Privacy policy
Last updated: October 28, 2026. How Indmaksoft ("we", "us") handles personal data across indmak.com and our desktop apps — FirmamentPro, FieldLedger, SheetScrub, DocDiet, TextScalpel, RarZap and Vidly.
1. Who we are (data controller)
Indmaksoft, Flat 226, Chun Tip House, Fu Tip Estate, Tai Po, Hong Kong, is the data controller for the processing described below. For privacy inquiries, data requests or complaints, contact legal@indmak.com. We respond to verified requests within 30 days.
This policy is written to meet our obligations under applicable privacy laws, including the EU/UK GDPR and the CCPA/CPRA, to the extent they apply to you.
2. Scope
This policy covers this website (including your account, checkout, downloads and support), our licensing and trial services, and the desktop applications listed above.
Product-specific notices add detail where an app handles data differently: FirmamentPro privacy policy and FieldLedger privacy policy.
3. Our design principle: local-first
Our desktop apps keep your working data — matters, clients, farm records, documents, spreadsheets, media — in local databases and files on your own computer. We do not receive, host or read that content.
FirmamentPro stores everything in an encrypted vault (AES-256, SQLCipher) unlocked by a master password that never leaves your device; we cannot open it and cannot recover the password. Other apps keep their files locally as well.
Apps connect to our services only for sign-in, starting a trial, activating and periodically checking a license, downloading updates, and any AI request you explicitly trigger. The apps contain no advertising SDKs and no third-party analytics.
4. Information we collect
- Account data: email address, display name (optional), password hash (PBKDF2-SHA256 with a per-user salt), account creation date.
- License, device and trial data: license keys, product and entitlement status, subscription periods, and the device fingerprint and device name you submit when activating. Fingerprints are one-way SHA-256 hashes of a machine identifier — never raw machine IDs or hardware serials.
- Purchase and billing data: transaction identifiers, product, amount, currency, tax country and checkout email. Card and bank details are handled exclusively by our merchant of record and never reach our servers.
- Support communications: messages and attachments you send us.
- Update checks: app version, platform and CPU architecture (no identifier).
- Technical logs: IP address, timestamp, path, user agent and outcome, used for security, rate limiting and debugging.
- Cookies: strictly necessary session and anti-abuse cookies only.
5. What we do not collect
- No content of your records, documents, spreadsheets, media or vault — from any app.
- No analytics or usage telemetry from the desktop applications.
- No precise geolocation, advertising identifiers, or sale/sharing of personal data for advertising.
6. How we use information, and our legal bases
Under the GDPR we rely on the following legal bases; elsewhere, equivalent grounds.
- Contract performance — accounts, licensing, payments, downloads and support you request.
- Legitimate interests — fraud and abuse prevention (including trial and license abuse), rate limiting, reliability, and understanding aggregate sales. Never used for advertising profiling.
- Legal obligation — tax-relevant purchase records, lawful requests, enforcing our Terms.
- Consent — only where required, such as an opt-in product-updates list; you can withdraw at any time.
7. Sharing and disclosure
We do not sell personal information. We share it only with service providers that help us operate:
- Creem (merchant of record) — checkout, payments, tax, invoices and refunds; Creem acts as an independent controller for its own KYC/AML and tax duties.
- Cloudflare — hosting, CDN, database, object storage and security for this site and our licensing service.
- Resend — transactional email (receipts, license keys, support replies).
- Distribution channels — the Microsoft Store (FirmamentPro, FieldLedger, RarZap commercial) and GitHub (open-source builds) process installation and download data under their own policies.
- Authorities and advisers — where required by law or to protect rights and safety; where permitted we will notify you.
8. Retention
- Account and license data: while the account is active and as long as needed to honor licenses. After deletion we keep a minimal purchase record required for tax/accounting (typically 7 years) and anti-abuse.
- Device and trial records: while the license or trial is active, or as long as needed to enforce one-trial-per-device.
- Technical logs: generally up to 30 days, then deleted or aggregated.
- Support correspondence: up to 24 months.
9. International transfers
Our providers operate globally, so data may be processed outside your country (including the United States). For EEA/UK/Swiss residents we rely on appropriate safeguards such as Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework. You can request a copy via legal@indmak.com.
10. Security
- Passwords are stored only as salted PBKDF2-SHA256 hashes; sessions use signed, short-lived tokens in HttpOnly, Secure, SameSite cookies with server-side revocation.
- Administrative access requires TOTP two-factor authentication.
- License files are signed with Ed25519 keys that never leave our server environment.
- All traffic uses TLS 1.2+; data at rest is encrypted by our infrastructure providers.
- If we become aware of a breach affecting your personal data, we will notify you and the authorities as required by law.
11. Your rights
Subject to your jurisdiction and legal exemptions, you may:
- Access and receive a portable copy of the personal data we hold about you.
- Correct inaccurate data (email and display name in your account).
- Delete your account and associated data, subject to records we must retain by law.
- Object to or restrict processing based on legitimate interests, and withdraw consent.
- Opt out of sale/sharing — we do not engage in either, so there is nothing to opt out of.
- Non-discrimination for exercising your rights; you may also complain to your local supervisory authority (we ask that you contact us first).
12. Cookies
We use only strictly necessary cookies (session and anti-abuse). No analytics, advertising or social cookies, so no cookie banner is required. Clearing cookies signs you out but does not affect desktop apps or licenses.
13. Children
Our services are for business use by adults. We do not knowingly collect data from children under 16 (or the applicable digital-consent age). If you believe a child provided us information, contact legal@indmak.com.
14. Do Not Track
We do not track users across sites, so Do Not Track / Global Privacy Control signals require no special handling — all users are treated as opted out of cross-site tracking.
15. Changes
If we make material changes we will update the date above and, where the change significantly affects you, notify account holders by email. Continued use after changes constitutes acceptance.
16. Contact
Privacy questions, data requests or complaints: legal@indmak.com. Support questions: support@indmak.com.