1. Data We Collect
DrakoCtrl collects the minimum data needed to run the licensing system and, if you buy a plan, to fulfil your order.
1.1 Collected by the Software
- Machine ID (hardware fingerprint hash) — used to bind a license to your PC
- License Key — stored on our server and locally (encrypted)
- IP address — for rate limiting only, not stored permanently
1.2 Collected When You Purchase
When online checkout is available, it is operated by Paddle, our Merchant of Record. Paddle collects your billing details and passes us only what we need to issue and support your license:
- Email address — to deliver your License Key, renewal notices and support replies
- Paddle customer ID and subscription ID — to link your license to your subscription and process renewals and cancellations
- Billing country — required for tax determination and passed to us by Paddle
- Payment status (paid, renewed, failed, refunded, cancelled) — to keep your license in the correct state
- Plan and order reference — for support and accounting
1.3 NOT Collected
- Card numbers, CVV or bank credentials — these go directly to Paddle and its payment processors; we never receive or store them
- Your name, postal address or phone number, unless you send them to us yourself when contacting support
- iPhone data, photos, messages or contacts
- Screen recordings or screenshots from your devices
- Browsing history or usage patterns
- Location data
- Any analytics or telemetry beyond licensing
2. How We Use Data
| Data | Purpose | Storage |
|---|---|---|
| Machine ID hash | License binding & device limit | Cloudflare (encrypted at rest) |
| License Key | License validation | Server + local cache (AES-256-GCM) |
| IP address | Rate limiting | Temporary (60s TTL) |
| Email address | License delivery, renewal notices, support | Cloudflare (encrypted at rest) |
| Paddle customer / subscription ID | Renewals, cancellations, refunds | Cloudflare (encrypted at rest) |
| Billing country & payment status | Tax determination, license state | Cloudflare (encrypted at rest) |
We do not sell your data, and we do not use it for advertising or profiling.
3. Data Security
- All API communication uses HTTPS with certificate pinning
- API responses are digitally signed with Ed25519 public-key signatures to prevent tampering
- Local license cache is encrypted with AES-256-GCM
- Machine ID is a one-way SHA-256 hash — it cannot be reversed
4. Third-Party Services
| Service | Purpose | Data Shared |
|---|---|---|
| Paddle.com Market Ltd | Merchant of Record — checkout, payment, tax, invoicing, subscription management | Email, billing details you enter at checkout, order and subscription data |
| Cloudflare Workers | License API server | Machine ID hash, License Key |
| Cloudflare | License and billing systems, hosted on Cloudflare infrastructure | License records, email, subscription references |
Paddle acts as an independent controller for the payment data it collects. Its handling of that data is governed by the Paddle privacy policy linked from your receipt and from the checkout page.
5. Data Retention
- License and subscription data is retained while your license is active
- Trial data is retained for 30 days after expiry
- Rate limit data expires after 60 seconds
- Order records are retained for as long as tax and accounting rules require, even after a license ends
- You can request deletion of everything not covered by that obligation by contacting support
6. Your Rights
Depending on where you live, you may have the right to:
- Access the data we hold about you
- Correct data that is inaccurate
- Request deletion of your data
- Receive a copy of your data in a portable format
- Object to, or ask us to restrict, a particular use of your data
- Deactivate your license and remove the local cache from your PC at any time
Email [email protected] to exercise any of these. We aim to respond within 30 days. If you are in the EU or UK and are unhappy with our response, you may complain to your local data protection authority.
7. Changes to This Policy
We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated date.
8. Contact
Privacy questions: [email protected]
For questions about payment data specifically, you can also contact Paddle through the link in your receipt email.
Data controller: Long Dinh Nguyen, trading as DrakoCtrl, Vietnam.
Email: [email protected] — Phone: +84 393 928 982
