Permutrix Privacy Policy

English#

1. Scope and controller#

Permutrix Labs ("Permutrix," "we," or "us") processes personal data in accordance with applicable privacy laws. This Policy applies to the permutrix.com website and web demo, Permutrix Desktop, product purchases, license activation, and customer support.

• Controller: Permutrix Labs (퍼뮤트릭스 랩스)
• Representative and privacy contact: Seo Jain
• Business address: 1F S73, 21 Apdok 2-ro 1-gil, Amnyang-eup, Gyeongsan-si, Gyeongsangbuk-do 38536, Republic of Korea
• Email: obistru@gmail.com
• Telephone: +82 10-3471-8911

External services such as Microsoft Store, Paddle, itch.io, Ko-fi, and Google also apply their own privacy notices to information they collect for their services.

2. Key principles#

• We do not sell personal data or disclose it for targeted advertising.
• Artwork, projects, and outputs opened in the desktop app or web demo are generally processed on the user's device. They are not automatically uploaded to Permutrix servers unless the user deliberately sends them with a support request.
• Permutrix Desktop 1.2.1 does not include advertising, behavioral analytics, or diagnostic telemetry operated by Permutrix.
• Payment is handled by the selected store or payment provider. We do not directly collect or store full payment-card numbers or card security codes.
• We process only the data needed to deliver the product, verify licenses, provide support, maintain security, handle refunds, and comply with law.

3. Data, purposes, and retention#

Website and web demo#

When the website is used, IP address, request time, requested URL, referring page, browser, operating system, device type, approximate country or region, security events, and page-performance data may be processed automatically. We use this information to deliver and protect the site, prevent abuse, diagnose failures, and understand aggregated performance and visit statistics.

Cloudflare Web Analytics measures page paths, referrers, country, browser, operating system, device type, and performance metrics without analytics cookies. We do not use this information to create individual advertising profiles. Under Cloudflare's current published practices, unsampled raw beacon data is retained for seven days before aggregation, and aggregated analytics are currently available to us for up to six months. Security and network records are processed for the periods set by Cloudflare's service settings and contract.

Prepared assets and working state in the web demo are processed in the browser. We do not intentionally collect projects made in the web demo on our servers. The ordinary website access data described above still applies.

Website preferences and cookies#

The permutrix_language cookie stores the selected language for up to one year. If set, the permutrix_country cookie is used only to suggest a suitable language based on an approximate country and is stored for up to one year. Cloudflare may set cookies that are strictly necessary for site security and traffic management. Cloudflare Web Analytics does not itself use analytics cookies.

Cookies can be deleted or blocked in browser settings. Blocking functional cookies may prevent the language choice from persisting or cause some security checks to appear again.

Purchases and licenses#

When a user purchases through Paddle, itch.io, Ko-fi, or another official store, we may receive only the information needed from the store, payment provider, or user, including:

• name, email address, and country or region;
• store, order, customer, and transaction identifiers, product, and price information;
• payment, refund, withdrawal, dispute, or chargeback status; and
• limited order metadata needed to deliver the product and prevent abuse.

We use this information to confirm purchases, deliver the product, issue, restore, and administer perpetual licenses, process refunds and disputes, and meet accounting, tax, and legal obligations.

When Permutrix Pro activation through Paddle is offered, the app may process the purchase email, a randomly generated installation identifier or device-binding token, app version, license status, last-verification time, and security access logs. Raw hardware serial numbers and user projects or images are not transmitted for license verification. A one-time email verification code becomes unusable after a short validity period, and its plaintext is not retained longer than necessary to complete verification.

Minimum license records are retained while a valid perpetual license must remain restorable. Where Korean law applies, records concerning contracts or withdrawal and payment or supply may be retained for five years, and consumer complaint or dispute records for three years. Records may be retained longer while a refund, legal dispute, or abuse investigation remains active.

Support and communications#

If a user contacts us by email or through the Google Forms support form, we may process the inquiry category, name or display name, email address, message, order, app or device details, and any screenshots, files, or links the user voluntarily provides. We use this information to respond, reproduce technical problems, support purchases and licenses, and handle disputes.

General support records are retained for up to three years after the matter is finally closed, then deleted or anonymized, unless a longer period is required by law or an active dispute. Do not send sensitive personal data, passwords, or full payment-card information.

Data stored only on the device#

Terms-acceptance records, language, theme and layout preferences, recent projects and folder permissions, autosave recovery data, render and export caches, project.json, assets, _working_cache, and exported files are stored on the device or in folders selected by the user. See the Permutrix Local Data Notice for the detailed storage and reset boundary.

On-device app data may remain until the user resets it in the app or deletes it through operating-system and file-management tools. Resetting Permutrix app data does not delete external project folders or exported files selected by the user. See the Permutrix Local Data Notice for details.

4. Legal bases#

Depending on the applicable law, we rely on:

• entering into and performing a contract to purchase, deliver, activate or restore the product and provide support;
• compliance with accounting, tax, consumer-protection, and dispute obligations;
• legitimate interests in site and license security, fraud and abuse prevention, and service reliability; and
• consent for optional processing where the law requires consent.

Consent may be withdrawn for processing based on consent. If information essential to a contract or legal obligation is not provided, the relevant feature, license restoration, or support may be unavailable.

5. External services, disclosures, processors, and international processing#

We do not sell personal data. The following services may process information only as needed for the stated purposes, and their servers or international networks may be located outside the Republic of Korea.

• Cloudflare, Inc. (United States and global network): website delivery, CDN, DNS, security, traffic management, and cookie-free web-performance analytics. Technical access, security, and performance data is transmitted over encrypted connections when the site is used and retained under Cloudflare's policies, contract, and service settings.
• Google LLC (United States and locations where Google operates): inquiries and replies through Google Forms and Gmail. Technical request information, contact details, and message contents may be transmitted when the user submits a form or email. Our support copy follows the retention period above, while Google's independent processing follows Google's policies.
• Paddle group entities and payment processors (United Kingdom, Ireland, United States, Canada, and other service locations depending on the buyer): payment, taxes, receipts, fraud prevention, refunds, and payment disputes through Paddle Checkout. Paddle processes payment, contact, and device information entered directly by the buyer as the authorized reseller and merchant of record under its own notice. We receive only limited transaction data needed for fulfillment and license administration.
• Microsoft Corporation and affiliates (United States and service locations): app distribution, installation, updates, security, and Store services through Microsoft Store. Microsoft's privacy statement applies to Microsoft account and Store information processed directly by Microsoft. We do not receive Microsoft account passwords or full payment information.
• The itch.io, Ko-fi, or payment provider selected by the user: purchase, digital delivery, receipts, refunds, and disputes. Each provider's notice applies to information entered directly into that service.

Where processing, storage, or a service provider outside Korea is necessary, we disclose the data, country, recipient, purpose, timing and method, and retention basis in this Policy and apply appropriate safeguards. We request separate consent before the transfer where applicable law requires it.

Before the Store license server or authentication-email provider is launched, we will add the provider name, processing countries, data, purpose, timing and method, and retention period to this section.

6. Deletion#

When a retention period ends or a purpose is completed, we delete or irreversibly destroy the data without undue delay unless law requires segregated retention. Electronic files are deleted using methods reasonably designed to prevent recovery, and backup copies are overwritten or deleted on the applicable backup cycle. Anonymous or aggregate data that cannot identify an individual may continue to be used.

7. Security#

We use reasonable technical and organizational measures appropriate to the nature and risk of the data, including encryption in transit, access controls, separation of credentials and secret keys, data minimization, service-provider review, security updates, and log review. No Internet transmission or storage method can be guaranteed completely secure. If an incident occurs, we follow the notification and response requirements of applicable law.

8. Automated decisions and marketing#

We do not use personal data for profiling or solely automated decisions that produce legal or similarly significant effects. The license system may mechanically reflect payment, refund, or chargeback status received from Paddle to update access to Pro features. A user may request human review of an error by contacting obistru@gmail.com.

We do not use purchase or support data for separate advertising targeting. Marketing email that requires consent is not sent without prior consent.

9. Rights and choices#

Depending on applicable law, a user may request access, correction, deletion, restriction, withdrawal of consent, objection, or portability by emailing obistru@gmail.com. We may request only the information reasonably needed to verify identity and will respond within the applicable legal period. An authorized agent may need to provide proof of authority.

A request may be limited where retention is required by law, to protect another person's rights, investigate fraud or disputes, or establish, exercise, or defend legal claims. Deleting an identifier needed to restore a perpetual license may make automatic restoration unavailable; we explain that effect before processing the request.

For information controlled directly by a store or payment provider, the user should also use that provider's privacy-request channel.

Users in Korea may contact the Personal Information Infringement Report Center at 118, or the Personal Information Dispute Mediation Committee at +82 1833-6972. Users may also complain to the competent data-protection authority where they live.

10. Children#

Permutrix is not designed for children, and we do not knowingly collect personal data from a child below the age at which parental consent is required. If we learn that such data was collected without valid consent, we will verify and delete it.

11. Changes to this Policy#

We update this Policy when features, service providers, or laws change and revise the version and effective date above. If the purpose of processing or scope of disclosure changes materially, we provide advance notice and seek consent where required. Previous versions are kept available for a reasonable period.

12. Contact#

Questions about privacy, this Policy, or a rights request may be sent to:

• Privacy contact: Seo Jain
• Email: obistru@gmail.com
• Telephone: +82 10-3471-8911
• Address: 1F S73, 21 Apdok 2-ro 1-gil, Amnyang-eup, Gyeongsan-si, Gyeongsangbuk-do 38536, Republic of Korea