Privacy Statement

This is a translation. The German version of this statement is the binding one. In the event of any discrepancy, the German text prevails. It is available in the application under "File → About / Legal" and on the website at https://software.behpunktdesign.de/beh-stitched/datenschutz/.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Christian Behrenbruch
Schwarzer Weg 11A
22955 Hoisdorf
Germany

E-mail: info@behpunktdesign.de
Telephone: +49 151 11202784

No data protection officer has been appointed, as the statutory conditions requiring one are not met.

2. Principle: the software works locally

The version of Beh.Stitched you acquired processes your designs exclusively on your device. Images, vector paths, stitch data and the created embroidery files are not transmitted to us or to third parties. This characteristic is part of the contract for the version supplied (clause 13 of the licence terms). Should a later version depart from it, this will be described before that version is made available; you are not obliged to switch to such a version.

In the current version there is, beyond that, no usage analysis, no telemetry, no crash reporting and no advertising or tracking measurement; the Software currently contains no components for any of these. Should such functions be introduced in future, we will amend this statement beforehand and — where legally required — obtain your consent.

The only case in which the Software establishes a connection to the outside is the check of your licence (section 4).

3. Processing on your device

The Software stores the following information locally on your device (in the storage of the application or the browser) in order to remain usable between two starts:

• open projects and tabs from the last session,
• program settings (including language, window and panel sizes, display options),
• most recently used colours and your own presets for the pull compensation values,
• most recently opened files,
• your licence key and a randomly generated device identifier (see section 4).

This information does not leave your device and is not visible to us. You can delete it at any time by removing the application data or the website data; the Software then behaves as after a fresh installation.

If you wish to embroider text in the Software, the fonts installed on your device can be accessed on request. The font data is processed exclusively locally and is not transmitted.

4. Licence: purchase and check

4.1 Purchase

The seller of the licence is Digistore24 GmbH, St.-Godehard-Strasse 32, 31139 Hildesheim, Germany. The contract of sale is concluded between you and Digistore24 (merchant of record). Digistore24 processes the data required for the purchase — in particular your payment and invoicing data — under its own responsibility; the privacy statement of Digistore24 applies to that.

After the purchase, Digistore24 sends an automatic notification to our licence server so that the licence key can be issued. This notification contains

• the order number and your email address,
• your first and last name and your country,
• details of the order (product, quantity, amount, currency, tax rate and amount, payment type, language),
• internal identifiers of the distribution partner (buyer, address, merchant and order form).

The record also carries fields for a full postal address (street, postcode, town, state, telephone, company, form of address) — these are empty, because our order form does not collect them.

Only the order number, the product identifier and your email address are used. The product identifier merely determines which licence type is to be issued and is not stored. Only the order number and email address are stored permanently — the order number so that a payment can be matched in a support case, the email address for queries and to identify the correct key in the event of a refund.

All other details — including your name and country — are discarded immediately. They are not stored, not evaluated and not passed on. Technically this is implemented such that, once the authenticity of the notification has been verified, they are no longer available in the program flow at all.

We do not receive your payment data.

• Legal basis: Art. 6(1)(b) GDPR (performance of the contract for the use of the software).

4.2 Check

Purpose. When a licence is activated, re-checked or released, data is transmitted to our licence server in order to establish whether a valid licence exists and on how many devices it is in use.

Controller. We operate the licence server ourselves; the controller is the entity named in section 1. No payment or licensing service provider is involved.

Data transmitted. Transmitted are solely

• the licence key you entered, and
• a randomly generated identifier (UUID) created at the first activation, which makes the device distinguishable.

This identifier is generated by the software itself. It contains no hardware characteristics, no device name, no serial numbers and allows no conclusion about you or your device. For technical reasons your IP address is known to us during the connection — as with every request on the internet.

Data stored. Stored on the licence server are a cryptographic hash of the licence key (not the key itself), the device identifier, the time of activation and of the last check, as well as the order number and email address named in section 4.1.

Legal basis. Art. 6(1)(b) GDPR (performance of the contract for the use of the software) and Art. 6(1)(f) GDPR (legitimate interest in preventing unauthorised use).

No third-country transfer. The licence server is operated in Germany. The processor is checkdomain GmbH, named in section 6.1. A transfer to a third country does not take place.

Use without a connection. After activation, no connection is required to use the software. The software asks again at the earliest 14 days after the last successful confirmation. If that does not succeed it keeps working; only once more than 30 days have passed since the last successful confirmation does the export function pause, until the next contact is established. A failed attempt does not extend this period. The same period is stated in clause 3.6 of the licence terms.

Storage period. The licence-key hash and the device identifier are stored for as long as the licence is active on the device. If you release the device, the activation is lifted on the licence server; if you remove the application data, they are deleted on your device.

5. Purchase through the App Store (iPadOS)

If you buy the personal or commercial licence on an iPad, the purchase is handled through Apple's in-app purchase. Apple is the contracting party and seller in that respect; the payment data is processed exclusively by Apple. We receive neither your payment data nor your Apple ID. Apple's privacy statement applies.

6. Website

6.1 Accessing the website (server log files)

When our website is accessed, the hosting service provider automatically records information in server log files which your browser transmits. This is in particular the IP address, the date and time of access, the file requested, the volume of data transferred, the browser type and the operating system.

• Purpose: technical operation, stability and security of the website.
• Legal basis: Art. 6(1)(f) GDPR (legitimate interest in trouble-free and secure operation).
• Storage period: the log files are deleted after 14 days at the latest. IP addresses are anonymised after 24 hours where this is technically possible and sensible.

Processor: checkdomain GmbH, Große Burgstraße 27/29, 23552 Lübeck, Germany. A data processing agreement pursuant to Art. 28 GDPR is in place with this provider. The service is performed exclusively in Germany, in a member state of the European Union or in a state party to the Agreement on the European Economic Area.

6.2 No cookies, no analysis, no external content

At the time of this statement, our website sets no cookies that are not strictly necessary for operation. There is no reach or usage analysis, and no fonts, maps, videos or other content are loaded from third-party servers. Should that change, we will amend this statement beforehand and — where required — obtain your consent. For this reason no consent under § 25 TDDDG (German Telecommunications Digital Services Data Protection Act) is required, and no consent banner is displayed.

6.3 Linked external services (YouTube, Instagram)

Our tutorial videos are hosted on YouTube; we also run an Instagram profile. Neither is embedded in our website — they are only linked. Visiting our pages therefore loads nothing from YouTube, Google, Instagram or Meta — no cookies are set and no data is transmitted to these providers. The preview images are held on our own server as well.

Only when you click such a link do you leave our website and reach YouTube or Instagram. From that moment the controller is:

• for YouTube: Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland); its privacy policy applies (https://policies.google.com/privacy);
• for Instagram: Meta Platforms Ireland Limited (Merrion Road, Dublin 4, Ireland); its privacy policy applies (https://privacycenter.instagram.com/policy).

The provider may set cookies, analyse your usage and also transfer the data to the United States of America. If you are signed in to an account there, the provider can associate the visit with your account.

We have no influence over that processing and receive no personal data about your visit from these providers.

6.4 Contact form and e-mail

If you contact us via the contact form or by e-mail, we process the information you provide (in particular your name, e-mail address and the content of your message) in order to answer your enquiry.

• Legal basis: Art. 6(1)(b) GDPR where your enquiry serves the initiation or performance of a contract, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries).
• Storage period: we delete your enquiry at the latest 12 months after it has been finally dealt with, unless statutory retention obligations prevent this.

7. No automated decision-making

Automated decision-making including profiling within the meaning of Art. 22 GDPR does not take place.

8. Your rights

You have the following rights against us in respect of the personal data concerning you:

• access (Art. 15 GDPR),
• rectification (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• objection to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR),
• withdrawal of a consent given, with effect for the future (Art. 7(3) GDPR).

An informal message to info@behpunktdesign.de is sufficient to exercise them.

9. Right to complain to a supervisory authority

Without prejudice to other remedies, you have the right to complain to a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:

Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (ULD)
Holstenstraße 98
24103 Kiel
Germany

10. Changes to this statement

We adapt this privacy statement when the Software, our website or the legal situation changes. The version published on our website at the relevant time applies.

Version: July 2026