1. Controller
The controller is [PENDIENTE: nombre y apellidos del titular], tax ID [PENDIENTE: NIF/NIE del titular], at [PENDIENTE: domicilio o dirección profesional], operating under the Meltvest brand (we, us, or our).
Meltvest is a commercial brand name and not, by itself, a separate legal entity. The website, desktop application, licensing operations, and related processing activities are operated by the individual developer behind the Meltvest brand.
Online purchases are processed by LemonSqueezy, acting as merchant of record for those transactions. LemonSqueezy carries out its own processing under its own privacy policy.
2. What data we collect
2.1 Website (https://workspacelauncher.meltvest.com)
- Contact form: name, email address, message content, privacy-notice acknowledgement, and optional marketing choice.
- Newsletter / waitlist: email address and consent to receive communications when you explicitly subscribe.
- Security and anti-abuse data: technical request data such as IP-related request information, timestamp, and browser information may be processed to detect abuse, rate-limit submissions, and protect the service. Where feasible, we minimise or transform that data.
2.2 Workspace Launcher application (Windows desktop app)
- Google account email: when you link your device using Google OAuth, we store your Google account email to identify your license. We do not access your Google contacts, calendar, files, or other Google content.
- Hardware identifier (HWID): a one-way cryptographic hash derived from hardware identifiers for license management.
- Free-trial abuse-prevention record: if you activate a free trial, the hashed hardware identifier of that device is stored in a separate record, unlinked from your account and your email address, so that the same computer cannot obtain repeated trials. This record is kept even if you delete your account, because deleting it would otherwise reset the limit. Legal basis: our legitimate interest in preventing abuse of the free trial (Art. 6(1)(f) GDPR).
- Machine name: displayed in your device list so you can identify linked devices.
- Plan and license status: subscription tier, device count, and expiry date.
- License administration records: activation and validation timestamps, linked-device records, local suspension or reactivation status, unlink or deactivation history, and plan-limit metadata needed to operate the licensing service and support tooling.
- Legal evidence: document type, version, content hash, server timestamp, app version, language, channel, and a pseudonymous subject hash when you accept the EULA; web forms also keep versioned events for privacy notices and marketing choices.
- Usage and error logs: pseudonymised diagnostic information sent only when you expressly submit a report; depending on the issue it may include technical identifiers, app version, process or window metadata, paths or URLs after automatic redaction.
2.3 Data we do not collect
- We do not collect, transmit, or store the contents of your workspaces, file paths, application names, or other details about what you do inside the application, except where you deliberately include such information in a support request or bug report.
- We do not use advertising trackers, third-party analytics scripts, or sell personal data.
3. Legal basis for processing (GDPR Art. 6)
- Consent (Art. 6.1.a): newsletter subscriptions, marketing emails, and optional bug reports.
- Contract performance (Art. 6.1.b): processing your Google email, HWID, plan data, and license status to provide licensed software features and related support.
- Legitimate interest (Art. 6.1.f): technical, fraud-prevention, and anti-abuse processing needed to protect the website, forms, authentication flow, and licensing infrastructure.
- Legal obligation (Art. 6.1.c): processing required to comply with applicable accounting, tax, legal, or regulatory duties.
4. How we use your data
- To deliver and maintain the Workspace Launcher license service.
- To respond to support inquiries submitted via the contact form or support channels.
- To send product updates and newsletters you have subscribed to.
- To detect abuse, enforce rate limits, protect security, and investigate fraud or misuse.
- To enforce plan limits, link licenses to devices, and manage unlinking or deactivation requests.
- To comply with legal obligations and maintain required business records.
We do not use your data for advertising profiling or automated decision-making producing legal effects.
5. Data recipients and sub-processors
We share personal data only where needed to operate the service or comply with law, including with:
- Supabase Inc. for database and authentication infrastructure.
- The configured email/SMTP provider for contact, verification, and transactional messages.
- LemonSqueezy for payment, subscription, and merchant-of-record processing.
- Google LLC for OAuth authentication when you choose to link your device with Google.
- Vercel Inc. for website hosting, request delivery, and operational logs where the site is deployed on Vercel.
- Google/YouTube only after you choose to load embedded YouTube media; YouTube may then receive technical request data.
We do not sell, rent, or trade personal data to third parties for their own marketing purposes.
6. Data retention
- Account and license data: retained while your account or license relationship remains active and afterwards only for as long as reasonably necessary for support, dispute handling, audit, fraud prevention, or legal compliance.
- Contact submissions: retained only as long as reasonably necessary to handle the request and related follow-up, unless a longer retention period is required by law or justified by support or dispute needs.
- Newsletter data: retained until you unsubscribe, plus any limited retention reasonably needed for consent audit or legal compliance.
- Security and anti-abuse data: retained only for as long as reasonably necessary for security, troubleshooting, rate-limiting, evidentiary, or fraud-prevention purposes.
- Purchase and transaction records: retained for the period required by applicable tax, accounting, and legal obligations, including records maintained by LemonSqueezy as merchant of record.
7. Your rights under GDPR
If you are in the European Economic Area, you may have the following rights:
- Access: request a copy of the personal data we hold about you.
- Rectification: correct inaccurate or incomplete data.
- Erasure: request deletion of your data, subject to lawful retention obligations.
- Portability: receive certain data in a machine-readable format.
- Restriction: request restricted processing in certain situations.
- Objection: object to processing based on legitimate interests, including security and anti-abuse processing, unless we have compelling grounds or another lawful basis applies.
- Withdraw consent: withdraw consent for marketing or optional bug reports at any time.
- Complaint: lodge a complaint with the Spanish Data Protection Authority (AEPD) at www.aepd.es.
To exercise your rights, email privacy@meltvest.com. We will respond within the legally required timeframe.
8. International data transfers
Some service providers may process data outside the European Union. Where that happens, we rely on appropriate safeguards such as Standard Contractual Clauses, adequacy decisions, or other lawful transfer mechanisms where applicable.
9. Cookies and tracking
This website does not use advertising cookies or third-party analytics trackers. It may use browser session storage or similar functional mechanisms needed for authentication and product flows.
10. Children
Workspace Launcher is not directed at children under 16. If you believe we have inadvertently collected personal data from a child, contact us at privacy@meltvest.com.
11. Changes to this policy
We may update this Privacy Policy from time to time. When changes materially affect your rights, we will update the last-updated date and, where appropriate, provide additional notice by email or inside the application.
Where required by law, we will seek any additional consent needed for material changes. Otherwise, the revised policy will apply to future use of the service after you have been informed of the update.