not a controller or processor of it; you remain in control of it on your own device.

The following are stored ONLY on your device and never sent to us:

• your settings (config.json);
• words you explicitly teach the app (learned_words.json), which may include personal terms you enter and which you can review or delete;
• the trial marker (only the day the trial started goes to the activation server, as described in Section 4);
• a diagnostic log, which records only word lengths, language codes, and error information, never the text you type.

3. Personal data we do process, and why

We process personal data only when you interact with us, principally to sell and support licenses, and to operate our website.

a) License purchase and activation

Data: your name, email address, billing country and, where required, billing address, VAT or tax identification information where you provide it, payment method type, transaction identifier, amount, currency, payment status, and invoice details. Your full payment-card details are processed by the selected payment provider and are not received or stored by oncut. Activating the license on your computer is described in Section 4.

Purpose: to provide the license and perform our agreement with you, and to keep the records we are legally required to keep.

Lawful basis: performance of a contract (Article 6(1)(b) GDPR) for issuing and validating the license; compliance with a legal obligation (Article 6(1)(c) GDPR) for invoicing, tax, and accounting records.

Retention: for the duration of the license relationship and thereafter as necessary for support, fraud prevention, and the establishment, exercise, or defence of legal claims. Accounting, invoicing, tax, and transaction records are retained for at least five (5) years from the end of the relevant reporting period, or for a longer period where required by applicable law.

Merchant of record: where a purchase is completed through Stripe Managed Payments, Stripe or Link acts as the merchant of record and is responsible for processing the payment, collecting and remitting applicable indirect taxes, handling payment-related disputes, and providing payment-related customer support. oncut processes the order and customer information it receives in order to deliver the license, provide product support, prevent misuse, and maintain legally required accounting and business records.

b) Support and correspondence

Data: your email address and the contents of messages you send us.

Purpose: to answer your questions and resolve issues.

Lawful basis: performance of a contract (Article 6(1)(b) GDPR) where support relates to your license, otherwise our legitimate interest in responding to enquiries (Article 6(1)(f) GDPR).

Retention: as long as needed to handle the matter and a reasonable period afterwards.

c) Website and cookies

When you visit apps.oncut.gr, our hosting and security providers process technical information such as your IP address, date and time of access, requested page, browser and device information, referring page, HTTP status, and security or error information. This processing is necessary for the operation, security, integrity, and troubleshooting of the website. The lawful basis is our legitimate interest in operating and protecting the website (Article 6(1)(f) GDPR).

We use Cloudflare Turnstile on forms to distinguish legitimate users from automated abuse. Turnstile processes technical and security signals and may, depending on its configuration or whether a security challenge is triggered, use strictly necessary security cookies (such as cf_clearance). This processing is necessary for the security of the website and its forms.

Where you give consent through our cookie-consent banner, we use Google Analytics 4 to obtain aggregated information about website visits and usage. Google Analytics may process information such as an online identifier, session and interaction information, approximate location, browser, device type, operating system, and referring page, and may set cookies including _ga and _ga_<measurement-id>. The lawful basis for this analytics processing is your consent (Article 6(1)(a) GDPR). Your choice is stored locally in your browser (oncut_cookie_consent) and is not transmitted to us. You may withdraw or change your consent at any time using the "Cookie settings" control in the website footer (or here), after which the consent banner is shown again; analytics is disabled as soon as you decline.

Non-essential analytics cookies are not activated unless you have given the required consent. Refusing analytics cookies does not prevent you from using the essential functions of the website. The non-essential cookies are the Google Analytics cookies described above; your consent choice itself is stored in your browser's local storage (oncut_cookie_consent), not as a cookie transmitted to us.

We use Bunny.net as a content-delivery network to deliver website video and other media. The provider may process IP addresses and request, device, security, and delivery-log information to provide and protect the content-delivery service.

We do not sell your personal data, and we do not use it for advertising.

4. License activation and the machine identifier

A license runs on a limited number of computers at the same time (usually one). To keep to that, the oncut License Manager, installed with the app, activates the license on your computer with oncut's activation server and renews that activation about once a day while the computer is online. The app itself does not connect; it checks the license and the activation offline.

Data sent: the license key, a machine identifier, and whether the computer runs Windows, macOS, or Linux, and nothing else. The license key carries the license number, the product, and its terms; it does not contain your name or email address. The machine identifier is derived from a stable value on your device (on Windows, the MachineGuid): before it leaves your computer this value is combined with a fixed, product-specific salt, put through a one-way cryptographic hash (SHA-256), and truncated, so it does not reveal your hardware, serial numbers, or any directly identifying information, and cannot be reversed back to them. Like any connection, a request also reveals your IP address to the server.

What the server keeps: for each license, whether it has been revoked and on how many computers it may run (sent by oncut, without customer details); for each activated computer, the machine identifier, its operating system (Windows, macOS, or Linux), whether the activation was online or offline, when the computer was first and last seen, and when its activation ends; and the number of times a license was deactivated in the last 30 days. It does not keep names or email addresses, which stay in oncut's own records (Section 3(a)). The license number links these records to your purchase in those records.

IP addresses are not stored with any of this. To limit abuse, the server counts requests per address in ten-minute slots, keyed by a one-way hash of the address under a key that changes daily; these counts are deleted within the hour. Our hosting provider's technical logs record requests as described in Section 3(c).

Purpose and lawful basis: activating, renewing, moving, and revoking licenses, which is part of providing the license you bought (Article 6(1)(b) GDPR); limiting abuse of the activation service, on the basis of our legitimate interest in protecting it (Article 6(1)(f) GDPR).

Retention: an activated computer's record is deleted once that computer has not been seen for twelve (12) months; deactivating a computer deletes its record at once. A license's revocation and computer-count record lasts as long as the license.

Trials

An app's trial is offered once per computer. The trial starts on your computer without a connection; the first time the computer is online, the License Manager registers it with the activation server, sending the app, the machine identifier (as above), the operating system, and the day the trial started. The first three days need no connection; after that, the trial continues only once the server has answered. A computer that is never online has no trial.

What the server keeps for each trial: the app, the machine identifier, the day the trial started and the day it ends, when the computer first and last asked, its operating system, and, if that computer later activates a license for the app, when it did. No license key, name, or email address. Purpose and lawful basis: offering each computer one trial, and counting how many trials are started and lead to a purchase, on the basis of our legitimate interest in offering trials without their being repeated and in knowing how they are used (Article 6(1)(f) GDPR). Retention: a trial's record is deleted twelve (12) months after its computer last asked, and never while the trial runs.

If the License Manager cannot reach the server, nothing is sent; the app keeps working until the current activation ends. A computer that is never online can be activated through support (see the License Manager help): the License Manager saves a request file holding the same data (license key, machine identifier, operating system), you email it to us, and we obtain the activation from the server and email you back an answer file. That correspondence is handled as described in Section 3(b), and the activation is kept as described above.

5. Recipients and service providers

We disclose personal data only where necessary to operate the website, process purchases, issue licenses, provide support, comply with legal obligations, and protect against fraud or misuse.

Depending on the service and the processing activity, the following providers may process personal data either on our behalf as data processors or for their own purposes as independent data controllers:

• Stripe and Link, where Stripe Managed Payments is used, Stripe or its affiliated Link service acts as the merchant of record for the transaction and processes payment, billing, tax, fraud-prevention, dispute, invoicing, refund, and customer-support information in accordance with its own privacy notice, and may act as an independent data controller for these activities. oncut receives only the transaction, customer, and order information necessary to fulfil the purchase, issue the software license, provide product support, and maintain legally required business records;
• Pointer (pointer.gr), for website hosting, hosting of the license activation server (Section 4), hosting of the oncut.gr email mailboxes used for support correspondence, server security, and technical logs;
• Google Analytics (Google), where you consent to analytics cookies, for measuring website traffic and use;
• Cloudflare, for website and form security, including Cloudflare Turnstile;
• Bunny.net, for the delivery of website media content.

Payment providers receive and process payment and transaction information in accordance with their own privacy notices. oncut does not receive or store your full payment-card number or card security code.

We may also disclose personal data to professional advisers, public authorities, courts, tax authorities, or law-enforcement bodies where this is required by law or reasonably necessary to establish, exercise, or defend legal claims.

We do not sell your personal data.

6. International data transfers

We operate from Greece and may offer the SOFTWARE to customers worldwide.

Some of the service providers identified in Section 5 operate internationally or may process or make personal data accessible from countries outside the European Economic Area ("EEA"). These countries may not provide the same level of data protection as the country in which you reside.

Where personal data protected by the GDPR is transferred outside the EEA, we rely on an applicable lawful transfer mechanism, which may include:

• a decision by the European Commission recognising that the recipient country provides an adequate level of protection;
• the European Commission's Standard Contractual Clauses;
• the EU-U.S. Data Privacy Framework, where the recipient is currently certified and the framework is applicable; or
• another transfer mechanism or permitted derogation provided by applicable data-protection law.

Our payment, analytics, security, hosting, email, and content-delivery providers may use infrastructure or subprocessors located outside the EEA. Further information about their international-transfer safeguards is available in their respective privacy notices and contractual data-protection terms.

You may contact us at support@oncut.gr to request further information about the safeguard applicable to a particular transfer and, where available, a copy of the relevant contractual safeguard. Certain commercial or security information may be redacted.

7. Your rights

Subject to the conditions in applicable data-protection law, you have the right to: access your personal data; have it corrected; have it erased; restrict or object to its processing; data portability; and, where processing is based on consent, to withdraw that consent at any time without affecting prior processing. To exercise any of these, contact us at support@oncut.gr.

You also have the right to lodge a complaint with a supervisory authority. In Greece this is the Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα), dpa.gr. You may also contact the authority in your country of residence.

8. Automated decision-making

We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects.

9. Security

We apply appropriate technical and organisational measures to protect personal data. On your device, KeyLang stores its trial marker using the Windows Data Protection API (DPAPI, bound to your Windows user), verifies license keys and activations with public-key cryptography, and never transmits the content of what you type. The License Manager talks to the activation server over an encrypted connection (HTTPS) only.

10. Children

The SOFTWARE is a productivity tool for general audiences and is not directed at children, and we do not knowingly collect personal data from children.

11. Changes to this policy

We may update this Privacy Policy from time to time. The version number and effective date at the top indicate the current version; material changes will be notified by appropriate means, such as a notice on apps.oncut.gr.

12. Contact

Questions about this Policy or your personal data:

Michail Oikonomou, trading as "oncut"
Email: support@oncut.gr
apps.oncut.gr (legal notice)