Privacy policy

1. Controller

The controller for processing personal data on this website is Jörg Huelmann, sole proprietor trading as StormStag Studios, Bahnhofstraße 15, 72793 Pfullingen, Germany.

Contact for privacy and support requests: support@stormstagstudios.com. Phone: +49 176 64921715.

2. Hosting and website visits

This website is hosted on servers operated by IONOS SE. When you visit the website, IONOS processes technically necessary connection data. This may include IP address, date and time, requested URL, amount of data transferred, browser type and operating system, and the previous page (referrer).

This data is used to deliver the site, keep it stable, and prevent abuse. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in operating the site securely).

We do not use this for advertising analytics or visitor tracking. Server logs are usually kept only briefly and then deleted or anonymised, unless a longer retention is needed to investigate incidents or abuse.

3. Cookies, fonts, and local settings

This website does not use tracking cookies, advertising cookies, or analytics tools (no Google Analytics, no Meta Pixel, no consent banner for ad tracking).

Language (German/English) is selected via the URL (/de, /en), not via a tracking cookie.

Fonts are loaded with next/font and served from this website. The browser does not request Google’s servers for those fonts.

When you click “Buy” for Aurelix Workspaces, Paddle’s checkout overlay is loaded. Paddle may then set technically necessary cookies and process connection data. That overlay is not loaded merely by visiting the website.

On the support page we load Cloudflare Turnstile (see section 5). Cloudflare may then process technically necessary data. That widget is not loaded on the other pages.

4. Newsletter (double opt-in)

When you sign up, we store your encrypted email address, documented consent, subscription status, and the timestamps of the request and confirmation in a PostgreSQL database on our server. The confirmation token is stored only as a hash and is valid for 24 hours.

After signing up, we use Resend (Plus Five Five, Inc., USA) to send a confirmation email with a link and subsequent newsletter emails. Resend processes the data provided for this purpose on our behalf as a processor. We have concluded a data processing agreement with Resend in accordance with Article 28 GDPR. Your address is only treated as confirmed and may only be used for the newsletter after you click that link. The email address is required for the subscription; without it, we cannot send the newsletter. We also receive a short internal notice at support@stormstagstudios.com so new sign-ups and confirmations are visible.

The legal basis is Art. 6(1)(a) GDPR (consent). You may withdraw consent at any time with future effect using the unsubscribe link in every newsletter email or by writing to support@stormstagstudios.com. We do not use automated decision-making, including profiling.

5. Support contact

You can contact us via the form on the support page or by email at support@stormstagstudios.com. The form processes your name, email address, topic, message, and optionally a company name so we can reply. Those details are delivered by email via Resend to support@stormstagstudios.com.

To prevent abuse we use Cloudflare Turnstile (Cloudflare, Inc.) on the support page. A challenge token and technical details such as IP address and browser data may be sent to Cloudflare. The widget is loaded only on the support page. The legal basis for Turnstile is Art. 6(1)(f) GDPR (legitimate interest in blocking automated requests). We have a data processing agreement with Cloudflare. Cloudflare’s notice: https://www.cloudflare.com/privacypolicy/

The legal basis for handling the request is Art. 6(1)(b) GDPR (pre-contractual/contractual communication) or Art. 6(1)(f) GDPR (legitimate interest in handling requests). We delete messages when they are no longer needed for that purpose, unless a legal retention duty applies.

6. Purchasing Aurelix Workspaces via Paddle

Purchases of Aurelix Workspaces are processed by Paddle as merchant of record (Paddle.com Market Ltd and affiliated companies). The checkout overlay is loaded only when you click “Buy”.

Paddle processes payment and customer data (for example name, email address, billing address, payment details, and transaction status) as an independent controller. Paddle’s privacy notice applies: https://www.paddle.com/legal/privacy

After a successful payment we receive the details needed to fulfil the contract, in particular the transaction ID and the customer email address, so we can issue and deliver the license key. The legal basis is Art. 6(1)(b) GDPR (performance of a contract).

When you make the two declarations before purchase, we store a random consent ID, language, terms version, version and wording of the withdrawal declaration, and the server-side acceptance time. After successful payment, we associate the transaction ID and customer email address and store when the confirmation email was sent. This is used to perform the contract and evidence the declarations required by law; the legal bases are Art. 6(1)(b), (c), and (f) GDPR.

Paddle may transfer personal data to third countries, in particular the United States. According to Paddle, this is based on appropriate safeguards, in particular EU Standard Contractual Clauses.

7. License keys and device activation

After purchase we generate a license key in the format ALX-XXXX-XXXX-XXXX-XXXX. In our database we store the key only as a hash and in encrypted form, together with the Paddle transaction ID and the status (active or refunded). The plaintext key is shown once on the thank-you page after purchase and is also emailed via Resend to the address collected by Paddle. We attach Paddle's seller invoice as a PDF to that email.

When you activate the key in Aurelix Workspaces under “About Aurelix”, or when the app later checks the license, the application sends the key, a device fingerprint (64-character hex value), and optionally a machine name to our servers. The fingerprint identifies the device for activation; it does not include your workspace data.

The purpose is contract performance and abuse prevention. A license may typically be activated on two devices. The legal basis is Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR (legitimate interest in limiting sharing of a single license).

Workspace data, notes, and other working content are not transmitted in that process.

8. Desktop software (Aurelix, DeskNotes, QuickTasks)

Our Windows apps are local desktop programs. Core features do not require an account or a cloud service.

Aurelix Workspaces stores workspace data locally on your computer (including under %LOCALAPPDATA%\Aurelix). DeskNotes stores notes locally. QuickTasks stores launcher entries locally.

That local data stays on your device. Exception for Aurelix Workspaces: if you activate a license key or the license is checked, only the activation data described in section 7 is sent to us. We do not retrieve workspace content.

Downloading the Windows installer (trial or purchase) creates the usual connection record at the host (see section 2). We do not collect an email address for the 10-day trial. After you accept the terms, we store the language, terms version, acceptance timestamp, and a random download token to technically authorise the trial download. The token exists only in a technically necessary cookie, is valid for ten minutes, and is deleted after the one-time download. Expired records are deleted during subsequent technical authorisation requests. We also receive a short internal notice at support@stormstagstudios.com for downloads and purchases (software, event type, and IP address, no payment details).

9. Videos and media

Product videos and images are served from this website or our hosting, not from YouTube or similar third-party platforms. Playback creates the usual technical connection record at the host (see section 2).

10. Recipients and third countries

Recipients may include IONOS SE for hosting, the database, the email mailbox, and technically necessary logs; Paddle for payment processing (see section 6); Resend (Plus Five Five, Inc., USA) for newsletter, support, purchase, and notice emails; and Cloudflare, Inc. for Turnstile on the support page (see section 5). The email sending region is Ireland (eu-west-1).

Resend stores account data, email metadata, logs, and API records in the United States regardless of the selected sending region. According to Resend, appropriate safeguards apply to the transfer, in particular EU Standard Contractual Clauses and participation in the EU-US Data Privacy Framework.

Paddle may transfer payment and customer data to third countries, in particular the United States. According to Paddle, appropriate safeguards apply, in particular EU Standard Contractual Clauses. Details: https://www.paddle.com/legal/privacy

Cloudflare may transfer Turnstile data to third countries, in particular the United States. According to Cloudflare, appropriate safeguards apply, in particular EU Standard Contractual Clauses and participation in the EU-US Data Privacy Framework.

11. Retention

Server logs: only as long as needed for operation and security.

Support messages: until the request is resolved, then deletion or archiving only where legally required.

Newsletter: until you withdraw consent. Unconfirmed sign-ups are automatically deleted once the 24-hour confirmation token expires.

License and purchase data (key hash, encrypted key, transaction ID, email, status): for the term of the license contract or until a refund; after a refund the license is marked refunded and can no longer be activated. Evidence of acceptance of the terms and withdrawal declaration is retained for the term of the contract and afterwards only where statutory retention or limitation periods require it. Device fingerprints and machine names are kept only for as long as the relevant activation exists.

12. Your rights

Where we process personal data, you have the GDPR rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection (Art. 21). You may withdraw consent at any time with effect for the future.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your residence, workplace, or the alleged infringement. Our competent authority is the Baden-Württemberg Commissioner for Data Protection and Freedom of Information.

13. Changes

We update this policy when the website, newsletter, purchase process, or services we use change. The current version is shown at the top of this page.