Summary
Crownware collects only the personal data needed to run your account, process one-time purchases, deliver and secure the software, and meet legal obligations. We do not sell or share personal data for advertising, we use no analytics or marketing trackers, and we send no marketing email without your consent. Payment details go directly to Stripe or PayPal. Data is hosted in the United States with providers certified under the EU-US Data Privacy Framework. You can access, correct, export, or delete your data, and consumers in the EU, UK, and many US states have additional rights described below. Contact admin@crownware.org with any request.
On this page
Who we are and how to reach us
This Privacy Policy explains how Crownware Ltd Company (Crownware, we, us, or our) processes personal data when you visit crownware.net, create an account, buy a Pass, use Crownware software, or contact us. We are the controller of that personal data, which means that we decide why and how it is processed.
ControllerCrownware Ltd Company17350 State Hwy 249, Ste 220 #27132Houston, TX 77064United States of AmericaEmail: admin@crownware.orgRepresentative in the European Union (Article 27 GDPR): we have not yet appointed a representative in the European Union. Representative in the United Kingdom (Article 27 UK GDPR): we have not yet appointed a representative in the United Kingdom. Until a representative is appointed, please send every data-protection enquiry directly to admin@crownware.org. We will update this policy as soon as a representative is appointed.
We have not appointed a data protection officer because the law does not require one for our processing. The privacy mailbox above is monitored by the person responsible for data protection at Crownware.
Scope of this policy
This policy covers the website, accounts, the customer dashboard, purchases, transactional email, Crownware software, and our communications with you. It does not cover the websites or services of third parties that you reach through links, or the checkout pages of Stripe and PayPal, which have their own privacy policies. The Cookie Policy describes the cookies we use and is part of this policy.
Personal data means information that relates to an identified or identifiable individual. Where this policy refers to laws, it means in particular the EU General Data Protection Regulation (GDPR), the UK GDPR and Data Protection Act 2018, the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA), the other United States state privacy laws listed in the section titled Your rights, and the privacy laws of other countries where our customers live.
Personal data we collect
We collect personal data directly from you, automatically from your device when you use the Services, and from the payment and infrastructure providers listed in the section titled Who receives personal data. We do not buy personal data from data brokers and we do not collect personal data from social networks.
| Category | What it includes | Source |
|---|---|---|
| Account data | Display name, email address, password (stored only as a salted hash), email-verification status, account creation and update times, profile picture if you add one. | You |
| Security data | Two-factor authentication secret (stored encrypted), hashed backup codes, trusted-browser tokens, failed sign-in counts and temporary lockouts, sign-in suspension records, and the pseudonymized keys used for rate limiting. | You; generated by our systems |
| Session and device data | Session token, IP address, browser and operating-system information from the user-agent string, session creation, activity, and expiry times. | Your browser |
| Order and payment data | Order reference, Product, Pass duration, price and currency, order status, timestamps, the identifiers that Stripe or PayPal assign to the payment, payment status and the evidence they send us, the payment method type, billing name and country, and the last digits of a card where the provider shares them. We never receive your full card number, bank details, or PayPal password. | You; Stripe; PayPal |
| Acceptance records | The version hashes of the Terms of Service, EULA, and Privacy Policy that you accepted and the time of acceptance, and your express request for immediate delivery. | You |
| Entitlement data | Passes held by your account, banked time, activation status, and, once activation exists, the identifiers of the devices on which a Product is activated and the times of license checks. | Generated by our systems; Crownware software |
| Transactional email data | The recipient address, template contents, and action links of the emails we send you (stored encrypted until delivery), and the delivery status events that Resend reports. | Generated by our systems; Resend |
| Bot-protection data | The result of the Cloudflare Turnstile challenge on sign-up, sign-in, and password-reset forms, including the IP address that we forward to Cloudflare for verification. | Your browser; Cloudflare |
| Hosting and request logs | Requests to our servers with IP address, URL, timestamp, response status, and user-agent string, kept for a short period by our hosting provider for security and debugging. | Your browser; Vercel |
| Communications | The content of emails and messages you send to our role mailboxes, your contact details, and our replies. | You |
| Software diagnostics (optional) | Crash reports and diagnostic information from Crownware software, only if you enable the option in the software settings. | Crownware software, with your consent |
| Staff and audit records | For platform staff only: role assignments, administrative actions, and an immutable audit chain that records actions using hashed identifiers rather than exact email addresses or IP addresses. | Generated by our systems |
Data we do not collect. We do not collect precise geolocation, biometric data, health data, government identifiers, or data revealing racial or ethnic origin, political opinions, religious beliefs, or sexual orientation. The only data that the CCPA classifies as sensitive that we hold is your account credentials, which we use solely to authenticate you. Crownware software does not send your code, builds, logs, traces, or other project data to us.
Why we process personal data and our legal bases
Where the GDPR or UK GDPR applies, we may process personal data only if we have a legal basis. The table lists each purpose, the data used, and the legal basis. Where United States law applies, the same table describes our business purposes.
| Purpose | Data used | Legal basis |
|---|---|---|
| Creating and operating your account, verifying your email, and signing you in | Account data, security data, session data | Performance of a contract (Article 6(1)(b) GDPR) |
| Processing Orders, delivering Passes, issuing receipts, handling refunds, and keeping acceptance records | Order and payment data, acceptance records, entitlement data | Performance of a contract; legal obligation for tax, accounting, and consumer-law records (Article 6(1)(c)) |
| Activating and verifying licenses in Crownware software | Entitlement data, account token, device identifier | Performance of a contract |
| Sending transactional email such as verification links, security alerts, and receipts | Account data, transactional email data | Performance of a contract; legal obligation for required notices |
| Protecting the Services against attacks, fraud, abuse, and unauthorized access, including bot protection, rate limiting, lockouts, and session management | Security data, session and device data, bot-protection data, hosting logs | Legitimate interests (Article 6(1)(f)) in the security of our systems and of our customers; we have assessed that these interests are not overridden by your rights |
| Responding to support requests and complaints | Communications, account data, order data | Performance of a contract; legitimate interests in resolving requests |
| Complying with law, including tax, accounting, sanctions, consumer-protection, and lawful requests from authorities | Order and payment data, account data, communications | Legal obligation |
| Establishing, exercising, or defending legal claims and enforcing our terms | Any relevant data | Legitimate interests in protecting our legal rights |
| Improving the reliability of Crownware software using crash reports | Software diagnostics | Consent (Article 6(1)(a)), which you can withdraw in the software settings at any time |
| Sending marketing email about new Products or features | Email address | Consent, which you can withdraw through the unsubscribe link in every message. We currently send no marketing email. |
Providing your account data and order data is necessary to enter into and perform the contract with you; without it we cannot create an account or sell you a Pass. Every other category is either generated automatically or optional.
Automated decisions. We do not make decisions based solely on automated processing that produce legal effects on you or similarly significantly affect you. Automated security controls, such as bot-protection challenges, rate limits, and temporary lockouts after repeated failed sign-ins, may briefly restrict access; you can always contact us to have such a restriction reviewed by a person.
Who receives personal data
We share personal data only with the service providers that we need to run the Services, with professional advisers and authorities where the law requires, and in a business transfer. We do not sell personal data, we do not share it for cross-context behavioral advertising, and we do not disclose it to data brokers or advertising networks.
| Provider | Purpose | Data | Location and transfer mechanism |
|---|---|---|---|
| Stripe Payments Company | Payment processing, receipts, fraud prevention, local-currency pricing, and tax calculation | Order and payment data; billing details you enter on Stripe's checkout page | United States and Ireland; EU-US, UK, and Swiss-US Data Privacy Framework participant |
| PayPal, Inc. and PayPal (Europe) S.à r.l. et Cie, S.C.A. | Payment processing and fraud prevention | Order and payment data; details you enter on PayPal's pages | United States and Luxembourg; PayPal's binding corporate rules and standard contractual clauses |
| Cloudflare, Inc. | Bot protection (Turnstile) and private storage of profile pictures (R2) | Bot-protection data; profile pictures | United States and global network; EU-US, UK, and Swiss-US Data Privacy Framework participant |
| Resend, Inc. | Delivery of transactional email | Transactional email data | United States; EU-US and UK Data Privacy Framework participant |
| Neon, Inc. (a Databricks company) | Hosting of our database | All account, security, session, order, entitlement, and audit data | United States; EU-US, UK, and Swiss-US Data Privacy Framework participant |
| Vercel, Inc. | Web hosting, edge network, and request logs | Hosting and request logs; all data in transit through the application | United States; EU-US, UK, and Swiss-US Data Privacy Framework participant |
Each provider is bound by a data-processing agreement that limits its use of personal data to our instructions and requires appropriate security. Stripe and PayPal also act as independent controllers for the fraud-prevention and regulatory processing that they perform in their own right; their privacy policies describe that processing.
Other disclosures. We may disclose personal data to our lawyers, accountants, and auditors under confidentiality obligations; to courts, regulators, law enforcement, and other authorities when the law requires it or when disclosure is necessary to protect the rights, property, or safety of Crownware, our customers, or the public; and to a successor in a merger, acquisition, or sale of assets, in which case this policy continues to apply and we will notify you before your data becomes subject to a different policy.
International transfers
We are established in the United States, and the providers listed above store personal data there. If you are in the European Economic Area, the United Kingdom, or Switzerland, your personal data is therefore transferred to the United States.
For transfers to providers that participate in the EU-US Data Privacy Framework, its UK Extension, and the Swiss-US Data Privacy Framework, we rely on the European Commission's adequacy decision of 10 July 2023, the United Kingdom's adequacy regulations, and the Swiss Federal Council's decision. The General Court of the European Union upheld the EU-US framework on 3 September 2025; an appeal to the Court of Justice is pending. For any transfer that the framework does not cover, and as a fallback should the framework ever be invalidated, we rely on the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914), the UK International Data Transfer Addendum, and supplementary measures such as encryption in transit and at rest. You can request a copy of the safeguards we use by writing to admin@crownware.org.
How long we keep personal data
We keep personal data only for as long as we need it for the purposes described above, and then delete or anonymize it. The periods below are our standard retention periods; we may keep specific data longer where the law requires it or where it is needed for a pending dispute.
| Category | Retention period |
|---|---|
| Account data and profile pictures | For as long as your account exists, then deleted within thirty days of closure, except data that we must keep under the rows below. |
| Security data | Two-factor secrets, backup codes, and trusted-browser tokens until you disable them or your account is closed; lockout and rate-limit records until their window ends, at most one hour; suspension records for the life of the account. |
| Session and device data | Until the session expires (seven days after the last use, or thirty days for a trusted browser) or you revoke it, after which expired sessions are removed. |
| Order and payment data and acceptance records | For as long as required by tax and accounting law, typically seven years in the United States and ten years in Germany, counted from the end of the year of the transaction. |
| Entitlement data | For the life of the account and the Pass, then with the order records above. |
| Transactional email data | Encrypted contents are erased as soon as the email is accepted by the delivery provider or the action link expires; non-personal delivery metadata is kept for thirty days. |
| Bot-protection data | Not stored by us beyond the request; Cloudflare's retention is described in its Turnstile privacy notice. |
| Hosting and request logs | Retained by our hosting provider for a short period, at most thirty days, for security and debugging. |
| Communications | For up to twenty-four months after the matter is closed, or longer where needed to establish, exercise, or defend legal claims. |
| Software diagnostics | For up to twelve months after receipt. |
| Staff audit records | Kept for the life of the platform in pseudonymized form as an immutable record of administrative actions. |
Backups are retained by our database provider for a rolling period of up to thirty days and are then overwritten; data deleted from the live system disappears from backups on that schedule.
Cookies, tracking, and Do Not Track
We use only strictly necessary cookies: session cookies that keep you signed in, short-lived cookies that complete secure email links and two-factor challenges, and the cookies that Stripe and PayPal set on their own checkout pages for fraud prevention. We use no analytics, advertising, social-media, or cross-site tracking technologies, and no third party collects information about your activity on our site over time and across other sites. Because we set no optional cookies, we do not display a cookie banner. Full details are in the Cookie Policy.
Do Not Track and Global Privacy Control. We do not track visitors for advertising, so there is nothing for a Do Not Track signal to switch off; we treat every visitor as if the signal were on. We honor the Global Privacy Control signal as a valid request to opt out of any sale or sharing of personal data, which we do not perform in any case.
How we protect personal data
We apply technical and organizational measures appropriate to the risk, including:
- encryption of all traffic in transit with TLS, and encryption at rest by our database and storage providers;
- passwords stored only as salted hashes using a memory-hard algorithm, and two-factor secrets and backup codes stored encrypted or hashed;
- email contents and action links stored in an encrypted outbox with versioned keys that can be rotated;
- pseudonymization of the identifiers used for rate limiting and audit records, so that exact email addresses and IP addresses are not written to those records;
- bot protection on public forms, rate limits, sign-in lockouts, verified email links, session revocation, and optional two-factor authentication for every account;
- a strict content-security policy, secure cookie attributes, and separation of provider credentials with least-privilege scopes;
- an immutable, tamper-evident audit chain for administrative actions, and staff access limited to what a role requires; and
- regular review of dependencies, provider configurations, and incident procedures.
No system is completely secure. If we become aware of a personal-data breach that is likely to result in a risk to you, we will notify you and the competent authorities without undue delay and within the periods that the law requires. Please report suspected vulnerabilities to admin@crownware.org.
Your rights
You can exercise any of the rights below by writing to admin@crownware.org from the email address on your account, or by post to the address in the section titled Who we are. We will confirm your identity by verifying access to that email address, and we may ask for further information if your request is unusual. We respond within one month, or within forty-five days where United States state law applies; we will tell you if we need more time. Exercising your rights is free unless a request is manifestly unfounded or excessive.
Rights for everyone
- Access. Ask for a copy of the personal data we hold about you and information about how we process it.
- Correction. Ask us to correct inaccurate data; you can change your display name, email address, and profile picture from your dashboard.
- Deletion. Ask us to delete your personal data. We will delete it unless we must keep it under the retention rules above, for example order records required by tax law.
- Portability. Receive the data you provided to us in a structured, commonly used, machine-readable format.
- Objection and restriction. Object to processing based on legitimate interests, or ask us to restrict processing while a dispute is resolved.
- Withdrawal of consent. Withdraw consent for optional processing at any time, without affecting the lawfulness of processing before withdrawal.
- Opt out of marketing. Unsubscribe from any marketing email through the link in the message; transactional messages required to operate your account cannot be switched off while you keep an account.
European Economic Area, United Kingdom, and Switzerland
In addition to the rights above, you have the right to lodge a complaint with a supervisory authority, in particular the authority in the country where you live or work or where an alleged infringement occurred. In the United Kingdom this is the Information Commissioner's Office; in Switzerland the Federal Data Protection and Information Commissioner. We would appreciate the chance to address your concern first, but you are not required to contact us before complaining.
United States state privacy rights
Residents of California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia may have the rights to confirm whether we process their personal data, to access, correct, delete, and obtain a copy of it, and to opt out of the sale of personal data, the sharing or processing of personal data for targeted advertising, and profiling in furtherance of decisions that produce legal or similarly significant effects. We do not sell personal data, do not process it for targeted advertising, and do not profile you in that way, and we have not done so in the preceding twelve months. We honor opt-out preference signals such as the Global Privacy Control. We do not discriminate against you for exercising any right.
Appeals. If we decline to act on your request, you may appeal within forty-five days by replying to our decision or writing to admin@crownware.org with the word "appeal" in the subject line. A different person will review the appeal and respond in writing within forty-five days, explaining the reasons for the decision. If your appeal is denied, you may contact the attorney general of your state; the response will tell you how.
Authorized agents. You may designate an authorized agent to make a request on your behalf. We will ask the agent for written proof of authorization and will verify your identity directly with you, as the law allows.
Additional California disclosures
In the preceding twelve months we collected the categories of personal information listed in the section titled Personal data we collect, which correspond to the following CCPA categories: identifiers (name, email address, account identifier, IP address); commercial information (orders and purchase history); internet or other electronic network activity information (session and request logs); approximate geolocation derived from IP address or billing country, used for tax calculation and fraud prevention; and sensitive personal information limited to account log-in credentials, which we use only to authenticate you and for no purpose that would require a "Limit the Use of My Sensitive Personal Information" link. We collected them from the sources and for the business purposes described above, and disclosed them for business purposes only to the service providers listed in the section titled Who receives personal data. We did not sell or share personal information and have no actual knowledge that we sell or share the personal information of consumers under sixteen years of age. Because we do not sell or share personal information, we do not offer a "Do Not Sell or Share My Personal Information" link. California residents may request the information described in this paragraph twice in a twelve-month period.
California Online Privacy Protection Act. This policy identifies the categories of personally identifiable information we collect and the categories of third parties with whom we share it, describes how you can review and request changes to your information, explains how we notify you of material changes, states its effective date, and explains how we respond to Do Not Track signals. Nevada. We do not sell covered information as defined in Nevada law.
Other countries
If you live in Brazil, you have the rights provided by the Lei Geral de Proteção de Dados, including the rights to confirmation, access, correction, anonymization, portability, deletion, and information about sharing; our contact for those requests is the privacy mailbox above. If you live in Canada, you may request access to and correction of your personal information and complain to the Office of the Privacy Commissioner of Canada or, in Québec, the Commission d'accès à l'information; your data is stored outside Québec and Canada as described above. If you live in Australia, you may complain to the Office of the Australian Information Commissioner if we do not resolve your concern. If you live in Japan, you may request disclosure, correction, and suspension of use under the Act on the Protection of Personal Information. In every case, write to the privacy mailbox and we will apply the law that protects you.
Children
The Services are intended for adults and are not directed to children. We do not knowingly collect personal data from anyone under thirteen years of age, or under the higher age at which a person can consent to data processing where you live, for example sixteen in parts of the European Union. If you believe that we have collected personal data from a child, contact admin@crownware.org and we will delete it promptly.
Changes to this policy
We may update this policy when our processing or the law changes. If a change is material, we will notify account holders by email at least 30 days before it takes effect and post a notice on the website; other changes take effect when the updated policy is published with a new version number and effective date. We keep previous versions and will provide them on request.
Contact
Questions, requests, and complaints about this policy can be sent to admin@crownware.org or by post to Crownware Ltd Company, 17350 State Hwy 249, Ste 220 #27132, Houston, TX 77064, United States of America. Our full company identification is in the Impressum.