Privacy Policy (GDPR)

This document explains how personal data is processed in connection with the Direct Edit tool and the website directedit.dev. We only process the minimum data necessary for the operation of the service. Direct Edit itself runs locally on the customer's server and does not collect any data about the visitors of your website.

1. What data is processed and why?

a) Data collected during purchase and licence activation

Data Type	Purpose
Email address	Delivery of licence key, support communication, and important product updates.
Domain	Verification of licence plan usage and prevention of licence abuse.
Activation timestamp and version	Technical diagnostics, compatibility checks, and auto-update management.
Billing information	Compliance with legal accounting and tax obligations.

b) Customer account data (Freelancer and Agency plans)

Customers on Freelancer or Agency plans have access to a customer dashboard at directedit.dev. Login is handled via a magic link sent to the registered email address - no permanent password is stored. Within the account, the following data is processed:

• Email address (account identification).
• List of activated domains and their status.

c) Auto-updater

Direct Edit includes an automatic update mechanism. When triggered, it communicates with the operator's update server (Hukot, Czech Republic), transmitting: the installed software version, the installation domain, and the licence key. This communication is used solely to verify entitlement to download the update.

d) Website analytics (directedit.dev)

The website uses Plausible Analytics - a privacy-first analytics tool. It does not use cookies, does not track users across websites, and does not process personal data as defined by GDPR. We run a self-hosted instance on a server located in the Czech Republic. No data is shared with third parties.

e) Email marketing (newsletter)

With your consent (or on the basis of legitimate interest within an existing contractual relationship), your email address may be used to send you news - such as new features or important announcements. We use Ecomail for this purpose. You may unsubscribe at any time via the link in any email.

2. Legal basis for processing

Processing Activity	Legal Basis
Licence delivery and service operation	Performance of a contract (Art. 6(1)(b) GDPR)
Licence verification and abuse prevention	Legitimate interests (Art. 6(1)(f) GDPR)
Accounting and tax obligations	Legal obligation (Art. 6(1)(c) GDPR)
Customer dashboard and security logs	Performance of a contract / Legitimate interest
Newsletter	Consent (Art. 6(1)(a) GDPR) or Legitimate interest (existing customers)

3. Who has access to your data? (Processors)

Data is not sold or transferred to third parties for their own purposes. Access is limited to the following processors, strictly within the scope necessary to provide their service:

• Hukot (hosting): Server infrastructure, dashboard, and update server (Czech Republic / EU).
• SimpleShop: Payment and order processing (Czech Republic).
• Ecomail: Transactional emails and newsletter delivery (Czech Republic / EU).

Planned: International payment gateway (to be confirmed upon launch - this page will be updated accordingly).

4. Data retention

Data Category	Retention Period
Licence and activation data	Duration of licence + 3 years after termination (legitimate interest, support).
Billing and accounting records	10 years (statutory obligation).
Customer account (dashboard)	Until account deletion or 2 years after last activity.
Security logs	90 days.
Newsletter consent	Until consent is withdrawn.

5. Your rights

You have the following rights under GDPR:

• Access - request an overview of your personal data.
• Rectification - request correction of inaccurate data.
• Erasure - request deletion of your data where legally permissible.
• Restriction - request temporary restriction of processing.
• Portability - receive your data in a machine-readable format.
• Object - object to processing based on legitimate interest.
• Withdraw consent - withdraw your newsletter consent at any time.

Requests should be sent to: hello@directedit.dev

If you believe your rights have been violated, you have the right to lodge a complaint with the Office for Personal Data Protection (ÚOOÚ): www.uoou.cz. You may also contact the supervisory authority in your country of residence within the EU.

6. Security

• All communication is encrypted via HTTPS/SSL.
• Direct Edit running on the customer's server does not collect data about website visitors.
• Customer account access is protected by a magic link mechanism (no permanent password).
• Access to personal data is restricted to authorized personnel only.

7. Changes to this document

This document may be updated from time to time - for example, when an international payment gateway is added. Active customers will be notified of material changes by email.