PRIVACY POLICY

The controller responsible for data processing on this website (Art. 4(7) GDPR) is:

SmallSoftLoaf Software - Kevin Jung
Walkmühlenstraße 28
71397 Leutenbach, Germany
USt.ID: DE462096083

Email: [email protected]

The privacy policy for the Diffract desktop application (covering in-app data processing such as license key validation and update checks) is published separately at: getdiffract.com/app-privacy.

This website is hosted and distributed via Cloudflare, Inc. (101 Townsend St., San Francisco, CA 94107, USA). As a static site, no server-side dynamic processing of personal data occurs on our origin. Cloudflare acts as a content delivery network and may process connection metadata (including IP addresses) as part of its network operations.

Legal basis: Art. 6(1)(f) GDPR - legitimate interest in reliable, secure, and performant website delivery.

International transfer: Cloudflare, Inc. is a US company. The transfer of data to the US is covered by the EU–US Data Privacy Framework (adequacy decision pursuant to Art. 45 GDPR). For details, see cloudflare.com/privacypolicy.

The following legal bases apply to processing activities on this website:

• Website hosting and CDN delivery: Art. 6(1)(f) GDPR - our legitimate interest is to make this website accessible in a fast, reliable, and secure manner.
• Cloudflare infrastructure cookies: Art. 6(1)(f) GDPR - our legitimate interest is to protect the website against bots, DDoS attacks, and abuse, and to ensure stable service delivery.

This website uses the typefaces Exo 2, DM Sans, and JetBrains Mono. These fonts are self-hosted- the font files are served directly from getdiffract.com. Your browser makes no request to Google's servers (fonts.googleapis.com or fonts.gstatic.com) when visiting this site. No data related to font loading is transmitted to any third party.

This website sets no first-party cookies and no tracking or advertising cookies.

However, Cloudflare, Inc. may set technically necessary cookies as part of its infrastructure services (security, bot protection, load balancing). These cookies are set by Cloudflare - not by this website - and are required to deliver and protect the service you requested. They do not track you across sites and are not used for advertising.

Cloudflare infrastructure cookies include:

• __cf_bm - Bot detection and mitigation (expires after 30 min of inactivity)
• cf_clearance - Records that a browser passed a security challenge
• __cflb - Load balancing session affinity (session duration)
• _cfuvid - Rate limiting for security purposes (session duration)

This website uses Plausible Analytics (Plausible Analytics OÜ, Västriku tn 2, 50403, Tartu, Estonia). Plausible is a privacy-first analytics tool that collects no personal data and sets no cookies. Page view counts and referrer data are aggregated and cannot be used to identify individual visitors. No IP addresses are stored or transmitted to Plausible. No consent banner is required for Plausible under the GDPR or the ePrivacy Directive / German TDDDG.

Legal basis: Art. 6(1)(f) GDPR - legitimate interest in understanding aggregate website traffic to improve the service.

For details, see plausible.io/privacy.

When you purchase Diffract Pro, the transaction is processed by Paddle.com Market Limited("Paddle"), 15 Lower Leeson Street, Dublin 2, Ireland, which acts as Merchant of Record for all sales. Paddle collects and processes:

• Name and e-mail address
• Payment information (credit card, PayPal, etc.)
• Billing address
• IP address and approximate geolocation (for tax determination)
• Transaction identifiers

As a data subject under the GDPR, you have the following rights:

• Art. 15 - Right of access: Request confirmation of whether and what personal data we process about you.
• Art. 16 - Right to rectification: Request correction of inaccurate data.
• Art. 17 - Right to erasure: Request deletion of your data where the legal basis for processing no longer applies.
• Art. 18 - Right to restriction: Request that processing be restricted under certain conditions.
• Art. 20 - Right to data portability: Where processing is based on consent or contract and carried out by automated means, request your data in a machine-readable format.
• Art. 21 - Right to object: Object at any time to processing based on Art. 6(1)(f). We will then cease processing unless we can demonstrate compelling legitimate grounds.

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The competent authority for the operator (resident in Baden-Württemberg) is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (LfDI BW)
Lautenschlagerstraße 20
70173 Stuttgart, Germany

Web: www.baden-wuerttemberg.datenschutz.de

• Cloudflare infrastructure cookies: Retained only for their technical lifetime - 30 minutes of inactivity (__cf_bm), session duration (__cflb), or as otherwise noted in section _04. Data stored in these cookies expires together with the cookie.
• Cloudflare CDN/infrastructure logs:Connection metadata processed by Cloudflare as part of hosting is subject to Cloudflare's own retention policies. We do not control or access these logs directly; see cloudflare.com/privacypolicy.