Legal
Short version: we store the minimum needed to run your account and licenses, we don't run analytics or marketing, and we never sell data. Last updated 12 July 2026.
The controller of your personal data is dB Records sp. z o.o., ul. Belwederska 20/22, 00-762 Warszawa, Poland (NIP 5214091043, KRS 0001134383). Contact: contact@dbapps.co.
Account: e-mail address and a password hash (bcrypt); needed to run your account and show your licenses (contract performance, art. 6(1)(b) GDPR).
Licenses: buyer name, e-mail, product, license identifiers; needed to issue, verify and (in case of refund) revoke licenses (contract performance; legal obligations for accounting).
Contact & support: messages you send via the contact form or support tickets, with your name and e-mail; used solely to reply (legitimate interest / contract).
Waitlist: e-mail and product; used only to write to you once about that product's availability (consent; you can withdraw any time).
Technical logs: standard server logs (IP, time, URL) kept by our hosting for security and abuse prevention (legitimate interest). Our license API receives an anonymous machine identifier during activation checks; it is not linked to browsing.
We set three first-party cookies: a session cookie (keeps you logged in), a CSRF token (protects forms) and one that remembers your answer to the analytics question. No advertising cookies, ever. Analytics is opt-in — nothing is loaded and nothing is sent unless you accept, and you can change your mind at any time. Full details, including names and durations, are in our Cookie Policy.
Data is processed on servers of OVH (hosting, EU). If you buy through our payment provider Paddle (Paddle.com Market Ltd, acting as merchant of record), Paddle processes your payment data under its own privacy policy. We never see card numbers. We do not sell or share data with anyone else.
Account data: while the account exists. License records: for the life of the license plus statutory accounting periods. Contact/support threads: up to 2 years after the last message. Waitlist: until launch contact or withdrawal. Logs: up to 12 months.
You may request access, rectification, erasure, restriction, portability, and object to processing. Write to contact@dbapps.co; we reply to privacy requests within one month. You may also lodge a complaint with the Polish supervisory authority (Prezes UODO, ul. Stawki 2, Warszawa).
Data stays in the EU: the site runs on OVH servers here, and our analytics processor (PostHog) runs on EU servers too. We self-host our fonts, so ordinary browsing talks only to our server. Two things reach outside it, and only when you trigger them: analytics, which loads only if you accept it and which we can see anonymously or tied to your account id — never your e-mail; and Paddle's secure checkout, which loads when you click Buy and sets its own cookies under its own policy. You can change your analytics choice at any time on the Cookies page. Passwords are hashed, sessions are HttpOnly cookies over HTTPS, and license keys are cryptographically signed. No automated decision-making takes place. If a data breach ever puts you at risk, we will notify you and UODO as the GDPR requires.