Privacy Policy

Houdah Studios GmbH ("we", "us", "our") is committed to protecting and respecting your privacy. This document informs you about the nature, scope, and purpose of the personal data we collect, receive, use, and process, about the legal bases for this processing, and about the choices and rights you have with regard to this data.

This privacy policy applies to the following:

  • the houdah.com and related websites (including the archive of the former Houdah Software discussion forums at forums.houdah.com and our blog at blog.houdah.com)
  • the software applications published by Houdah Studios GmbH (including HoudahSpot, HoudahGeo, Tembo, and Photos Workbench)
  • other products and services offered by Houdah Studios GmbH (including our newsletters)

Throughout this privacy policy, we will refer to the above collectively as "Service". Please note that this privacy policy does not apply to any product or service that has a separate privacy policy.

Name and Address of the Controller

For the purpose of the Swiss Federal Act on Data Protection ("FADP"), the European Union General Data Protection Regulation ("GDPR"), and other applicable privacy laws, the data controller is:

Houdah Studios GmbH
Konradstrasse 2
8304 Wallisellen
Switzerland

https://www.houdah.com
support@houdah.com

Houdah Studios GmbH is registered in the commercial register of the Canton of Zurich under the company number (UID) CHE-404.811.318.

Where the FADP and the GDPR differ, the provision more favourable to you applies.

We have not appointed a data protection officer, as neither the FADP nor the GDPR requires one for our activities. For any question about data protection, contact us at support@houdah.com.

Definitions

  • 'personal data' means any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person
  • 'data subject' means an identified or identifiable natural person who uses our Service or otherwise provides us personal data
  • 'processing' means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction
  • 'restriction of processing' means the marking of stored personal data with the aim of limiting their processing in the future
  • 'profiling' means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location or movements
  • 'controller' means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law
  • 'processor' means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller
  • 'recipient' means a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of those data by those public authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing
  • 'third party' means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorized to process personal data
  • 'consent' of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her

Data Collection and Storage

Data You Provide

  • Contact information including, but not limited to, your name, email address, phone number, and postal address
  • Content for publishing. For example: posts you contributed to the former Houdah Software discussion forums, which we keep in a public archive (see "Forum Archive" below)
  • Communications with us. For example: email messages, crash reports, tweets, or web forms you submit
  • Other personal data. For example: sample data you provide to customer support to illustrate a problem

Data We Collect Automatically

  • Server log and usage data. Our online services - like most websites - collect a series of general data and information when called up by a data subject or automated system. This typically includes the accessing computer's Internet protocol address ("IP address"), application / browser type and version used, operating system used, source by which our websites were reached (known as referrer), date, time, pages of our websites visited as well as similar data and diagnostic information.
  • Software update checks. When one of our applications checks for software updates, it contacts our server. This request transmits the application name and version, your macOS version, a per-installation identifier, and — where applicable — license status information. We use this data to deliver the correct update information, to prevent misuse, and to compile aggregate statistics about the number of active installations.
  • Usage and debugging information. Our support and crash reporting services may collect additional information to help us provide customer support, detect and address problems. This typically includes operating system and software versions used, error logs, license information and, if provided, contact information.
  • Cookies and tracking. We use cookies and related technologies to collect information, store preferences and track activity on our Service. Cookies are used by websites to store small amounts of data on your computer or other device. This data is sent back when you return to the website. Cookies may include an anonymous unique identifier. This allows us to recognize returning visitors. If you consent to analytics, our website sets a first-party visitor cookie (named "__id", which expires 30 days after your last visit) and records your IP address, browser type, the page through which you arrived on our website, and the site that referred you. We use this data to understand how visitors find our websites and which downloads and purchases result from which referrals.
  • Information included in your communications with us. For example, when you contact us by email your message typically includes your computer's Internet protocol address, email software used and operating system used. When you contact us through social networks, we may collect personal data such as your user name and public profile on that network.

Examples of cookies we use:

  • Strictly necessary cookies. This includes, for example, cookies that enable you to log in to certain areas of our websites or store your language preference
  • Analytical cookies. These allow us, for example, to analyze how our websites are used
  • Preference cookies. These allow us, for example, to remember your preferences and personalize website content

Please note that service providers may also use cookies, over which we have no control. These cookies are likely to be analytical cookies.

Forum Archive

The Houdah Software discussion forums ran from 2007 to October 2026. Houdah Software s.à r.l. operated them on a service provided by Website Toolbox LLC (United States). Houdah Studios GmbH did not renew that service, and the forums closed in October 2026. We keep their discussions available as a read-only archive at forums.houdah.com, hosted in Switzerland by cyon (see "Web Hosting and Email" below). The forums' accounts and data at Website Toolbox have been deleted.

The archive shows forum and thread titles, the date of each post, the text of the posts, and attachments that we reviewed before publishing. It does not show user names, profiles, avatars, signatures, email addresses, IP addresses, or private messages. Each author appears as "Member" followed by a number. We assigned these numbers for the archive; the same number marks the same author throughout the archive, so posts by one author can be recognized as such. Before publishing, we removed email addresses, user names mentioned in posts, names in sign-offs, home folder names in file paths, links to members' personal pages, and image metadata such as location data.

Archive pages set no cookies and load no analytics or other third-party content. As on our other websites, our web server records the requests it receives (see "Data We Collect Automatically" above).

If you wrote a post in the former Houdah Software discussion forums and want it removed or changed, or believe the archive still shows personal data about you, contact us at support@houdah.com with a link to the post. We will remove or edit it.

Your Cookie Choices

When you first visit our website, a consent banner lets you choose whether to allow analytics cookies. Strictly necessary cookies do not require consent. Analytics cookies and the related tracking described above are set only after you have given your consent. You can change or withdraw your choice at any time using the cookie icon displayed on our web pages.

Our blog at blog.houdah.com uses its own consent banner. There, analytics are loaded only if you allow statistics, and our push notification service is loaded only if you allow marketing. You can change or withdraw these choices at any time using the "Manage consent" button on the blog.

You may also, at any time, use the features of your browser to prevent the setting of cookies or delete existing cookies. If you choose to deactivate cookies, some portions of our Service may not function fully.

Data Use and Legal Bases

We use the collected data for the following purposes. For each purpose, we indicate the legal basis on which we rely where the GDPR applies:

  • To provide and maintain our Service to you. For example, to provide you with a license key to one of our software applications, or to deliver software updates. Legal basis: performance of a contract (Art. 6(1)(b) GDPR)
  • To provide customer support for our Service and to provide you with information you have requested. Legal basis: performance of a contract or steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR)
  • To notify you of changes to our Service or our policies. Legal basis: performance of a contract (Art. 6(1)(b) GDPR) or compliance with a legal obligation (Art. 6(1)(c) GDPR)
  • To process payments and to comply with tax, accounting, and other statutory obligations. Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and compliance with a legal obligation (Art. 6(1)(c) GDPR)
  • To analyze usage, further develop and improve our Service, and to measure the effectiveness of our communication. Legal basis: your consent (Art. 6(1)(a) GDPR) where cookies or similar technologies are used; otherwise our legitimate interest in understanding and improving our Service (Art. 6(1)(f) GDPR)
  • To provide you with news, information relating to our Service, product announcements, special offers, and related content. Legal basis: your consent (Art. 6(1)(a) GDPR)
  • To send you push notifications about new blog posts, if you have subscribed to them in your browser. Legal basis: your consent (Art. 6(1)(a) GDPR)
  • To keep the discussions of the former Houdah Software discussion forums available as a public, read-only archive of questions and answers about our software. Legal basis: our legitimate interest in preserving support information for the users of our software (Art. 6(1)(f) GDPR). You can object to this processing (see "Data Protection Rights" below)
  • To monitor, detect, and prevent misuse, fraud, security incidents, and technical problems with our Service. Legal basis: our legitimate interest in the security and integrity of our Service (Art. 6(1)(f) GDPR)
  • To remember your preferences and personalize your experience. For example, to provide website content in your preferred language. Legal basis: our legitimate interest in providing a convenient service (Art. 6(1)(f) GDPR)

We will send you our newsletter only if you have opted in to receive it. You can unsubscribe at any time by following the unsubscribe link in our newsletter or by contacting us directly. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

We do not use automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you.

Data Sharing

As a general rule, we don't share personal data with any third party. There are a few exceptions where we may have to disclose personal data:

  • To meet applicable laws, regulations, legal processes, or enforceable governmental requests
  • To protect rights, property, or safety of Houdah Studios GmbH, our data processors, our customers, or others
  • To prevent, investigate, or address misuse, fraud, or other wrongdoing in connection with our Service
  • To prevent, investigate, or address security or technical issues with our Service
  • To enforce applicable terms of service or license agreements
  • With your consent

We also share personal data with the service providers listed below, which process it on our behalf and on our instructions.

Data Security

We use appropriate technical and organizational measures to protect personal data. These include encrypted connections (TLS) for our websites and services, access controls, and authenticated access to administration interfaces. Nevertheless, Internet-based data transmissions and electronic data storage can never be guaranteed to be completely secure. Thus, we cannot guarantee absolute protection of your data.

International Data Transfers

Some of our service providers are located outside of Switzerland and the European Economic Area ("EEA"), in particular in the United States. Where personal data is transferred to such countries, we rely on the following safeguards:

  • An adequacy decision of the Swiss Federal Council or the European Commission, such as the Swiss-U.S. and EU-U.S. Data Privacy Frameworks for U.S. providers certified under them (this includes, among others, Google, Microsoft, Amazon, and Cloudflare)
  • Standard Contractual Clauses approved by the European Commission and recognized by the Swiss Federal Data Protection and Information Commissioner, where no adequacy decision applies

You may contact us for further information on the safeguards applied to a specific transfer, or for a copy of the Standard Contractual Clauses we rely on.

Data Retention

We retain personal data only for as long as we need it for the purposes set out in this privacy policy, or for as long as the law requires us to keep it, for example for accounting or to resolve disputes. We periodically delete or anonymize data we no longer need. Deleted data may remain in backups until those are overwritten. In particular:

  • Website visits (only with your consent): the first-party visitor cookie expires 30 days after your last visit. We periodically remove IP addresses from visit records after a short period, and delete the records of visitors who have not returned
  • Downloads: we periodically anonymize download records after a short period by removing IP addresses, visitor identifiers, and browser details. The remaining anonymous statistics (product, date, operating system, referring site) may be retained indefinitely
  • Purchases and licenses: we keep these records for the lifetime of your license and thereafter as required by statutory retention obligations (up to 10 years under Swiss accounting law, Art. 958f of the Swiss Code of Obligations)
  • Newsletter: we use your email address for our newsletter until you unsubscribe. After that, we keep a record of your unsubscription so that we do not write to you again
  • Push notifications: your subscription is kept while it is active. We stop sending notifications when you unsubscribe or block notifications for blog.houdah.com in your browser
  • Support correspondence: we keep it for as long as needed to resolve your request and to provide follow-up support
  • Forum archive: archived posts remain published for as long as we operate the archive, unless you ask us to remove them. The account data of the former forums (user names and email addresses) is kept offline, and only for as long as we need it to verify requests concerning archived posts
  • Software update checks: we keep one record per installation for statistics about active installations, and periodically delete the records of installations that no longer check for updates
  • Server logs: our hosting provider keeps web server and email logs for a limited period, as needed to operate and secure our services, and then deletes them

Data Protection Rights

Where the European Union General Data Protection Regulation applies, you have the following rights:

  • Right of access: You can contact us to obtain confirmation as to whether or not personal data concerning you is being processed and, where that is the case, to obtain a copy of that data along with information about how it is used
  • Right to rectification: You can contact us to have inaccurate or incomplete personal data rectified
  • Right to erasure: You can contact us to request erasure of your personal data. We will honor such requests unless we are required or permitted by law to retain the data, for example under statutory retention obligations
  • Right to restriction of processing: You can contact us to request that the processing of your personal data be restricted
  • Right to withdraw consent: Where processing is based on your consent, you can withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal
  • Right to data portability: You can contact us to receive personal data concerning you, which you provided to us, in a structured, commonly used and machine-readable format
  • Right to lodge a complaint: You can lodge a complaint with a data protection supervisory authority, in particular with the Swiss Federal Data Protection and Information Commissioner (FDPIC, Feldeggweg 1, 3003 Bern, Switzerland) or, in the EEA, the authority of your habitual residence or place of work

Right to object: You can object, on grounds relating to your particular situation, to processing of your personal data that is based on our legitimate interests. Where personal data is processed for direct marketing purposes, you can object at any time and we will stop processing your data for such purposes.

To exercise any of these rights, contact us at support@houdah.com. We will respond without undue delay and within the time limits set by applicable law. In order to protect the privacy of data subjects, we may ask you to verify your identity before responding to such requests.

Global Privacy Control and Do-Not-Track Signals

Your browser can tell websites that you do not want to be tracked, using the Global Privacy Control ("GPC") or Do-Not-Track ("DNT") signal.

We honor both. If your browser sends either signal, we treat it as declining analytics: the consent banner is not shown, no analytics cookies are set, and downloads are counted without your IP address, browser details, visitor cookie, or referring page. If you nevertheless opt in to analytics through the cookie icon, your explicit choice takes precedence.

Children's Privacy

Our Services are not directed to children. We do not knowingly collect personal data from children under the age of 16 in the European Economic Area, or under the age of 13 elsewhere, without parental consent. If we become aware that a child has provided us with personal data without parental consent, we will take steps to delete such information. If you become aware that a child has provided us with personal data, please contact us.

Data Processors and Service Providers

We rely on Service Providers to help us provide our Service, provide the Service or part of it on our behalf, or to assist us in the collection and use of data.

Web Analytics

Web analytics is the collection, gathering, and analysis of data about the number and behavior of visitors to websites. Analytics services on our website are loaded only after you have consented through our cookie banner.

Google Analytics is a web analytics service operated by Google Ireland Limited, Ireland, for users in the EEA and Switzerland, and by Google LLC, United States, elsewhere. It uses cookies to collect information about your visits, such as the pages you view, how you reached our website, and your browser and device, and sends it to Google, which processes it to produce statistics for us. For details, see How Google uses information from sites or apps that use our services.

Jetpack is a WordPress toolkit operated by Automattic Inc., United States. It provides visitor statistics on our blog at blog.houdah.com, loaded only after you have allowed statistics in the blog's consent banner.

Push Notifications

Our blog at blog.houdah.com offers browser push notifications about new posts. The notification service is loaded only after you have allowed marketing in the blog's consent banner, and notifications are sent only if you also subscribe and allow them in your browser. The service processes your IP address, a subscription identifier, browser and operating system details, language and time zone, and whether you open the notifications we send.

OneSignal operated by OneSignal, Inc., United States.

Payment Processing

We rely on payment processors to securely process payment for our Service.

Paddle operated by Paddle.com Market Limited, United Kingdom, and Paddle Payments Limited, Ireland.

FastSpring operated by Bright Market, LLC d/b/a FastSpring, United States.

Some of our products are distributed through the iOS and Mac App Stores operated by Apple Inc. Products obtained through these stores are also subject to Apple's privacy policy.

Some of our products are distributed as part of a Setapp subscription, operated by MacPaw. Products obtained through this service are also subject to Setapp's privacy policy.

Web Hosting and Email

cyon operated by cyon AG, Basel, Switzerland. Hosts our websites (including our blog, our downloads and the forum archive), their databases, and our email, in Switzerland.

CloudFlare workers web services operated by Cloudflare, Inc., United States.

Google Workspace (Gmail) provided by Google Cloud EMEA Limited, Ireland, with data also processed by Google LLC, United States. We use it for support email: messages you send to our support address, and support requests you send through Replies (see below), are delivered to it.

Campaign Monitor operated by Campaign Monitor Pty Ltd., Australia.

Amazon Simple Email Service operated by Amazon Web Services, Inc., United States.

Advertising

We may promote our products through advertising on third-party platforms such as search engines and social networks. We currently do not embed any advertising cookies, web beacons, pixels, or similar third-party tracking technologies on our websites. Advertisements you see on third-party platforms are subject to the privacy policies of those platforms.

Customer Support, Crash Reporting and App Analytics

Replies operated by Buzzard AG, Switzerland. Our help desk and the support forms in our apps; requests are forwarded to our support email (Google Workspace).

Sentry operated by Functional Software, Inc., United States.

AppCenter operated by Microsoft Corporation, United States. Used for crash reporting in older versions of our applications and being phased out in favor of Sentry.

Embedded Content

You may encounter embedded videos and files on our websites. Such content may be hosted by third party services such as YouTube, Vimeo, or DropBox.

Third-Party Websites and Services

Please note that we cannot assume any responsibility for the content or the privacy policies of third-party websites or services.

Changes To Our Privacy Policy

This policy was last changed and is effective per the date indicated below and is updated periodically. Any changes we make to our Privacy Policy will be posted to this page. Where appropriate, we will notify you of significant changes by email and/or a notice on our Service. We encourage you to periodically review this privacy policy.

Effective date: October 31, 2026.