Privacy Policy
GDPR & CCPA compliant · Last updated: May 13, 2026
1. Data Controller
Digital Essence (publisher of HeavyM) is the data controller for personal data collected through this website. Contact: support form.
2. Data we collect
We collect the following categories of data:
- Account / purchase data (via Paddle): name, email, billing address, country, payment method. Paddle acts as Merchant of Record and processes this data in accordance with its own privacy policy.
- Browsing data: IP address, browser type, pages visited, visit duration, traffic source. Collected via analytics cookies only with your consent.
- Lead data: first name and email voluntarily submitted in the demo download form.
- License data (post-purchase): email and license key, managed by our provider Keygen.
3. Purposes of processing
Your data is used to:
- Process your order and deliver your HeavyM license
- Send you product-related information (updates, technical support)
- Measure the performance of our marketing campaigns (Meta Ads, Pixel + Conversions API)
- Improve user experience (Microsoft Clarity, anonymous heatmaps)
- Comply with our legal obligations (invoicing, accounting)
4. Legal bases
The processing of your data is based on:
- Performance of a contract (delivery of the license after purchase)
- Your consent (marketing cookies, newsletter, lead form)
- A legal obligation (invoicing, accounting retention)
- Our legitimate interest (marketing performance measurement, in compliance with GDPR)
5. Retention period
- Invoicing data: 10 years (legal accounting obligation)
- License data: license duration + 3 years
- Unconverted leads: 3 years from last contact
- Analytics data: 13 months maximum (CNIL recommendation)
- Cookies: 13 months maximum
6. Data recipients
Your data may be shared with:
- Paddle.com Market Ltd (payment, invoicing, VAT/Sales Tax)
- Keygen.sh (license generation and management)
- Meta Platforms Ireland Ltd (Pixel + Conversions API, subject to your cookie consent)
- Microsoft Corporation (Clarity, anonymized analytics)
- Cloudflare (hosting, security)
No data is sold to third parties. All our subprocessors are bound by GDPR-compliant contracts.
7. Cookies
We use the following cookies:
- Essential cookies: cart, consent, language/currency preference (always active)
- Analytics cookies: Microsoft Clarity (anonymous heatmaps) — only with your consent
- Marketing cookies: Meta Pixel (advertising campaign measurement) — only with your consent
You can change your preferences at any time via the cookie banner at the bottom of the page (clicking "Decline" is enough to disable non-essential cookies).
8. Your rights (GDPR / CCPA)
You have the following rights over your personal data:
- Right of access: obtain a copy of all your data
- Right of rectification: correct inaccurate data
- Right to erasure ("right to be forgotten"): delete your data
- Right to object: object to marketing processing
- Right to data portability: retrieve your data in a structured format
- Right to withdraw consent at any time
To exercise a right, submit a request via our support form. Response within 30 days maximum.
9. Complaint to the supervisory authority
If you believe your rights are not respected, you may file a complaint with the French data protection authority (CNIL): cnil.fr/en/plaintes, or with the supervisory authority of your country of residence within the EU.
10. International transfers
Some of our subprocessors (Cloudflare, Meta, Microsoft) may transfer your data to the United States. These transfers are governed by the Standard Contractual Clauses of the European Commission and/or the EU-US Data Privacy Framework.