Privacy Policy

Last updated: July 15, 2026

This policy explains what personal data we process when you use the OrchestraX website, buy a license, or use the OrchestraX software's activation features — and why, for how long, and what your rights are.

Who we are

The data controller is Maj13 LLC,[LEGAL FORM, REGISTRATION NUMBER],[REGISTERED ADDRESS]. Contact: support@maj13.com.

What we collect, and why

• Purchase & account data — your email address, language preference, country (provided by the payment processor), order history and license keys. Purpose: delivering what you bought, your customer account, invoicing. Legal basis: performance of a contract; legal accounting obligations.
• Payment data — processed entirely by Stripe or PayPal. Your card or PayPal details never reach our servers; we receive only a payment reference, the amount and your email. Legal basis: performance of a contract.
• License activation data — when the software activates, validates or deactivates a license: a device identifier (a technical fingerprint), the device name you chose, the software version, your IP address and the country derived from it. Purpose: enforcing the activation limit and detecting license fraud and key sharing. Legal basis: our legitimate interest in protecting our product; performance of the license agreement.
• Sign-in data — one-time login links sent by email and session tokens. We store only cryptographic hashes of these tokens. Legal basis: performance of a contract.

We do not sell personal data, run advertising, or build profiles.

How long we keep it

• Activation/validation telemetry (incl. IP addresses): deleted after 90 days.
• Login links: valid 15 minutes; sessions expire after 30 days. Expired records are purged automatically.
• Account, license and order data: for as long as your license is active, then per statutory retention.
• Invoices and order records: retained as required by accounting law (up to 10 years in France).

Who processes it for us

• Stripe and PayPal — payments, refunds, invoices.
• [SMTP PROVIDER] — sending transactional emails (license delivery, sign-in links).
• [HOSTING PROVIDER] — server hosting; [BACKUP STORAGE PROVIDER] — encrypted database backups.

Cookies

• ls_session (essential) — keeps you signed in to your customer account for up to 30 days. Set only when you sign in; exempt from consent.
• Analytics (optional) — currently none. If we introduce audience measurement, it will load only after you opt in via the cookie banner. You can change your choice anytime via “Cookie preferences” in the footer.

Your rights

Under the GDPR you can request access to, rectification or erasure of your data, its portability, and restriction of or objection to processing. Write to support@maj13.com; we answer within one month. You may also lodge a complaint with your supervisory authority (in France: the CNIL, cnil.fr).

Note that erasing purchase records is limited by our legal duty to retain invoices, and that erasing your license data ends our ability to honor the license.