RollVT Privacy Notice

1. Who we are

HALF GREY BEAR Ltd is responsible for the personal information we use for RollVT. We are a UK company, number 13904102, with our registered office at 5 Canada Drive, Rawdon, Leeds, LS19 6LU, United Kingdom. Our VAT registration number is GB 402 5307 44.

For privacy questions or to exercise your rights, email [email protected] or write to our registered office, marking your message “RollVT privacy”.

2. Information we receive

• Contact and purchase information: your email address, name where supplied, licence key, plan, position count, entitlement dates, payment and subscription references, and relevant payment, cancellation or refund status. Paddle sends us information needed to fulfil and administer your purchase. We do not receive your full payment-card number or card security code.
• Activation information: a hashed identifier derived from your Mac’s hardware identifier, its name, the RollVT version and activation/check-in history. Hashing does not make a device identifier anonymous: we can associate it with your licence.
• Website and service requests: IP addresses, request information and security or error records generated when your device contacts our website, licensing, update or support services.
• Guest passes and rewards: invitation identifiers and private labels, verified email addresses, activation and expiry dates, eligibility and redemption records, referral relationships, and purchase references and reward status needed to administer the programme.
• Support information: correspondence and information you choose to send us. An optional in-app bug report can include your description, contact email if supplied, Mac and software details, diagnostic logs, crash reports, file paths and show metadata. The report screen explains the contents before submission. Media files are not included in the in-app diagnostic bundle.

We obtain information directly from you, from your device when it contacts these services, from the person administering a shared licence, and from Paddle for purchases and billing updates. An invitation’s private label is entered by its sender; guests provide and verify their own email addresses.

RollVT does not upload your media or show files as part of licensing or checking for updates. Sending an optional diagnostic report is a separate action. Do not include confidential client material or sensitive personal information in a support message unless we have agreed a suitable way to handle it.

3. Why we use this information

We use information needed to provide and administer your licence, verify your email, manage activated Macs, deliver requested guest passes and rewards, send service messages, and respond to support requests. Where you are our customer, our basis is performing our contract with you or taking steps you request before a contract.

Where an organisation holds the licence and you are its operator or contact, we rely on our legitimate interest in providing the service to that organisation and helping its authorised users.

We also rely on legitimate interests to protect the service, investigate faults and abuse, prevent duplicate trials or rewards, reconcile billing events and maintain reliable licensing records. These interests are operating a secure service, protecting customers and ensuring that licences and rewards are allocated correctly. We must balance those interests against your rights.

We use and retain information where necessary to comply with legal obligations, including applicable accounting requirements and responding to valid legal requests.

We need an email address and the relevant licence and device information to provide activation, verification and licence-management services. Without them, we may be unable to provide those services. Guest-pass participation and submitting a diagnostic report are optional.

Licence and programme checks apply rules such as entitlement dates, activation capacity and previous redemption history. If you think a decision is wrong, contact us to request a review.

4. Who receives information

We use service providers to operate RollVT:

• Cloudflare hosts the website and licensing services, stores licensing records and submitted diagnostic bundles, and provides network and security services. See Cloudflare’s privacy information.
• Resend delivers verification, licence, portal and support notification emails. It receives the recipient address and message content needed to send those emails. See Resend’s privacy information.
• Google Fonts supplies fonts on some website pages and receives the browser requests needed to load them. See Google’s privacy policy.
• GitHub hosts RollVT installer downloads and receives requests when you download those files. See GitHub’s privacy statement.
• Paddle is our merchant of record and reseller. It processes purchases, renewals, refunds and billing support, and supplies relevant payment and subscription information to us. Paddle is separately responsible for its payment processing and related uses described in Paddle’s privacy policy.

People administering a shared licence can see the activated Macs and associated machine names and licence information in the portal. A guest-pass sender can see their invitation label, redemption state and reward state; the programme does not show them the guest’s email address, licence key or billing details.

Our support email provider handles messages you send and the report notifications we receive. Authorised staff and contractors may access information needed for their work. We may also disclose relevant information to professional advisers or authorities where necessary to comply with law, resolve a dispute or protect our legal rights.

5. International processing

Our providers operate internationally, so information may be processed outside the United Kingdom, including in the United States. Their privacy information describes their international operations. The standard Resend data-processing terms provide for standard contractual clauses and the relevant UK transfer provisions. The standard Cloudflare data-processing terms provide for standard contractual clauses and the UK Addendum where applicable. These safeguards depend on the transfer and the terms that apply. You can contact us for information about the arrangements and safeguards applying to RollVT, including how to obtain a copy.

6. How long we keep information

Retention depends on the record and its purpose:

• Submitted diagnostic bundles and their report metadata: the report store is configured to expire these after 90 days. An emailed report notification or support correspondence is a separate copy and does not disappear when that store expires.
• Service event records: routine cleanup removes IP addresses and detailed event text from records older than 90 days, and removes event rows older than 400 days. Cleanup runs during service activity, so these are cleanup thresholds rather than a guarantee that every record disappears at an exact time.
• Licence, activation and purchase records: we retain records while needed to provide the licence, recognise existing entitlements, manage renewals and refunds, reconcile payments, meet legal obligations or resolve disputes. A non-expiring licence can require long-term entitlement records.
• Trial, guest and reward records: some records must remain after a trial, invitation or reward expires to enforce one-per-person eligibility, prevent duplicate rewards and handle later payment reversals. Expiry of a pass or reward is not itself deletion of its record.
• Transaction reconciliation records: records used to recognise previously processed payments may be retained long term so a repeated payment notification cannot incorrectly add another entitlement or reward.
• Support correspondence: we retain it according to the continuing support need, issue history and any related complaint, claim or legal requirement.

We consider whether we still need to identify a person, whether information can be reduced, and whether a legal requirement or an unresolved issue justifies keeping it. You can ask us about a particular record or request deletion. A deletion request does not automatically override a continuing legal or legitimate need to retain some information.

7. Your rights

Depending on the circumstances and applicable law, you can request access to your personal information, correction, deletion or restriction of its use. You may also be entitled to receive information you provided in a portable format where it is processed automatically on the basis of consent or a contract.

You can object to processing based on legitimate interests for reasons relating to your circumstances. We must stop that processing unless we have an applicable legal basis to continue, such as compelling legitimate grounds that override your interests or establishing, exercising or defending legal claims.

Email [email protected] to make a request. We may need enough information to verify your identity and locate the records. We will explain any limit or exemption that applies.

You can complain to the UK Information Commissioner’s Office through the ICO complaints service. We would welcome the chance to address your concern first, but this does not remove your right to contact the regulator. You may also have the right to contact the supervisory authority where you live.

8. Changes to this notice

We will update this notice when our use of information changes and show the update date above. Where necessary, we will bring a material change to your attention or provide additional information when we collect it.