Your data · Your rights
Privacy notice
Registration number: 742254
Privacy contact: support@pollux.lt
PolluxTool edits binary files on your device. This notice explains the separate account, payment and website data we process, why we need it and your rights.
1. Who is responsible
The operator identified above is the controller for PolluxTool accounts and the pollux.lt website. This notice covers the editor, account service and subscriptions. A separate service you visit through a link has its own privacy arrangements.
2. Data we handle and why
| Data | Purpose and basis |
|---|---|
| Account name, fixed registered email, password hash, verification and authenticator settings, sign-in sessions, browser user agent and access status. | Create and operate the account and provide requested features: performance of our service contract. Protect sign-in and investigate incidents: our legitimate interests in service security. |
| Preferences, functional device preference identifiers, saved search/bookmark/scaling presets and scripts you choose to save to your account. Preferences may contain text you enter, including search terms or code. | Provide the settings and account storage you request: performance of our service contract. Avoid including secrets or other people's personal data in saved scripts or presets. |
| Plan, subscription/payment references, pass expiry and payment-event records. Stripe receives the contact, address and payment details you enter on its page. | Provide paid access and administer the purchase: performance of our service contract. Keep required accounting/tax records: applicable legal obligations. Prevent duplicate grants, fraud or resolve a claim: legitimate interests. |
| Session-linked identifiers, server-observed account access times, app version, approximate connected duration and a bounded history of direct connection IP addresses and an approximate country inferred locally from a country database. No IP addresses are sent to the database provider. | Account security, abuse prevention and licence compliance: our legitimate interests in protecting accounts and operating the licensed service. These limited records are part of the account service. They contain no opened file contents, filenames, keystrokes or command counts. |
| Recorded versions and time of agreement to the service terms and software licence and acknowledgment of this privacy notice; transactional email copies/delivery status, invitations, privacy requests and replies. | Provide and document the account contract, communicate about the account and handle your request: contract, legal rights-handling duties and legitimate interests in reliable support and resolving claims, as applicable. |
| Web-server/security logs may record IP address, request time, requested path and browser details. | Operate and secure the hosting environment: legitimate interests in reliable and secure service delivery. |
We obtain these details from you, your browser, account administrators acting on an invitation or support request, and payment status returned by Stripe. We do not sell personal data, send advertising campaigns to account email addresses or use the editor's file bytes for advertising. Accepting the service terms is not consent to unrelated marketing or analytics.
3. Your files stay on the device
Opening, editing, comparing, searching, calculating checksums and viewing maps take place in your browser and browser workers. The account service does not receive the opened binary contents or filenames through normal editing or account-access reporting. Local recovery/workspace storage may contain binary data, names and drafts on this device. Account-saved scripts and presets are different: their text is sent to the account service when you save it there.
You control files you manually export, upload elsewhere or include in support messages. Do not send passwords, identity documents or sensitive file contents unless a specific support need has been agreed.
4. Hosting, email and payments
PolluxTool uses UAB Interneto vizija for the hosting environment. Transactional messages are passed to the configured mail transport and then your email provider. Authorised administrators and providers acting for us may access the data needed for their role.
Payments and the customer billing portal are provided by Stripe. Card numbers are entered on Stripe's hosted page and are not stored by the PolluxTool account service. Saving a payment method is your choice in Checkout; recurring payments follow the subscription you purchase.
Stripe may act as a processor for some services and as an independent controller for its own fraud prevention, regulatory and payment-network responsibilities. Some provider processing or support can involve countries outside the EEA. Applicable provider agreements and transfer safeguards, such as adequacy decisions or standard contractual clauses, govern those transfers. Contact the privacy address above for information or copies of the safeguards that apply to your data.
5. How long we keep it
- Account details, saved preferences and scripts: while the account is needed to provide the service, then removed on an accepted erasure request except for justified legal/security retention.
- Account access, session and connected-duration records: the configured 365-day retention schedule. At most ten recent direct connection addresses are kept in the account history, under the 365-day schedule. Earlier versions may have retained additional activity totals; those remain subject to the applicable retention and rights-review process. New reporting does not measure keystrokes, commands or active/idle interactions.
- Application security/audit events: 365 days. Transactional email copies: 365 days. Closed privacy-request records: 365 days. Open requests are retained to handle the request. Agreement evidence is kept with the account and any justified contract/claims record.
- Sign-in sessions expire after 12 hours, or up to 30 days when you request Remember me. Verification, password-reset and MFA challenge links have short validity periods; expired tokens are cleaned by maintenance.
- Payment, invoice and minimal duplicate-payment prevention records: for applicable accounting/tax obligations and the period needed to establish or defend a claim; account erasure does not automatically remove Stripe invoices.
- Hosting logs and backups rotate under the hosting/security arrangements. A backup may persist until its rotation period ends. When restoring a backup we must reapply accepted erasure and restriction requests before normal use.
Application cleanup uses the configured maintenance schedule. Browser files and recovery data remain until you delete them or clear the relevant site storage; clearing local storage can remove unsaved work. Ask us for more information about a specific record or retention exception.
6. Your privacy rights
Depending on the processing and applicable conditions, you can request access, correction, erasure, restriction, portability or object to processing based on legitimate interests. Where processing relies on consent, you may withdraw that consent without affecting processing already performed lawfully before withdrawal.
Account → Privacy lets you download the listed account data and submit a rights request, including an objection or a request to review security-record retention. You can also contact the privacy email above, including if you cannot sign in or have no account. We may seek proportionate information to verify a request, without routinely demanding an identity document. Your display name can be changed in account settings. If a registered email needs correction, contact the operator; it cannot be changed through the normal profile form.
We normally respond within one calendar month. A permitted extension for a complex or numerous request will be explained within that first month. Erasure or restriction may be limited where necessary records are required for a legal obligation, contract or legal claim; we explain the specific reason and available steps.
You may complain to your local supervisory authority. In Lithuania, contact the State Data Protection Inspectorate (VDAI); you do not have to contact us first.
7. Security and access
The service uses HTTPS, password hashing, signed-in access controls, optional authenticator verification, limited sign-in sessions and signed payment webhooks. Secret configuration and authenticator/email secrets are protected separately from the public website. Authorised account administrators can review account, security and support records. These measures reduce risk; no internet service can promise absolute security.
Account/contact, security and payment information needed for your chosen service is required to provide that service. We do not use advertising profiling. Feature access follows your verified account and subscription state. You can contact the operator to request review of an account-security or licence issue. We update this notice when the described processing changes.