Legal

Privacy Notice

Last updated: August 2, 2026

1. Who we are

SceneIt Studio is operated by Daniel Bick, trading as Bytemix Studios ("we", "us", "our"), a sole proprietor under German law. Full contact details are available in the imprint. This notice explains how we process personal data on this website, during purchases, for licence activation and when providing protected downloads.

The short version: Your projects and media stay on your Mac. We process only the information needed to sell, deliver, activate and support your licence. Payment is handled by Paddle as Merchant of Record. Public page views are kept only as identifier-free daily totals; unique-browser attribution requires your consent.

2. Data processed by the website

Depending on how you use the website, we process:

Basic access data: IP address, request time, requested page and browser user agent in short-lived server security logs.
Order data: the email address you enter, order status, product, Paddle transaction reference, amount, currency and delivery timestamps.
Licence data: licence status, encrypted licence material, permitted seats and the order connected to the licence.
Download verification: a one-way email hash, a one-way verification-code hash, attempt count and verification/download timestamps.
Activation data: a one-way hash of the machine identifier, app version and activation, last-seen or deactivation timestamps.
Creator programme data: the submitted video URL and platform, matched order and licence, consent and verification timestamps, review status and notes, and cash-back amount and payment status.
Aggregate page statistics: normalized public page path, calendar date and total view count. These totals contain no IP address, user agent, cookie ID or other visitor identifier.
Optional attribution data: a random browser identifier, first landing page, referrer and UTM campaign values, but only after analytics consent.

Order email addresses are encrypted in our database. A one-way normalized email hash is additionally used to match an existing licence without exposing the address during download recovery.

3. Why we process it

To start and fulfil your purchase, issue the licence and provide downloads (performance of a contract).
To activate licences, prevent abuse and keep the download service secure (contract and legitimate interests).
To send transactional email such as licence delivery and verification codes (performance of a contract).
To meet accounting, tax and other legal obligations where applicable (legal obligation).
To understand aggregate use of public pages without identifying visitors (legitimate interests in operating and improving the website).
To measure unique browsers and campaign attribution only when you have consented (consent, which can be withdrawn at any time).
To verify, review and administer Creator Cash Back submissions and the related marketing permission (contract and consent).

4. Paddle checkout

Paddle.com is our online reseller and Merchant of Record. When you continue to checkout, your email address, product selection and checkout context are sent to Paddle. Paddle independently processes payment details, billing information, tax, fraud-prevention signals, refunds and buyer support under its Privacy Notice. We do not receive or store your full payment-card details.

5. Hosting, email and recipients

The website and database are hosted by IONOS SE in Germany. IONOS also transports our transactional email. Personal data is disclosed only to service providers needed to operate the website and fulfil purchases, to Paddle for checkout, or where disclosure is required by law. We do not sell personal data and do not use advertising trackers.

6. Cookies, sessions & optional measurement

Essential session and security storage is used to operate forms, maintain checkout state and protect downloads. Identifier-free daily page totals do not use cookies, IP-derived hashes or browser fingerprints and exclude the admin area and internal endpoints. The consent choice itself is remembered in your browser. Only after you select “Accept” do we store a random visitor identifier and the attribution data described above. You can change that choice through “Cookie settings” in the footer.

7. The app, projects & API keys

SceneIt stores projects, imported media and editing data locally on your Mac; we do not receive that creative content. Provider API keys are stored in your macOS Keychain. If you choose to use an integrated provider, the app sends the relevant key and request directly to that provider. You can also create assets with other services and import them manually. Those providers process data under their own terms and privacy notices.

8. Contact and bug reports

When you contact us, we process the name, reply address, topic, subject and message you provide so we can respond. Bug reports additionally contain the associated licence, app and macOS versions and the reproduction details you submit. Bug reports sent by the app require an active, signed licence token. Optional diagnostics are accepted only after an explicit choice in the app and are limited to technical error, version, architecture, locale and recent-action fields. Do not submit passwords, provider API keys, payment-card data, confidential project media or other unnecessary personal information.

9. Retention & security

Order and licence records are kept for as long as required to provide the licence, support re-downloads and meet statutory retention duties. Short-lived verification records expire and are retained only as needed for security and abuse prevention. Creator submissions and consent records are retained while a claim is reviewed and, if paid, for as long as needed to document the programme and the granted marketing rights. Contact requests are normally removed within 12 months after completion; bug reports within 24 months after resolution, unless they remain necessary to maintain the product or establish, exercise or defend legal claims. Identifier-free daily page totals are retained for up to 25 months. Consented browser and attribution records are removed after 13 months of inactivity. We use access controls, encryption for stored order email addresses, one-way hashes for matching and HTTPS in transit. No system can be guaranteed completely secure.

10. Your rights

Where the GDPR applies, you may have the right to:

request access to and correction or deletion of your personal data;
restrict or object to processing;
receive data you provided in a portable format;
withdraw consent without affecting earlier lawful processing; and
complain to a competent data protection supervisory authority.

Some records cannot be deleted immediately where we must retain them by law or need them to establish, exercise or defend legal claims.

11. Changes & contact

We may update this notice when the service or legal requirements change. For privacy questions or to exercise your rights, email info@sceneit-studio.com.