Privacy notice

Controller and contact

The controller is FalcoSoft ITS EOOD, company number 208644390, at the address on the contact page. For privacy requests use [email protected] with subject “Privacy / DemoSoft”.

Data and purposes

Account data includes name, email, public handle, a cryptographic password hash and access records. Developer data includes business details, authority to represent, agreements, signatures, uploaded packages and information about rights to them. Purchase data includes orders, licences, delivery selections, acknowledgements, payment identifiers and accounting records.

We use this information to enter and perform contracts, comply with law, prevent abuse and handle enquiries. Security processing relies on legitimate interests balanced against individual rights. Marketing and optional analytics are not enabled without a separate basis and any required consent.

Public and private data

Studio name, public handle and approved product descriptions are public. Agreements, signatures, login emails, ZIP packages before purchase and payment data are private. Do not upload real customer data or secrets in demos.

Providers and international access

We use hosting and security infrastructure including Cloudflare, transactional email infrastructure and Stripe when payments are enabled. Developers receive only information necessary for licensing, support or legal obligations. Authors do not receive full card details and we do not sell personal data.

Processing outside the EEA uses an applicable transfer mechanism, such as an adequacy decision or standard contractual clauses where required. Information about the specific provider and safeguards is available on request.

Retention

Active accounts are kept until closure; data needed for existing purchases and rights may remain until obligations end. Agreements and related evidence are retained for 5 years after termination unless law or a pending dispute requires longer. Accounting records follow mandatory retention periods, which may be up to 10 years.

Verification tokens expire within 24 hours and password reset tokens within 30 minutes. Attempt-limiting records are removed after 7 days. Completed enquiry content is reviewed for deletion after 24 months; contractual or disputed records follow the relevant longer period. Backups expire under their rotation and are not used for new purposes.

Your rights

You may request access, correction, erasure, restriction or portability, or object where applicable law permits. Withdrawing consent does not affect earlier lawful processing. Proportionate identity checks may be necessary. We normally respond within the statutory one-month period, subject to lawful extensions.

You may complain to the Bulgarian Commission for Personal Data Protection at https://cpdp.bg/ or the competent authority where you usually reside. We do not make decisions with legal or similarly significant effects solely through automated profiling.

Domain purchases and customer tickets

For domain purchases we store listing, order, price, VAT, DNS verification and transfer-status records. Tickets and replies are accessible to the relevant customer and administrators. Buyers and sellers see only the information needed for their own handover. The retention periods and rights described in this policy apply.

Sign in with Google

You can use Google to sign in as a customer or developer. With your consent we receive your verified email, name and unique Google identifier for account linking and security. We do not request access to Gmail, Drive or contacts, and do not store your Google password, refresh tokens or access to Google services.

A new account is created after choosing its type and accepting the current terms. An existing account is not linked automatically merely because its email matches: first sign in with your current password and connect Google from your account settings. Google registration does not grant administrator privileges.

You can disconnect Google from your account after confirming your DemoSoft password. If you registered with Google only, first set a password through password recovery. Disconnecting does not delete purchases, agreements or required financial records. Google explains its processing at https://policies.google.com/privacy.

Cloudflare Turnstile

We use Cloudflare Turnstile to protect forms from automated abuse. When a form is opened, Cloudflare processes connection and browser data, including the IP address, for security verification. We do not send the message content to Turnstile. We do not use this check for advertising tracking. Cloudflare privacy notice.