Privacy Policy.
Voicehaus (business ID: FI31609011, registered in Finland) is the data controller for the personal data described in this policy. This policy explains what data we collect when you use Enlarger or visit enlarger.app, why we collect it, and what rights you have under the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and the Finnish Data Protection Act (Tietosuojalaki, 1050/2018).
If you have questions about this policy or wish to exercise your rights, contact us via the support form at enlarger.app/support/form.
1. Data We Collect and Why
We collect only what is necessary to provide the Software and support you. The table below sets out each processing activity, the data involved, the legal basis, and how long we keep it.
| Activity | Data | Legal basis | Retention |
|---|---|---|---|
| Purchase processing | Name, email address, billing details, purchase amount and country is processed by Stripe on our behalf. | Contract performance (Art. 6(1)(b) GDPR) | Financial records kept for 6 years as required by the Finnish Accounting Act (Kirjanpitolaki, 1336/1997). |
| License delivery | Email address used to deliver your License Key after purchase. | Contract performance (Art. 6(1)(b) GDPR) | Retained with the purchase record (6 years). |
| Account authentication | Email address used for one-time passcode (OTP) sign-in to the activation dashboard. | Contract performance (Art. 6(1)(b) GDPR) | Retained while your account exists; deleted upon verified erasure request. |
| License activation | A SHA‑256 hash of your device’s hardware identifier (the raw identifier never leaves your device), a device name you choose, your user account ID, and the License Key. Stored to enforce activation slot limits and enable deactivation. | Contract performance (Art. 6(1)(b) GDPR) | Retained while the activation is active. Deleted when you deactivate the device. |
| Trial usage tracking | A SHA‑256 hash of your device’s hardware identifier, sent once per processing operation in Trial Mode to decrement the trial counter. | Legitimate interest (Art. 6(1)(f) GDPR); preventing abuse of the trial limit | Retained for 5 years from the date of last trial activity. |
| Support requests | Name, email address, message content, and optional technical information you provide via the support form. | Legitimate interest (Art. 6(1)(f) GDPR); providing customer support | 2 years from receipt. |
| Website analytics | Anonymised page views, referrer, browser type, and country; collected via Umami, a cookieless analytics tool. No personal data is collected or stored; no cookies are set. | Not applicable; no personal data is processed | Aggregated; no individual retention period. |
2. Cookies and Local Storage
enlarger.app (this website) sets no cookies itself. Umami, which we use for analytics, is cookieless by design.
dashboard.enlarger.app sets a single strictly necessary session cookie to keep you signed in during the activation flow. This cookie expires when you close the browser session or sign out. No consent is required for strictly necessary authentication cookies.
Cloudflare may set a cf_clearance security
cookie after your browser passes an automated threat check. This cookie
proves to Cloudflare that you are a verified human visitor and is strictly
necessary for protecting the site against bots. It expires after 30 minutes.
3. Third-Party Processors
We share your data with the following processors who act on our instructions:
| Processor | Purpose | Location | Safeguard |
|---|---|---|---|
| Stripe, Inc. | Payment processing | USA | EU–US Data Privacy Framework; Standard Contractual Clauses |
| Supabase, Inc. | Database and authentication | EU (Ireland) | Data stored within the EU |
| Cloudflare, Inc. | Hosting, CDN, and bot protection | EU / USA | EU–US Data Privacy Framework; Standard Contractual Clauses |
| Umami Software, Inc. | Website analytics | USA | No personal data transferred; analytics are fully anonymised |
We do not sell, rent, or share your personal data with any third party for their own marketing purposes.
4. Your Rights
Under the GDPR you have the following rights in relation to your personal data:
- Access
- You may request a copy of the personal data we hold about you (Art. 15).
- Rectification
- You may ask us to correct inaccurate data (Art. 16).
- Erasure
- You may ask us to delete your data (“right to be forgotten”, Art. 17). We will comply unless we are required to retain data by law (e.g. accounting records). Erasure of activation data will deactivate the associated device(s).
- Restriction
- You may ask us to restrict processing of your data in certain circumstances (Art. 18).
- Portability
- Where processing is based on contract or consent and carried out by automated means, you may receive your data in a machine-readable format (Art. 20).
- Objection
- You may object to processing based on legitimate interests (Art. 21). We will stop processing unless we demonstrate compelling legitimate grounds that override your interests.
To exercise any of these rights, contact us via the support form. We will respond within 30 days. We may need to verify your identity before fulfilling a request.
5. Supervisory Authority
If you believe we have processed your data unlawfully, you have the right to lodge a complaint with the Finnish Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto):
Tietosuojavaltuutetun toimistoPO Box 800, FI-00531 Helsinki, Finland
tietosuoja.fi
If you are located in another EU member state, you may also contact your local supervisory authority.
6. Security and Breach Notification
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, or destruction. In the event of a personal data breach likely to result in a high risk to your rights and freedoms, we will notify you without undue delay (GDPR Art. 34). We will also notify the Finnish Office of the Data Protection Ombudsman within 72 hours of becoming aware of any notifiable breach (GDPR Art. 33).
7. Changes to This Policy
We may update this policy from time to time. Material changes will be communicated by updating the effective date above and by notifying affected users by email before the change takes effect. For material changes that affect how we process your personal data, the updated policy will not apply to you until you have received that notice. For minor, non-material updates (such as clarifications or formatting corrections), continued use of the Software after the effective date serves as acknowledgement of the change.