Privacy, in
plain language.

1. Who is responsible

[[FOUNDER: legal name]] (“we”, “us”) is the controller for the personal data described in this notice, which covers the DiskHalo desktop app, diskhalo.com, licence sign-in and our emails.

Registered address

[[FOUNDER: registered address]]

Privacy questions and requests

[email protected]

2. What stays on your computer

Scanning, analysis, previews, duplicate detection, cleanup and cleanup history all run on your computer. File names, paths, contents, scan results and your list of installed apps are not sent to us.

If you choose to connect a network or remote storage location, DiskHalo connects from your computer directly to that service; we do not receive its sign-in details or what it lists. Reports and exports you save go only where you put them.

The interactive chart on this website uses sample data. It does not look at your computer.

3. What leaves your computer, and why

Each item lists what is sent, why, and the lawful basis under UK GDPR Article 6(1).

Licence sign-in and activation

Your purchase email, the 6-digit code we send to it, a random installation ID created by the app, a generic device label such as “macOS device” (not your computer’s name), and the platform. We record when a device was activated, last checked in and deactivated. The app later refreshes its licence by sending the signed licence it already holds. Why: to provide the licence you bought and enforce its device limit. Basis: contract.

Sign-in protection

Keyed hashes of the email address and of the IP address making a sign-in request, with timestamps. Why: to limit repeated requests and guessing. Basis: legitimate interests in protecting the service and your licence.

Update checks

The app version, operating system and its version, processor architecture, whether DiskHalo was installed or runs as a portable copy, the app language, your time zone, and the random installation ID. The app checks shortly after it starts, unless an administrator has set update checks to manual only, and whenever you check yourself. Why: to offer the right signed update and understand which versions and platforms are in use. Basis: legitimate interests.

Feedback, only if you send it

The category and message you write, your email address if you add one, the app version, operating system and its version, processor architecture and app language. Also any attachments you choose, and recent app log files only if you choose to include them. Review attachments before sending. We also keep a keyed hash of the IP address that sent it, with the time, to limit repeated submissions. Why: to reply and fix problems. Basis: legitimate interests.

Purchases

From our checkout provider we receive your purchase email, its customer and transaction references, the plan, device allowance and licence status. If you reached checkout through a campaign link, its source, medium, campaign and content tags are stored with the purchase. We store an internal licence reference only as a one-way hash. Why: to deliver and manage your licence, prevent duplicate fulfilment and understand how people find DiskHalo. Basis: contract; legal obligation for accounting records; legitimate interests for campaign attribution and fraud prevention.

Emails

Your email address and the message content for purchase confirmations and sign-in codes, with delivery records. Basis: contract.

Support conversations

Whatever you choose to send us by email. Please leave out private documents, file paths and sign-in codes. Basis: legitimate interests in answering you, or contract where it concerns your purchase.

Visiting diskhalo.com

Our hosting provider processes technical request details such as IP address, browser information, the page requested and the time, to deliver and protect the website. There are no analytics or advertising scripts. Basis: legitimate interests.

4. Our merchant of record

Our checkout provider sells DiskHalo licences as our merchant of record. It is a separate, independent controller for the checkout, payment, tax, invoicing, refund and fraud-prevention data it collects, and its own privacy notice explains how it uses that data. We never receive your full card details.

5. Providers who process data for us

These providers act on our instructions, under data-processing terms, and only for the purposes below.

• Cloudflare: website hosting, the licence service and its database, and network protection.
• Resend: delivery of purchase-confirmation and sign-in-code emails, and of feedback you send from the app to our support mailbox.

We may also disclose information where the law requires it, or where it is needed to establish, exercise or defend legal claims. We do not sell personal data.

6. How long data is kept

Sign-in codes expire after 10 minutes. Temporary sign-in rate-limit records are kept for up to 24 hours, to enforce limits over a 15-minute window and over a day. Expired codes and rate-limit entries are removed when subsequent sign-in requests are processed. Delivery and payment-event records are retained to prevent repeated fulfilment and maintain correct licence status.

Purchase and licence records are kept while your licence is active and afterwards for [[FOUNDER: retention period for purchase and licence records]] to meet accounting and legal obligations and to handle disputes. Deactivating a device records its revoked status; it does not erase its activation history.

Update checks are not stored. The update service uses each check only to answer it and keeps no record of the installation ID, operating system version, language, time zone or installation type; its operational logs record no more than the platform, processor architecture, the app’s major and minor version and the result.

Feedback is not stored on our servers. It is delivered by email to our support mailbox and kept there, like other support emails, for [[FOUNDER: retention period for feedback and support emails]]. The keyed hash used to limit feedback submissions only counts for one hour and is removed when a later submission is processed. Our checkout provider and our other providers keep their own records under their own policies.

7. International transfers

Our providers may process personal data outside the UK, including in the United States. Where they do, we rely on a safeguard recognised by UK data protection law, such as UK adequacy regulations or the International Data Transfer Addendum to the EU standard contractual clauses. [[FOUNDER: confirm the transfer safeguard for each provider.]] You can ask us for details of the safeguard that applies.

8. Your rights

Under UK data protection law you have the right to:

• access the personal data we hold about you and receive a copy;
• have inaccurate data corrected;
• have data erased, or its use restricted, in some circumstances;
• receive data you gave us in a portable format, where processing is based on contract;
• object to processing based on legitimate interests; and
• withdraw consent at any time, where we rely on consent.

Email [email protected] to use any of these rights. We will reply within one month. Some records may need to be kept to meet legal obligations or to deal with legal claims. Inside the app, you can also deactivate a device and choose not to send feedback or logs.

9. Complaints

If you are unhappy with how we handle your data, please contact us first so we can try to put it right. You also have the right to complain to the Information Commissioner’s Office, the UK data protection regulator, or to the regulator where you live.

10. Cookies and similar technologies

diskhalo.com does not use analytics, advertising or tracking cookies, so it does not show a cookie banner. It sets one strictly necessary cookie, diskhalo_checkout, only when you open checkout. It links your checkout to the page that confirms your purchase, cannot be read by page scripts, is sent only to that confirmation request and expires after two hours. Blocking it can stop the confirmation page from showing your purchase.

When you open checkout, our checkout provider’s page loads from its own service and may use its own cookies or storage, as its privacy notice describes. The site owner’s administration area uses a sign-in cookie that is never set for visitors.

11. Protecting your data

Connections to the licence and update services use HTTPS. The licence database stores keyed hashes rather than sign-in codes, and DiskHalo verifies a signed licence on your computer.

12. Changes to this notice

We will update this notice when the product or the way we handle data changes. The effective date above shows the latest version. Where the law requires it, we will tell you about significant changes before they apply.