This policy explains how vfx.systems ("we", "us") handles personal data when you use the site, create an account, buy our software, or contact us. The operator named in the Contact section is the controller of the personal data described here, except where we say a provider acts on its own account.
Our products are Bright, Moray and EXR Converter. The desktop software has its own notices where it talks to the internet; for Moray licence activation, see Licence keys and activations.
Summary
- We use self-hosted, cookieless Umami analytics and session replays with every form input masked. No advertising and no tracking cookies: the only cookie we set is the sign-in cookie.
- We store accounts, sessions and contact messages in our own database on Cloudflare.
- Payments are processed by Stripe. We never see or store card numbers.
- We do not sell or share personal data for advertising.
- You can ask us to access, correct, export or delete your data.
What we collect and why
Visiting the site
Cloudflare, our host, processes request data for every visit: IP address, user agent, the page requested, the referring page, and the time. This is needed to deliver the site and protect it from abuse (legal basis: our legitimate interest in running a secure site). We keep short-term operational logs of errors and requests for up to 30 days. They do not contain passwords, tokens, keys or message content.
Analytics and session replays (Umami)
We run Umami, an open-source analytics tool, on our own server at umami-production-e7fb.up.railway.app (hosted on Railway). On the public pages of vfx.systems it records page views, the referring site, browser, operating system, device type, screen size, language and approximate country, plus named events such as clicking a product button, a docs search (only the length of the query, never its text) or submitting a form (never what you typed). Umami does not use cookies. It works out a visit from your IP address and browser details using a hash that changes regularly, and it does not store your IP address. The query string of every URL is removed before it is sent, so tokens in links are never collected.
On a sample of visits (about 15%), Umami also records a session replay and click heatmap: how the page looked and where you moved, scrolled and clicked. Every form field is masked, so values such as names, email addresses, passwords, licence keys and messages are never recorded, and the text of the contact and early-access forms is masked too. Replays are never recorded on the account, log-in, sign-up, password reset, email confirmation or order confirmation pages. Statistics are aggregated, and we use them only to improve the site; they are not used to identify you or for advertising (legal basis: our legitimate interest in understanding how the site is used). Session replays are kept for [PLACEHOLDER: replay retention set on the Umami server] and aggregate statistics while the site runs.
Our host Cloudflare also adds its cookieless Web Analytics script, which reports page load timing and page views to Cloudflare without identifying you.
Accounts
If you create an account, we store in our Cloudflare D1 database:
- your email address, and a username if you choose one;
- a password hash (PBKDF2-SHA256 with a per-user salt). We never store or log your password itself;
- when you created the account and confirmed your email;
- for each signed-in session: when it started and was last used, the browser user agent, and the IP address of the connection, so you can review and sign out sessions;
- one-time email tokens, kept until they expire, for confirming your email or resetting your password;
- rate-limit counters keyed by a one-way hash of your IP address or email, to stop password guessing.
We use this to provide your account, keep it secure, and link your purchases to it (legal basis: performance of our contract with you, and our legitimate interest in security).
Purchases, receipts and refunds
Checkout is run by Stripe, our payment processor. Stripe collects your payment details and billing name and address, checks payments for fraud, and emails your receipt. Stripe processes this data under its own privacy policy.
Buying needs a vfx.systems account. We send Stripe your account email and account ID, and we keep a record of each order in D1: the Stripe Checkout Session, Customer, Payment Intent and Charge IDs, product, amounts, tax, currency, status, refunds, the email used at checkout and a link to the Stripe receipt. We also store the Stripe Customer ID linked to your account. We use this to deliver what you bought, to support you, and to meet tax and accounting duties (legal basis: contract and legal obligation).
Licence keys and activations
Licence keys for purchases on vfx.systems are issued by us when the payment completes and emailed to you. We store each key in D1 as a one-way hash plus an encrypted copy, so your account page can show it again, along with its status and activations.
When you activate Moray, the add-on sends your licence key and a machine fingerprint (an identifier of the computer and user account, not your files or documents) to our licence server (license.compstart.pro for current releases), which checks the key and records the activation. The add-on checks again from time to time. This counts and limits activations per key and lets you deactivate a machine (legal basis: contract). Activation records are kept while the key is active and are removed when you deactivate.
Contact form
When you use the contact form, we collect your name, email, the project type you pick, and your message. We store the submission in our D1 database first, as a backup, and then deliver it to a private Telegram chat that we read, and, if configured, to our inbox by email through Plunk. We use it only to answer you (legal basis: our legitimate interest in replying, or steps before a contract at your request). Telegram processes the message under its privacy policy.
Bright early access
If you register for Bright early access, we store your email address, the studio or role you choose to give, and when you signed up, in our D1 database. We use it only to tell you when Bright early access opens (legal basis: your consent, which you can withdraw at any time). We do not send other email from this list and do not share it. We keep it until Bright launches and we have sent the launch email, or until you ask us to remove you, whichever comes first.
Bot protection (Cloudflare Turnstile)
Account sign-up (where it is required), sign-in, password reset, the contact form and Bright early-access registration use Cloudflare Turnstile to tell people from bots. Turnstile runs a check in your browser and sends signals about the browser and the request to Cloudflare. It does not set cookies on vfx.systems and is not used for advertising (legal basis: our legitimate interest in preventing abuse).
Transactional email (Plunk)
We send account emails (email confirmation, password reset, security notices) through Plunk. Plunk receives the recipient address and the message, and keeps delivery records. We do not send marketing email, and recipients are not subscribed to any list.
Who we share data with
We share personal data only with these providers, for the purposes above:
- Cloudflare (hosting, database, Turnstile, security): privacy policy.
- Stripe (payments, receipts, fraud checks): privacy policy.
- Railway (hosting for our self-hosted Umami analytics server): privacy policy. The analytics data stays in our Umami instance and is not shared with Umami or anyone else.
- Plunk (transactional email): privacy policy.
- Telegram (delivery of contact-form messages to us): privacy policy.
We may also disclose data when the law requires it, to protect our rights or users' safety, or to a successor if the business is sold or merged (we will tell you first). We do not sell personal data and do not "share" it for cross-context behavioural advertising, as those terms are defined in the CCPA/CPRA.
How long we keep data
- Account data: while your account exists. After you ask us to delete your account, we delete it within 30 days.
- Sessions: up to 30 days after last use (the session lifetime), or until you sign out.
- Email tokens: valid for 1 hour (password reset) or 24 hours (email confirmation and change), and single use.
- Rate-limit counters: hashed, and deleted after 24 hours.
- Bright early-access sign-ups: until Bright launches and the launch email is sent, or until you ask us to remove you.
- Contact-form messages: 12 months from receipt in our database, then deleted automatically. We delete the Telegram and email copies on the same schedule.
- Order and refund records: 7 years after the order, to meet tax and accounting rules. If you delete your account, we unlink these records from it and keep only what the law requires.
- Licence keys: while the licence exists, so the key keeps working and can be shown again.
- Operational logs: up to 30 days.
- Analytics: aggregate statistics while the site runs; session replays for [PLACEHOLDER: replay retention].
Stripe keeps its own records for the periods in its privacy policy.
Cookies
We set one strictly necessary cookie, __Host-vfx_session, only when you sign in. Our analytics are cookieless and there are no advertising cookies. See the Cookie Policy.
Your rights
Depending on where you live, you can ask us to:
- tell you what personal data we hold about you and give you a copy (access and portability);
- correct inaccurate data (you can change your email, username and password in account settings);
- delete your data, subject to what we must keep for tax and legal reasons;
- restrict or object to processing based on our legitimate interests;
- withdraw consent where we rely on it, for example to leave the Bright early-access list.
EEA and UK (GDPR, UK GDPR): you have the rights above and can complain to your local data protection authority (in the UK, the ICO). We answer within one month, which the law lets us extend by two more months for complex requests.
California (CCPA/CPRA): you can know, delete and correct personal information, and you will not be discriminated against for using these rights. We do not sell or share personal information and do not use sensitive personal information to infer characteristics. You may use an authorised agent. We answer within 45 days.
Canada (PIPEDA): you can access and correct your personal information and withdraw consent, and you can complain to the Office of the Privacy Commissioner of Canada.
To make a request, use the contact form (choose "Other") or email [PLACEHOLDER: privacy and legal contact email]. We will confirm the request comes from the account holder, usually by asking you to reply from the account email. Account deletion is handled on request; there is no self-service delete button yet.
Children
vfx.systems is for professionals and is not directed to children. You must be at least 16 to create an account. We do not knowingly collect personal data from children under 16; if you think a child has given us data, contact us and we will delete it.
Security
All traffic uses HTTPS with HSTS. Passwords are hashed (PBKDF2), sessions use random tokens that expire and can be revoked, email confirmation and password reset links work once and expire, forms are protected against cross-site request forgery, sign-in and contact attempts are rate limited, and secrets are kept out of our code. No system is perfectly secure; if we learn of a breach that affects you, we will tell you and the authorities as the law requires.
International transfers
We are based in the United States, and our providers process data in the United States and other countries. Cloudflare serves the site from data centres worldwide. Where GDPR or UK GDPR applies, transfers rely on the providers' safeguards, such as the EU-US Data Privacy Framework (and UK extension) where a provider is certified, or Standard Contractual Clauses.
Changes to this policy
We will post any change here and update the date below. If a change is significant, we will also tell account holders by email before it takes effect.
Contact
Medeu Global LLC, a Wyoming limited liability company
30 N Gould St, Ste N, Sheridan, WY 82801, United States
vfx.systems/contact · [PLACEHOLDER: privacy and legal contact email]