Privacy policy

What stack.f3lab.tools and the application Stack by F³ Lab do with personal data. In force from 5 September 2026.

1. Who is responsible

The controller of the personal data is The Zone Modest Reszewicz, NIP 6932129511. Every question and every request about personal data goes to support@f3lab.tools.

2. What is collected, and why

Free edition registration.

  • Name, e‑mail address, optionally a company or school name, and the machine code — to issue the license file, which carries the name and e‑mail, and to send it. Legal basis: the license agreement (GDPR art. 6(1)(b)).
  • The IP address and browser identification at the moment of registration — to prevent abuse of the free registration. Legal basis: the seller’s legitimate interest (art. 6(1)(f)).
  • The e‑mail address is also used to contact registered users about Stack itself: a new version, a change to the editions, a security notice. Legal basis: legitimate interest in keeping users of the software informed; each such message carries a way to opt out.

Purchase of a Pro license.

  • Name, address, e‑mail, optionally company name and VAT number, the machine code, and the order history — to conclude and perform the contract, issue the license and the invoice, and handle complaints. Legal basis: the contract (art. 6(1)(b)) and legal obligations in tax and accounting law (art. 6(1)(c)).
  • Payment data is handled by Stripe; the seller receives confirmation of payment, the last digits of the card and the payment method, never the card number.

Correspondence. Messages sent to support@f3lab.tools are kept to answer them and to document the conversation. Legal basis: legitimate interest.

The application itself. Stack works offline and sends no data anywhere. The license file, the machine code and the application’s settings and logs stay on the user’s computer. The only network request the application ever makes is the one the user triggers with Help → About → Check for updates: a request for a small version file from this site, in which the site’s hosting provider sees the requesting IP address as with any web page.

The machine code is a one‑way hash of a Windows installation identifier. It cannot be turned back into any hardware or personal detail; it only lets a license be matched to the computer it was issued for.

3. Who receives the data

Data is passed only to providers needed to run the service, each bound by a data‑processing agreement:

  • Stripe Payments Europe, Ltd. (Ireland) with Stripe, Inc. (USA) — payment processing and fraud prevention.
  • Railway Corp. (USA) — hosting of the site, the shop and the license register.
  • Resend, Inc. (USA), sending from servers in the European Union — delivery of transactional e‑mail (order confirmations, license files, renewal reminders).
  • Google Ireland Ltd. — the seller’s mailbox for correspondence.
  • The seller’s accountant, for invoices, and public authorities where the law requires it.

Where a provider processes data in the United States, the transfer rests on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the European Commission’s standard contractual clauses. Data is not sold and is not used for advertising.

4. How long the data is kept

  • Order and invoice data: five years from the end of the tax year of the sale, as tax law requires.
  • License records (name, e‑mail, machine code, edition, dates): for the life of the license and three years after it ends, the period in which claims can be raised.
  • Free edition registrations: as long as the license is in use. A registered user may ask for deletion at any time; the Free license issued to that record then stops being valid.
  • Correspondence: three years from the last message.
  • Registration IP addresses and browser identification: twelve months.

5. Your rights

Everyone whose data is processed may ask for access to it, for a copy, for correction, for deletion, for restriction of processing, for its transfer to another controller, and may object to processing based on legitimate interest. A request goes to support@f3lab.tools and is answered within one month. A complaint may be lodged with the supervisory authority: in Poland the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00‑193 Warszawa), or with the authority of the country of residence.

Giving the data is voluntary, but without a name, an e‑mail and a machine code no license can be issued, and without an address no invoice.

6. Cookies

The site uses only the cookies it needs to work: one that remembers the shopping cart, one that keys the site’s cache, and, on the checkout page, Stripe’s fraud‑prevention cookies. There are no analytics, no advertising trackers, no social‑media buttons, and therefore no consent banner. Blocking cookies in the browser stops the cart and the checkout from working; the rest of the site reads fine.

7. Security

The site is served over HTTPS only. The license register lives in a database reachable only by the shop’s backend. License files are signed with a private key that is not kept on any server; a Free license is signed by a separate key held by a service that can sign nothing else. Access to the shop’s administration is protected by a password and limited to the seller.

8. Changes

This policy changes when the service does, for example when a provider is replaced. The current version is always at stack.f3lab.tools, with its effective date at the top.