Privacy notice

1. Data controller

The data controller is AZAE, Belgian private limited company (SRL), Chaussée d’Alsemberg 897, 1180 Uccle, Belgique, enterprise number 1030.335.879 · RPM Bruxelles. For data questions or to exercise your rights: hi@treelab.sh. Full contact details also appear in the legal notice.

Data comes from information you enter, payment-provider confirmations and technical information needed for requests you initiate. Required fields and the reason for collecting them are identified when requested. Do not send confidential code, secrets, payment keys or unnecessary data to support.

2. Orders, payment and invoicing

To process the order, we use electronic-delivery contact details, billing identity, country and necessary tax information, customer status, order and payment references, amounts, taxes, currency, payment status and any refund. Stripe collects payment data entered in its interface; the Treelab site must not retain your full card number or security code.

Preparing and fulfilling your order relies on requested pre-contractual steps and the contract (GDPR Article 6(1)(b)). Invoices and tax records meet applicable legal obligations (Article 6(1)(c)). Security checks and dispute handling may rely on our legitimate interest in securing and defending transactions (Article 6(1)(f)), subject to your rights. Retention by category, starting point and any statutory archive: Order and payment data received by Treelab — Stripe order and session references, amounts, currency, billing country, taxes applied, contractual choices and the confirmation address — are kept for seven years from 1 January following the year of the order, the retention period for the Belgian seller’s accounting and VAT records. Stripe keeps its own payment and invoicing records under its own terms..

Payment arrangements and recipients actually used: Stripe hosts the payment page and processes billing details, tax information and the payment method. For the Belgian account, services are provided by Stripe Payments Europe, Limited and, depending on the service, the regulated Stripe entity identified in its terms. Treelab receives order references, amounts, country, contractual choices and the confirmation address. Treelab does not receive the full card number or its security code.. Stripe’s own roles, including regulatory duties and fraud prevention, are explained in its official policy: https://stripe.com/privacy. We do not sell your data.

3. Licence, agreements and counter

To issue and retrieve purchased rights, we retain a licence reference linked to the order and holder’s contact, its status, accepted text version and language, agreement date and evidence of retainable confirmation. Choices about immediate supply and loss of the withdrawal right are recorded separately. Keys must be protected and excluded from public logs.

Issuing the licence relies on the contract; evidence of mandatory information and confirmations relies on the applicable legal obligation; defending a dispute relies on legitimate interests, with restricted access. Licence and agreement-evidence retention and archiving: The licence key (in hashed form), the holder’s encrypted email address, the version of the accepted documents, the delivered confirmation and the record of its delivery are kept for the whole life of the licence, then ten years after its revocation or last use, the limitation period for contractual claims. They serve to prove the contract, to return your key to you and to handle a complaint..

The founder counter uses only the references and states needed to count no more than 20 sales and manage reservations. The public receives aggregate availability, not buyers’ identities. This serves order fulfilment and our legitimate interest in keeping the offer accurate, without commercial profiling.

4. Activation and machine transfer

To manage one activation at a time and transfers, the service may process the licence reference, a limited technical machine or activation identifier, status and dates of activation, replacement or failure. Implementation must favour a dedicated pseudonymous identifier and avoid detailed hardware inventories, project names, file paths and work content.

The basis is performance of the licence (Article 6(1)(b)). Preventing substantiated abuse may rely on a documented legitimate interest (Article 6(1)(f)), without disproportionate collection or usage tracking. Retention for active and replaced activations and failures: Each activation records a random installation identifier, a hashed fingerprint of the machine, its date and its state (active or replaced); neither machine names nor IP addresses are kept. These records are kept for as long as the licence they belong to and deleted with it. The technical receipts that prevent a duplicate activation are erased after twenty-four hours.. Exact service data and recipients must be confirmed before connection; this notice provides for no continuous transmission linked to ordinary commands.

5. Support and notifications

When you contact support, we receive your reply address, message and any attachments you choose to send. Send only a useful, reviewed excerpt. Preparing a diagnostic report locally does not automatically send it.

Answering a purchase-related request relies on the contract or pre-contractual steps; answering another enquiry relies on our legitimate interest in responding to the person contacting us. Contract, withdrawal and licence confirmations and necessary update information are not a marketing subscription.

Mail provider and authorised access: Order confirmations, contractual documents, licence keys and activation replacement notices are sent through Resend, operated by Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, United States. This provider receives the recipient’s address and the content required for these messages. The licensing service verifies delivery of confirmations before enabling licence activation. This sending provider does not, by itself, identify the provider hosting the support inbox.. Retention of support messages and attachments: Support exchanges by email are kept for three years after the last exchange, then deleted, unless a dispute is ongoing or a longer statutory retention applies. They serve to understand your situation, to follow up a request and to prove the answer given.. Unnecessary attachments are removed without waiting for the general retention period; material needed for a legal obligation or dispute may be archived separately with a reason, duration and restricted access.

6. Visits, security and language preference

The server or host receives data needed for a connection: IP address, time, requested resource, technical response and browser information sent in the request. Logs actually enabled, their fields and access must be limited to service availability, diagnosis and security, based on our legitimate interest in operating and protecting the service. No audience-measurement or advertising tool is planned.

Hosting and recipients: The licensing service, its database and installation archives are hosted by Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, United States. The storefront is intended to be published on Cloudflare Pages. Cloudflare receives requests needed to operate and protect these services.. Log retention, starting point, deletion and any backups: Execution logs of the licence service and of the website are held by Cloudflare for security and diagnostics, for a few days according to its settings, with no profiling or advertising. Signed payment events received from Stripe and linked to an order follow the payment retention period.. A provider’s policy does not prove that Treelab uses all its products or logs: only settings actually enabled must be considered.

A manual French/English choice may be kept in sessionStorage under the key treelab-language, without a user identifier, for the tab session. It only recalls the language you requested and ends with that session; localised URLs work even if storage is refused. You may change the language or clear browser data. This temporary functional storage is used for neither advertising nor visit analysis, and no advertising consent is associated with the choice.

7. Recipients and international transfers

Only authorised people handling orders, licences, support, accounting and security, and necessary providers described above, may access the data. Authorities or advisers may receive it where a legal obligation or defence of a right justifies disclosure. Processors must have instructions, security safeguards and a contract appropriate to their role.

Actual processing locations, subprocessors and transfer mechanisms outside the European Economic Area are: Cloudflare, Inc. and Stripe, Inc. (United States) participate in the EU–US Data Privacy Framework and incorporate the European Commission’s standard contractual clauses in their data processing agreements. Plus Five Five, Inc. (Resend, United States) processes email delivery under the standard contractual clauses of its data processing agreement. A copy of these safeguards can be requested from the contact given in these documents.. Where a transfer requires safeguards, they must be established before it takes place, for example an applicable adequacy decision or standard contractual clauses with necessary assessments and measures. You may request information and a copy of relevant safeguards at hi@treelab.sh.

8. Your rights

Subject to GDPR conditions, you may request access, correction, erasure, restriction of processing and portability. You may object on grounds relating to your particular situation to processing based on legitimate interests. Where processing relies on consent, you may withdraw it at any time without affecting earlier lawful processing. We do not treat commercial acceptance as blanket data consent.

Contact hi@treelab.sh. We normally respond within one month; a reasoned extension of up to two further months is notified within that first month if statutory conditions allow. Proportionate identity verification may be needed, without systematically requiring an identity-document copy. A retention duty may prevent immediate erasure of some invoices or evidence; we explain the reason and scope.

You may complain to the Belgian Data Protection Authority (https://www.autoriteprotectiondonnees.be) or another competent supervisory authority, including that of your habitual residence. Judicial remedies remain available.

No advertising profiling or significant automated decision-making of Treelab’s own is planned. If a payment or activation check affects you, you may request an explanation and human review through the contact above; applicable rights concerning solely automated decisions are preserved. The payment provider’s own processing is also explained in its notice.

9. Necessary data and changes

Without data necessary for payment, sending the key or activation, the corresponding operation may not succeed; this does not prevent reading the legal pages. Optional information remains optional. No source code, project content or behavioural history is required to purchase or read the texts.

At the end of justified periods, data is erased or anonymised; any additional archive requires a separate legal reason and restricted access. The lifetime-update commitment does not imply indiscriminate lifetime retention of personal data.

This notice carries version 2026-09-09.1. Changes to processing must be explained to you before implementation where required by law.