Privacy Policy

This policy explains what personal data Licento processes, why, and what your choices are. Licento is operated by [not yet provided by the operator] ("we", "us").

It covers three groups of people:

Account holders — people who register for Licento or are invited to an organization.
Customers of our customers — people who buy software from an organization that uses Licento, and whose licence is managed here.
Visitors to this website.

1. Who is responsible

For account holders and visitors, [not yet provided by the operator] is the controller of the personal data described here.

For customers of our customers, the organization you bought from is the controller. We process your data on their behalf and on their instructions. If you want to see, correct or delete that data, ask them; we will help them respond.

2. What we process

Account holders

Account details: name, email address, an optional telephone number, and a password stored only as a one-way hash.
Security data: the secret for your authenticator app (stored encrypted), recovery codes (stored only as hashes), the times and IP addresses of sign-ins, and a list of your active sessions.
Organization data: the organizations you belong to and your role in each.
Billing data: the plan you are on, the status of your subscription, and identifiers given to us by the payment provider. We do not receive or store card numbers or security codes.
Audit trail: a record of significant actions taken in your organization, with who took them and when.
Legal acceptance: which version of our terms and this policy you accepted, when, and from which IP address.

Customers of our customers

Contact details given by the organization you bought from: name, email address, and optionally a company name and telephone number.
Licences: which products you are licensed for, on which plan, and until when. Licence keys are stored only as a keyed one-way digest; we cannot read a key back.
Activations: the site address or installation identifier a licence is active on, the software versions it reported, the IP address the request came from, and when.
Portal sign-in: if you use the customer portal, the one-time links sent to your email address and your sessions there.

Visitors and contact form

Contact form: the name, email address, optional telephone number, subject and message you send, with the IP address it was sent from, so that we can reply and prevent abuse.
Server logs: IP address, the page requested and the time, kept for a short period for security and troubleshooting.

We do not use advertising trackers or third-party analytics on this website. See our Cookie Policy.

3. Why we process it

To provide the service you or your supplier asked for: creating accounts, issuing and checking licences, delivering releases and licence keys.
To keep the service secure: detecting abuse, rate-limiting, and keeping an audit trail.
To take payment for the service and meet accounting obligations.
To reply when you contact us.

Where the law requires a legal basis, we rely on performance of a contract, our legitimate interest in running a secure and reliable service, and compliance with legal obligations.

4. Who we share it with

We do not sell personal data. We share it only with those who help us run the service:

Hosting: the servers the service runs on.
Email delivery: the mail service that carries messages such as sign-in links, invitations and licence keys.
Payment providers: when you pay for a plan, or when an organization takes payment from its customers, the payment is handled by the provider shown at checkout (for example Paddle, Razorpay or Stripe) under that provider's own terms and privacy policy.

We may also disclose data where the law requires it.

5. Where it is stored

The service's database and files are stored on servers chosen by the operator. If data is transferred to another country, we take the steps the applicable law requires for that transfer.

6. How long we keep it

Account and organization data: for as long as the account is open, and for a short retention period after an organization is closed so that it can be restored on request.
Audit trail, webhook delivery history and payment event details: for fixed periods set by the operator, after which they are deleted automatically.
Contact form messages: for as long as needed to deal with the enquiry.
Backups: for a limited number of days before being overwritten.

7. Security

Passwords are hashed. Licence keys, API secrets and recovery codes are stored only as digests. Signing keys, authenticator secrets and payment-provider connections are encrypted at rest. Access to an organization's data is limited to its own members, and administrative access requires a second factor. More detail is on our Security page.

No system is perfectly secure. If we become aware of a breach affecting your personal data, we will tell you and the relevant authority where the law requires it.

8. Your rights

Depending on where you live, you may have the right to see the personal data we hold about you, to have it corrected or deleted, to restrict or object to its use, and to receive a copy in a portable form. You may also have the right to complain to your data protection authority.

To use these rights, write to [not yet provided by the operator]. If your data was given to us by an organization you bought software from, please contact that organization first.

9. Children

The service is for businesses and developers. It is not intended for children, and we do not knowingly collect their data.

10. Changes to this policy

We may update this policy. The version and date at the top of the page show which version is in force. If a change is significant we will tell account holders before it applies.

11. Contact

[not yet provided by the operator]
[not yet provided by the operator]

Privacy questions: [not yet provided by the operator]
Support: [not yet provided by the operator]