Permutrix Privacy Policy

English#

1. Scope and controller#

Permutrix Labs ("Permutrix," "we," or "us") processes personal data in accordance with applicable privacy laws. This Policy applies to the permutrix.com website and browser demo, Permutrix for Microsoft Store, the previously distributed standalone Permutrix Desktop, product purchases, license activation, purchase recovery, and customer support. On-device storage is described in the data notice for the relevant edition.

• Controller: Permutrix Labs (퍼뮤트릭스 랩스)
• Representative and privacy contact: Seo Jain
• Business address: 1F S73, 21 Apdok 2-ro 1-gil, Amnyang-eup, Gyeongsan-si, Gyeongsangbuk-do 38536, Republic of Korea
• Email: obistru@gmail.com
• Telephone: +82 10-3471-8911

External services such as Microsoft Store, Paddle, itch.io, Ko-fi, and Google also apply their own privacy notices to information they collect for their services.

2. Key principles#

• We do not sell personal data or disclose it for targeted advertising.
• Artwork, projects, and outputs opened in the desktop app or web demo are generally processed on the user's device. They are not automatically uploaded to Permutrix servers unless the user deliberately sends them with a support request.
• The previously distributed standalone Permutrix Desktop 1.2.1 does not include advertising, behavioral analytics, or diagnostic telemetry operated by Permutrix.
• Payment is handled by the selected store or payment provider. We do not directly collect or store full payment-card numbers or card security codes.
• We process only the data needed to deliver the product, verify licenses, provide support, maintain security, handle refunds, and comply with law.

3. Data, purposes, and retention#

Website and web demo#

When the website is used, IP address, request time, requested URL, referring page, browser, operating system, device type, approximate country or region, security events, and page-performance data may be processed automatically. We use this information to deliver and protect the site, prevent abuse, diagnose failures, and understand aggregated performance and visit statistics.

Cloudflare Web Analytics measures page paths, referrers, country, browser, operating system, device type, and performance metrics without analytics cookies. We do not use this information to create individual advertising profiles. Under Cloudflare's current published practices, unsampled raw beacon data is retained for seven days before aggregation, and aggregated analytics are currently available to us for up to six months. Security and network records are processed for the periods set by Cloudflare's service settings and contract.

Sample materials and project working state in the browser demo are processed in your browser. Projects, images, and outputs used in the demo are not automatically uploaded to Permutrix servers. Some working state and preferences may remain in browser storage, and saving a project or exporting outputs downloads files to your device. The demo on our website and the demo embedded on itch.io use separate browser-storage areas for their respective site origins. Clearing browser data does not delete ZIP projects or images already downloaded. See the Browser Data Notice for storage and deletion details. The website access-data description above still applies.

Website preferences and cookies#

The permutrix_language cookie stores the selected language for up to one year. If set, the permutrix_country cookie is used to suggest a suitable language based on an approximate country and is stored for up to six hours. Cloudflare may set cookies that are strictly necessary for site security and traffic management. Cloudflare Web Analytics does not itself use analytics cookies.

Cookies can be deleted or blocked in browser settings. Blocking functional cookies may prevent the language choice from persisting or cause some security checks to appear again.

Purchases and licenses#

For current Pro purchases or support for earlier Desktop orders, we may receive only the information needed from the store, payment provider, or user, including:

• name, email address, and country or region;
• store, order, customer, and transaction identifiers, product, and price information;
• payment, refund, withdrawal, dispute, or chargeback status; and
• limited order metadata needed to deliver the product and prevent abuse.

We use this information to confirm purchases, deliver the product, issue, restore, and administer perpetual licenses, process refunds and disputes, and meet accounting, tax, and legal obligations.

Pro purchases for Permutrix for Microsoft Store start in the app and are processed as a one-time payment through Paddle Checkout. License activation and purchase recovery may use the purchase email, limited order and transaction information, a randomly generated installation identifier, tokens or verification hashes needed to authenticate requests and bind an installation, license status and verification times, and security access information. Original hardware serial numbers and user projects or images are not transmitted for license verification. We use Cloudflare Workers and D1 for the necessary license and purchase-recovery processing, and Cloudflare Email Service to send purchase-recovery verification emails.

The verification database stores a verification hash and expiry information rather than the plaintext one-time code. A code cannot be used again after it expires or is consumed; this validity limit is separate from the retention of data copies. Cloudflare Email Service's currently enabled email-preview feature retains a copy of the sent email body, including the code, for about seven days. Expiry or use of the code does not immediately delete that email copy.

Minimum license records are retained while a valid perpetual license must remain restorable. Where Korean law applies, records concerning contracts or withdrawal and payment or supply may be retained for five years, and consumer complaint or dispute records for three years. Records may be retained longer while a refund, legal dispute, or abuse investigation remains active.

Support and communications#

If a user contacts us by email or through the Google Forms support form, we may process the inquiry category, name or display name, email address, message, order, app or device details, and any screenshots, files, or links the user voluntarily provides. We use this information to respond, reproduce technical problems, support purchases and licenses, and handle disputes.

General support records are retained for up to three years after the matter is finally closed, then deleted or anonymized, unless a longer period is required by law or an active dispute. Do not send sensitive personal data, passwords, or full payment-card information.

Data stored only on the device#

Storage of license-assent records, language, theme and layout preferences, recent-project information, recovery data, caches, projects, and exported files differs by edition. See the Store Local Data Notice for on-device data, licensing, and purchase recovery in the Microsoft Store edition; the Browser Data Notice for browser storage and ZIP project downloads; and the Desktop Local Data Notice for the previously distributed standalone Desktop 1.2.1.

External project folders, downloaded files, and exported outputs outside the scope of an app reset or browser-data clearing may remain until you delete them separately. Check the notice for your edition for its actual reset and deletion scope.

4. Legal bases#

Depending on the applicable law, we rely on:

• entering into and performing a contract to purchase, deliver, activate or restore the product and provide support;
• compliance with accounting, tax, consumer-protection, and dispute obligations;
• legitimate interests in site and license security, fraud and abuse prevention, and service reliability; and
• consent for optional processing where the law requires consent.

Consent may be withdrawn for processing based on consent. If information essential to a contract or legal obligation is not provided, the relevant feature, license restoration, or support may be unavailable.

5. External services, disclosures, processors, and international processing#

We do not sell personal data. The following services may process information only as needed for the stated purposes, and their servers or international networks may be located outside the Republic of Korea.

• Cloudflare, Inc.: used for website delivery, CDN, DNS, security, traffic management, and cookie-free web-performance analytics. We also use Cloudflare Workers and D1 to process and store the email, limited order, transaction and license status, installation identifiers, authentication-request information, and verification hashes needed for Store-edition purchases, license activation, and purchase recovery. Cloudflare Email Service sends purchase-recovery verification emails. Processing may include technical access and security information needed for these functions. Retention of sent-email preview copies is described in the purchases and licenses section above.
• Google LLC (United States and locations where Google operates): inquiries and replies through Google Forms and Gmail. Technical request information, contact details, and message contents may be transmitted when the user submits a form or email. Our support copy follows the retention period above, while Google's independent processing follows Google's policies.
• Paddle group entities and payment processors (United Kingdom, Ireland, United States, Canada, and other service locations depending on the buyer): payment, taxes, receipts, fraud prevention, refunds, and payment disputes through Paddle Checkout. Paddle processes payment, contact, and device information entered directly by the buyer as the authorized reseller and merchant of record under its own notice. We receive only limited transaction data needed for fulfillment and license administration.
• Microsoft Corporation and affiliates (United States and service locations): app distribution, installation, updates, security, and Store services through Microsoft Store. Microsoft's privacy statement applies to Microsoft account and Store information processed directly by Microsoft. We do not receive Microsoft account passwords or full payment information.
• itch.io, Ko-fi, and the payment provider for an earlier transaction: digital delivery, receipts, support, refunds, and disputes for past purchases. Each provider's notice applies to information entered directly into that service. This entry does not identify an active channel for new app sales.

Where processing, storage, or a service provider outside Korea is necessary, we disclose the data, country, recipient, purpose, timing and method, and retention basis in this Policy and apply appropriate safeguards. We request separate consent before the transfer where applicable law requires it.

6. Deletion#

When a retention period ends or a purpose is completed, we delete or irreversibly destroy the data without undue delay unless law requires segregated retention. Electronic files under our control are deleted using methods reasonably designed to prevent recovery. External-service logs, email previews, and provider-held copies are also subject to the relevant service settings, contract, retention practices, and applicable law; deleting operational data does not mean that every provider-held copy is immediately deleted. Anonymous or aggregate data that cannot identify an individual may continue to be used.

7. Security#

We use reasonable technical and organizational measures appropriate to the nature and risk of the data, including encryption in transit, access controls, separation of credentials and secret keys, data minimization, service-provider review, security updates, and log review. No Internet transmission or storage method can be guaranteed completely secure. If an incident occurs, we follow the notification and response requirements of applicable law.

8. Automated decisions and marketing#

The license system may automatically reflect payment, refund, or chargeback status received from Paddle to update access to Pro features. You may request human review at obistru@gmail.com if the result appears incorrect or you need an explanation or review. Your rights concerning automated processing and objections under applicable law remain unaffected.

We do not use purchase or support data for separate advertising targeting. Marketing email that requires consent is not sent without prior consent.

9. Rights and choices#

Depending on applicable law, a user may request access, correction, deletion, restriction, withdrawal of consent, objection, or portability by emailing obistru@gmail.com. We may request only the information reasonably needed to verify identity and will respond within the applicable legal period. An authorized agent may need to provide proof of authority.

A request may be limited where retention is required by law, to protect another person's rights, investigate fraud or disputes, or establish, exercise, or defend legal claims. Deleting an identifier needed to restore a perpetual license may make automatic restoration unavailable; we explain that effect before processing the request.

For information controlled directly by a store or payment provider, the user should also use that provider's privacy-request channel.

Users in Korea may contact the Personal Information Infringement Report Center at 118, or the Personal Information Dispute Mediation Committee at +82 1833-6972. Users may also complain to the competent data-protection authority where they live.

10. Children#

Permutrix is not designed for children, and we do not knowingly collect personal data from a child below the age at which parental consent is required. If we learn that such data was collected without valid consent, we will verify and delete it.

11. Changes to this Policy#

We update this Policy when features, service providers, or laws change and revise the version and effective date above. If the purpose of processing or scope of disclosure changes materially, we provide advance notice and seek consent where required. Previous versions are kept available for a reasonable period.

12. Contact#

Questions about privacy, this Policy, or a rights request may be sent to:

• Privacy contact: Seo Jain
• Email: obistru@gmail.com
• Telephone: +82 10-3471-8911
• Address: 1F S73, 21 Apdok 2-ro 1-gil, Amnyang-eup, Gyeongsan-si, Gyeongsangbuk-do 38536, Republic of Korea