Privacy Policy
Effective 1 October 2026
Chimpy ("we"), runs Notchset (https://notchset.dev) and is the controller of the personal data described here. We collect as little as we can and never sell it.
What we collect and why
| Data | Why | Legal basis (GDPR / UK GDPR) |
|---|---|---|
| Email address and account records (account id, seats, hashed sign-in tokens, hashed registry keys) | Sign-in, delivering and managing your licence, account messages | Contract, or our legitimate interest in serving the organisation that gave you a seat |
| Purchase records: product, amount, date, order and payment ids, and the version and time of your checkout consent | Delivering your licence; accounting; evidencing checkout consent | Contract; legitimate interests in keeping required records and establishing, exercising or defending legal claims |
| Registry downloads: which item, when, by which account | Delivering items; preventing key sharing and abuse | Legitimate interest (security, licence enforcement) |
| Technical and security logs: IP address, browser, request details | Security, fraud prevention, running the Service | Legitimate interest |
| Product analytics: pages and actions, linked to your account if you're signed in, or to an existing checkout identifier | Improving the product | Legitimate interest |
| Early-access list: your email and where you signed up | Sending the updates you asked for | Consent (unsubscribe any time) |
| Optional survey answers and messages you send us | Pricing research; answering you | Consent or legitimate interest |
An email address is required to sign in and receive a licence; surveys and the early-access list are optional. We also receive purchase details from Dodo Payments, our Merchant of Record, and seat assignments from the organisation administrator who adds you. Dodo Payments processes payment, billing and tax data as an independent controller under its own privacy policy. We never receive card details.
Cookies
We use only cookies the Service needs: one that keeps you signed in, and one set when you start a checkout to keep the price you were shown consistent. We don't set an analytics or advertising cookie. Preferences such as theme are stored in your browser.
Who we share data with
Service providers that help run the Service, under contracts that protect the data: Cloudflare (hosting, security, email routing), Neon (database), Resend (email delivery). Dodo Payments receives purchase data as an independent controller. We may disclose data where the law requires it, to protect our rights, or in a sale or reorganisation of the business.
International transfers
Our providers process data mainly in the United States and the European Union. Transfers that need safeguards rely on the providers' data processing agreements, which incorporate the EU standard contractual clauses and the UK addendum; you can ask for details and copies at support@notchset.dev.
How long we keep it
- Account data, download records and analytics linked to your account: while your account exists.
- Purchase and checkout-consent records: for the tax and accounting retention periods that apply and, where needed, the limitation period for legal claims.
- Early-access list: your address, where on the site you joined, and when you joined and confirmed, kept until 12 months after Pro goes on sale, then deleted. A signup that is never confirmed is deleted after 30 days. If you unsubscribe, we keep only your address and the date, so we never email you again; ask us and we delete that too.
- Security logs: as long as needed for security and as required by law.
When you delete your account, we delete or anonymise your data, except records kept for the legal obligations and legal claims described above.
Your rights
Depending on where you live, you may ask to access, correct, delete, restrict or port your data, object to processing, or withdraw consent. Email support@notchset.dev from your account email; we reply within 30 days. You can complain to your data protection authority (in the UK, the ICO; in the EU, your national authority). We don't make decisions about you based solely on automated processing that have legal or similarly significant effects.
Security
We use encryption in transit, hashed sign-in tokens and keys, and access controls. No system is perfectly secure, so keep your sign-in email and keys safe.
Age
The Service is not for anyone under 18.
Changes
We may update this policy by posting a new version here with a new effective date, and we'll notify you before materially different processing begins.
Contact
Chimpy · support@notchset.dev · Complaints and grievances: Chimpy, support@notchset.dev