1. Controller

The controller is [PENDIENTE: nombre y apellidos del titular], tax ID [PENDIENTE: NIF/NIE del titular], at [PENDIENTE: domicilio o dirección profesional], operating under the Meltvest brand (we, us, or our).

Meltvest is a commercial brand name and not, by itself, a separate legal entity. The website, desktop application, licensing operations, and related processing activities are operated by the individual developer behind the Meltvest brand.

Online purchases are processed by LemonSqueezy, acting as merchant of record for those transactions. LemonSqueezy carries out its own processing under its own privacy policy.

2. What data we collect

2.1 Website (https://workspacelauncher.meltvest.com)

Contact form: name, email address, message content, privacy-notice acknowledgement, and optional marketing choice.
Newsletter / waitlist: email address and consent to receive communications when you explicitly subscribe.
Optional website analytics: after you accept, we record visits to public pages, referring website, device type, approximate country, section attention and scrolling, click coordinates with generic element labels and selected interaction counts. We exclude account/authentication pages, visible button text and free-form campaign parameters. The server derives a daily pseudonymous identifier from IP and browser information; raw IP is not stored in the analytics database.
Security and anti-abuse data: technical request data such as IP-related request information, timestamp, and browser information may be processed to detect abuse, rate-limit submissions, and protect the service. Where feasible, we minimise or transform that data.

2.2 Workspace Launcher application (Windows desktop app)

Google account email: when you link your device using Google OAuth, we store your Google account email to identify your license. We do not access your Google contacts, calendar, files, or other Google content.
Email language: we save the browser language or your selected communication language to localise account, support and permitted marketing emails. A missing translation falls back to English. This preference does not grant marketing permission; you can change it in your referrals account.
Aggregate registration countries: for new Google registrations after this notice, our server briefly uses the hosting provider's approximate connection country to increment a monthly counter, to plan regional service and translation priorities. Legal basis for this initial processing: our legitimate interest (Art. 6(1)(f) GDPR), assessed against your rights. Before continuing with Google you can select “Exclude my new registration from country statistics” to object, without affecting sign-in or email language. We do not save country in your profile. Counters contain only month, country and quantity: no email, account/device identifier, full IP, city, coordinates or individual event time, and no breakdown by language. An account-level processed flag prevents duplicate counting; it cannot identify which counter received a contribution and is also set for exclusions and unknown countries. Existing accounts and the previous consent-based profile countries are not imported. VPNs may affect country; it is not residence or nationality. Admin reports show only closed months with at least ten registrations per country, in bands of ten. Counters older than the current month plus twelve previous months are deleted on the next write or report request. Once combined, a contribution cannot be located or individually removed; we do not retain extra identifiers to make that possible. You can contact us to object to future initial processing. Hosting security logs and backups remain subject to their separate safeguards and retention; this counter does not control those logs.
Hardware identifier (HWID): a one-way cryptographic hash derived from hardware identifiers for license management.
Free-trial abuse-prevention record: if you activate a free trial, the hashed hardware identifier of that device is stored in a separate record, unlinked from your account and your email address, so that the same computer cannot obtain repeated trials. This record is kept even if you delete your account, because deleting it would otherwise reset the limit. Legal basis: our legitimate interest in preventing abuse of the free trial (Art. 6(1)(f) GDPR).
Machine name: displayed in your device list so you can identify linked devices.
Plan and license status: subscription tier, device count, and expiry date.
License administration records: activation and validation timestamps, linked-device records, local suspension or reactivation status, unlink or deactivation history, and plan-limit metadata needed to operate the licensing service and support tooling.
Legal evidence: document type, version, content hash, server timestamp, app version, language, channel, and a pseudonymous subject hash when you accept the EULA; web forms also keep versioned events for privacy notices and marketing choices.
Usage and error logs: pseudonymised diagnostic information sent only when you expressly submit a report; depending on the issue it may include technical identifiers, app version, process or window metadata, paths or URLs after automatic redaction.
Optional app usage statistics: only after you enable "Share usage statistics" in Settings, we receive daily totals of app sessions, confirmed brief sessions, foreground minutes, workspace creations, item additions, successful launches and free-trial claims. The summary contains a random code that changes daily and a first-day or later-day participation flag, calculated on your device. It contains no workspace content, names, programs, games, paths, URLs, email, account, HWID or permanent cross-day identifier. Statistics are separate from licensing and diagnostics. The connection necessarily reveals the IP address to infrastructure providers; we do not add it to the statistics database.

2.3 AI, transcription and speech features

When you choose a remote AI provider, messages, conversation context and necessary tool results or selected content are sent to the configured provider. Depending on the feature, this can include application names, paths, window information or workspace data. Remote transcription sends the selected microphone audio; remote speech synthesis sends the response text. These are separate from optional usage statistics. Local processing remains on your device when the configured service is local; a custom endpoint may be remote.

Available integrations can include OpenAI, OpenRouter, Groq, Mistral, Google Gemini, Anthropic, Microsoft Azure Speech, Google Speech-to-Text and Deepgram, depending on the feature and configuration. The active provider/model/endpoint is selected in the app. Its retention, training and international processing depend on the provider and account settings; using your own API key does not guarantee zero retention. Review those conditions and avoid unnecessary personal data or information about others. Conversations may also remain in local app history.

2.4 Data we do not collect

We do not collect, transmit, or store the contents of your workspaces, file paths or application names, except where you deliberately include such information in a support request or bug report, or use an AI feature that sends the necessary context to your chosen remote provider. Optional app statistics describe aggregate operations without that content.
We do not use advertising trackers, third-party analytics scripts, or sell personal data.

3. Legal basis for processing (GDPR Art. 6)

Consent (Art. 6.1.a): optional website and app usage statistics, newsletter subscriptions, marketing emails, and optional bug reports. App statistics start disabled; declining does not restrict features and you can turn them off in Settings.
Contract performance (Art. 6.1.b): processing your Google email, HWID, plan data, and license status to provide licensed software features and related support.
Legitimate interest (Art. 6.1.f): technical, fraud-prevention, and anti-abuse processing needed to protect the website, forms, authentication flow, and licensing infrastructure.
Legal obligation (Art. 6.1.c): processing required to comply with applicable accounting, tax, legal, or regulatory duties.

4. How we use your data

To deliver and maintain the Workspace Launcher license service.
To respond to support inquiries submitted via the contact form or support channels.
To send product updates and newsletters you have subscribed to.
With your consent, to understand which pages and interactions need improvement.
With your consent, to improve the desktop app and communicate aggregate usage figures, such as workspace creation totals, without publishing individual summaries or profiling for advertising.
To detect abuse, enforce rate limits, protect security, and investigate fraud or misuse.
To enforce plan limits, link licenses to devices, and manage unlinking or deactivation requests.
To comply with legal obligations and maintain required business records.

We do not use your data for advertising profiling or automated decision-making producing legal effects.

5. Data recipients and sub-processors

We share personal data only where needed to operate the service or comply with law, including with:

Supabase for database and authentication infrastructure.
The configured email/SMTP provider for contact, verification, and transactional messages.
LemonSqueezy for payment, subscription, and merchant-of-record processing.
Google LLC for OAuth authentication when you choose to link your device with Google.
Vercel Inc. for website hosting, request delivery, and operational logs where the site is deployed on Vercel.
Google/YouTube only after you choose to load embedded YouTube media; YouTube may then receive technical request data.
AI and voice providers selected in the app for the remote features described in section 2.3, under the configured provider and account conditions.

We do not sell, rent, or trade personal data to third parties for their own marketing purposes.

6. Data retention

Account and license data: retained while your account or license relationship remains active and afterwards only for as long as reasonably necessary for support, dispute handling, audit, fraud prevention, or legal compliance.
Contact submissions: retained only as long as reasonably necessary to handle the request and related follow-up, unless a longer retention period is required by law or justified by support or dispute needs.
Newsletter data: retained until you unsubscribe, plus any limited retention reasonably needed for consent audit or legal compliance.
Security and anti-abuse data: retained only for as long as reasonably necessary for security, troubleshooting, rate-limiting, evidentiary, or fraud-prevention purposes.
App usage statistics: recent summaries and daily codes are kept for about eight days, until the next daily purge. Daily aggregate totals remain for approximately thirteen months, and a cumulative total without daily codes remains for statistical communication while needed. The local preference and first participating day remain while sharing is enabled. Turning sharing off clears local measurements and requests removal of recent server contributions when online; only random codes needed to confirm removal remain locally. Older contributions that exist only as aggregate totals cannot be individually located and remain aggregated. Infrastructure security logs and backups follow the provider retention applicable to that service.
Purchase and transaction records: retained for the period required by applicable tax, accounting, and legal obligations, including records maintained by LemonSqueezy as merchant of record.

7. Your rights under GDPR

If you are in the European Economic Area, you may have the following rights:

Access: request a copy of the personal data we hold about you.
Rectification: correct inaccurate or incomplete data.
Erasure: request deletion of your data, subject to lawful retention obligations.
Portability: receive certain data in a machine-readable format.
Restriction: request restricted processing in certain situations.
Objection: object to processing based on legitimate interests, including security and anti-abuse processing, unless we have compelling grounds or another lawful basis applies.
Withdraw consent: withdraw consent for analytics, marketing or optional bug reports at any time.
Complaint: lodge a complaint with the Spanish Data Protection Authority (AEPD) at www.aepd.es.

To exercise your rights, email privacy@meltvest.com. We will respond within the legally required timeframe.

8. International data transfers

Some service providers may process data outside the European Union. Where that happens, we rely on appropriate safeguards such as Standard Contractual Clauses, adequacy decisions, or other lawful transfer mechanisms where applicable.

9. Cookies and tracking

We do not use advertising cookies or third-party analytics trackers. Our optional first-party analytics does not use analytics cookies; it only runs after you accept in the privacy notice. We store your choice, notice version and decision/expiry dates in your browser for up to 180 days. YouTube requires a separate choice lasting for this tab. We only save a referral code if you request to use it, for up to 30 days with a generic source channel and no original query string. When you link your account, we send the code to the referral service to check the benefit and attribute the invitation. You can change analytics and YouTube choices through "Privacy preferences" in the footer. Functional browser storage may also be used for authentication and product flows.

10. Children

Workspace Launcher is not directed at children under 16. If you believe we have inadvertently collected personal data from a child, contact us at privacy@meltvest.com.

11. Changes to this policy

We may update this Privacy Policy from time to time. When changes materially affect your rights, we will update the last-updated date and, where appropriate, provide additional notice by email or inside the application.

Where required by law, we will seek any additional consent needed for material changes. Otherwise, the revised policy will apply to future use of the service after you have been informed of the update.

12. Contact

Privacy questions and rights requests: privacy@meltvest.com

General support: support@meltvest.com