# BeamDesk Privacy Policy

**Effective:** 2026-06-01
**Last updated:** 2026-06-01

This Privacy Policy explains what information **Jonathan Bucci Productions, LLC** ("**we**", "**us**", "**our**") collects when you use BeamDesk, why we collect it, and what your rights are.

We have designed BeamDesk to need very little information about you. This is not marketing language — it is a deliberate product decision. Most of what would be a "data collection" section in another company's privacy policy simply does not apply, because the data does not exist on our servers.

---

## 1. The short version

When you use BeamDesk, we collect:

- A **license code** so we know which subscription you are using.
- A **machine fingerprint** (a hashed identifier derived from your computer's hardware) so we can enforce the three-device limit in our Terms of Service.
- The **date and time** of your most recent license validation, plus the **IP address** the validation came from (for fraud / abuse prevention).
- Information that **Paddle** collects from you when you pay: name, email, billing country, and payment-method metadata. Paddle is our [Merchant of Record](./terms-of-service.md#2-merchant-of-record) and we receive a subset of this information so we can deliver your license code and provide support.

**We do NOT collect:**

- Anything inside your project files (drawings, fixture lists, channel hookups, paperwork, exports, magic sheets, custom layers, or anything else you create with BeamDesk).
- Telemetry about which features you use, when you open the app, or how long you use it.
- Crash reports or diagnostic logs sent automatically to us.
- Your full payment card number or banking details — those stay with Paddle.
- Any information for advertising, analytics, third-party sharing, or resale.

Project files live on **your computer's local file system.** They never leave your machine except when you choose to send them (email, upload to your own cloud storage, hand off to a colleague). We have no access to them.

---

## 2. Who we are

**Jonathan Bucci Productions, LLC**, a Pennsylvania limited liability company. Email: **beamdesk@jbp.design** for all inquiries (general support, privacy requests, legal notices — one inbox).

---

## 3. What we collect and why

### 3.1 License validation data

| Data | Why we collect it | Where it lives |
|---|---|---|
| License code | To identify your subscription and grant access to the app. | Our license-validation database. |
| Machine fingerprint (hashed) | To enforce the three-device limit. The fingerprint is a one-way hash; we cannot reverse it to identify your specific computer model, serial number, or user account. | Our license-validation database. |
| Last-validated timestamp | To support the 14-day offline grace period and detect anomalous activation patterns. | Our license-validation database. |
| IP address of validation request | To detect and respond to license-sharing or fraud (e.g., the same license activating from many countries in a short window). | Our license-validation database, retained for **90 days**. |

### 3.2 Information Paddle shares with us

When you purchase a BeamDesk subscription through Paddle, we receive:

- Your **name** (as entered at checkout).
- Your **email address** (to send your license code and provide support).
- Your **billing country** (for sales tax compliance and regional product behavior).
- Your **subscription plan** (monthly / annual / team tier).
- Your **subscription status** (active, canceled, past due, refunded).

We **do not** receive: your full payment card number, your card's CVV, your full billing address (unless we explicitly need it for a support case, which we will request from you directly), or any payment behavior from your other Paddle purchases.

Paddle's own privacy practices govern everything Paddle does with your payment information. See [Paddle's Privacy Policy](https://www.paddle.com/legal/privacy).

### 3.3 Information you send us in support emails

When you email us at `beamdesk@jbp.design`, we receive whatever you send: your message, any attachments (such as a project file you choose to share for debugging), and your email metadata. Support correspondence is retained for as long as the conversation is useful for ongoing assistance — typically up to **two years** — and may be retained longer if relevant to a billing dispute or legal matter.

### 3.4 Marketing website

Our marketing website at [beamdesk.app](https://www.beamdesk.app) is hosted on Squarespace. Squarespace places standard analytics cookies and may collect basic visit information (page views, referrer, browser type). See [Squarespace's privacy policy](https://www.squarespace.com/privacy) for details. The BeamDesk desktop application itself does not use cookies or web analytics.

---

## 4. What we do NOT collect

To be explicit, the BeamDesk desktop application does not:

- Read, transmit, or analyze your project files (`.bdp`, `.bdb`, `.bdf`) or any exported artifacts.
- Send usage telemetry to us or any third party.
- Automatically send crash reports. If BeamDesk crashes, no data leaves your computer unless you choose to send us a log file as part of a support request.
- Track which features you use, which menus you open, or which fixtures you place.
- Connect to advertising networks, analytics services, or tracking pixels.
- Access your contacts, calendar, microphone, camera, or location.
- Access files on your computer other than those you explicitly open or save in BeamDesk.

If our data-collection posture changes in a future release of BeamDesk — for example, if we add an opt-out crash reporter — **we will update this Privacy Policy and notify active subscribers by email before the change takes effect.**

---

## 5. How we use the information we collect

We use the limited information we collect only to:

- Operate the license validation system that powers your subscription.
- Send you transactional emails (license code on purchase, password reset, billing notifications, subscription-end reminders, security advisories).
- Respond to your support inquiries.
- Investigate suspected fraud, abuse, or violations of our Terms of Service.
- Comply with legal obligations (e.g., responding to a valid subpoena).

We do not use your information to profile you, target you with ads, train AI models, or sell to third parties. We do not have a marketing list separate from the transactional system — if you receive an email from us, it is because it relates directly to your subscription.

---

## 6. Who we share information with

We share information only with the small number of service providers we need to run BeamDesk:

| Provider | Purpose | What they receive |
|---|---|---|
| **[Paddle](https://www.paddle.com/legal/privacy)** | Billing, payment processing, tax compliance, customer billing portal. | Everything Paddle needs to process payments. We do not send Paddle information beyond what is necessary for billing. |
| **Cloud hosting (license-validation infrastructure)** | Operates the license-validation server. | License validation data (license code, fingerprint hash, validation timestamp, IP address of validation request). |
| **Email delivery provider** | Sends transactional emails (license code, support replies, billing notices). | Your email address and the contents of the email being sent. |

We will update this list if we add or change service providers in a way that materially affects your data.

We will share information with law enforcement or other authorities **only** in response to a valid legal demand (subpoena, court order, or equivalent) or where we believe in good faith that disclosure is required to prevent imminent harm. We will notify you of any such demand to the extent we are legally permitted to do so.

We do not sell or rent your personal information. We never have. We do not plan to.

---

## 7. Data retention

| Data | Retained |
|---|---|
| Active license records | For the duration of your subscription, plus 30 days after final cancellation, then anonymized. |
| IP address of validation requests | 90 days. |
| Account email and name | For the duration of your subscription, plus a reasonable archival period for billing records (typically 7 years, per accounting practice). |
| Support correspondence | Up to 2 years from last contact, longer if relevant to an open billing or legal matter. |
| Paddle-held data (payment info, full billing address) | Per Paddle's own retention practices. See [Paddle's Privacy Policy](https://www.paddle.com/legal/privacy). |

---

## 8. Where your data is stored

Our license-validation servers and email delivery infrastructure are operated in the United States. Paddle operates internationally and may process your data in multiple jurisdictions; see Paddle's privacy policy for details. If you are located outside the United States, your information will be transferred to and processed in the United States, where data-protection laws may differ from those in your country.

---

## 9. Your rights

Depending on where you live, you may have the following rights regarding your personal information:

### Everyone

- **Access.** You can ask us what information we have about you. Because we hold so little, the answer is usually short — typically your email, name, country, license code, and validation timestamps.
- **Correction.** You can ask us to correct inaccurate information. You can update your name and email directly in the Paddle customer portal.
- **Deletion.** You can ask us to delete your information. We will do so, subject to legal retention requirements (billing records, etc.). Note that deleting your license-validation record terminates your subscription's ability to function.
- **Portability.** You can ask us to export your information in a machine-readable format. As above, the dataset is small.
- **Opt-out of marketing.** We do not send marketing emails. If you ever receive an email from us that you believe is marketing rather than transactional, please reply asking us to stop, and we will.

### Residents of the European Union, United Kingdom, or other jurisdictions with comprehensive privacy laws (GDPR, UK GDPR)

In addition to the above:

- **Legal basis for processing.** We process your information under the lawful bases of (a) **performance of a contract** (your subscription), (b) **legitimate interests** (fraud prevention, security), and (c) **legal obligation** (tax records, responding to legal demands).
- **Right to restrict processing.** You can ask us to limit how we use your information.
- **Right to object.** You can object to processing based on legitimate interests.
- **Right to lodge a complaint** with your national data protection authority. We would prefer you contact us first so we can address the concern directly.
- **Paddle as our Merchant of Record** acts as the data controller for billing information and as a processor for some other data. See Paddle's privacy documentation for details.

### Residents of California (CCPA / CPRA)

In addition to the rights listed above:

- **Right to know** what categories of personal information we collect, the sources, the business purposes, and the third parties we share with — all of which are described above in this Policy.
- **Right to delete** subject to legal retention exceptions.
- **Right to opt out of "sale" or "sharing."** We do not sell or share personal information for cross-context behavioral advertising. There is nothing to opt out of.
- **Right to non-discrimination.** We will not deny you BeamDesk, charge you a different price, or provide a different level of service because you exercised a privacy right.

To exercise any right, contact us at **beamdesk@jbp.design**. We will verify your identity (typically by confirming you can receive email at the address on file) before acting on the request. We aim to respond within **30 days**.

---

## 10. Children's privacy

BeamDesk is not directed at children under 13 (United States) or under 16 (European Union). We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, please contact us at **beamdesk@jbp.design** and we will delete it.

---

## 11. Security

We use industry-standard security practices to protect the information we hold:

- License-validation traffic is encrypted in transit (TLS).
- License-validation data is encrypted at rest.
- Access to our infrastructure is restricted to authorized personnel and audited.
- We do not store payment card numbers — those are held by Paddle, which is PCI-DSS Level 1 certified.

No system is perfectly secure. If we discover a breach affecting your personal information, we will notify affected customers as soon as reasonably possible and as required by applicable law.

---

## 12. Changes to this Policy

When we update this Privacy Policy:

1. We will update the "Last updated" date at the top.
2. For material changes, we will notify active subscribers by email at least **30 days** before the change takes effect.
3. If a change introduces new data collection (such as adding crash reporting or telemetry), we will obtain consent where required by law before the new collection begins.

Continued use of BeamDesk after the effective date of a change constitutes acceptance of the updated Privacy Policy.

---

## 13. Contact

**Jonathan Bucci Productions, LLC**
532 Stiefel Ave, Ellwood City, PA 16117
Email: **beamdesk@jbp.design** (all inquiries — general support, privacy requests, legal notices)

For billing-related privacy questions involving payment data held by Paddle, contact Paddle directly via the [Paddle customer portal](https://www.paddle.com/customers).