Privacy Policy

Houdah Software s.à r.l. ("we", "us", "our") is committed to protecting and respecting your privacy. This document informs you about the nature, scope, and purpose of the personal data we collect, receive, use, and process, about the legal bases for this processing, and about the choices and rights you have with regard to this data.

This privacy policy applies to the following:

  • the houdah.com and related websites (including our discussion forums and our blog at blog.houdah.com)
  • the software applications published by Houdah Software s.à r.l. (including HoudahSpot, HoudahGeo, Tembo, and Photos Workbench)
  • other products and services offered by Houdah Software s.à r.l. (including our newsletters)

Throughout this privacy policy, we will refer to the above collectively as "Service". Please note that this privacy policy does not apply to any product or service that has a separate privacy policy.

Name and Address of the Controller

For the purpose of the European Union General Data Protection Regulation ("GDPR") and other applicable privacy laws, the data controller is:

Houdah Software s.à r.l.
255 route d'Arlon
L-1150 Luxembourg

https://www.houdah.com
support@houdah.com

Definitions

  • 'personal data' means any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person
  • 'data subject' means an identified or identifiable natural person who uses our Service or otherwise provides us personal data
  • 'processing' means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction
  • 'restriction of processing' means the marking of stored personal data with the aim of limiting their processing in the future
  • 'profiling' means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location or movements
  • 'controller' means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law
  • 'processor' means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller
  • 'recipient' means a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of those data by those public authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing
  • 'third party' means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorized to process personal data
  • 'consent' of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her

Data Collection and Storage

Data You Provide

  • Contact information including, but not limited to, your name, email address, phone number, and postal address
  • Content for publishing. For example: a public post to our discussion forums
  • Communications with us. For example: email messages, crash reports, tweets, or web forms you submit
  • Other personal data. For example: sample data you provide to customer support to illustrate a problem

Data We Collect Automatically

  • Server log and usage data. Our online services - like most websites - collect a series of general data and information when called up by a data subject or automated system. This typically includes the accessing computer's Internet protocol address ("IP address"), application / browser type and version used, operating system used, source by which our websites were reached (known as referrer), date, time, pages of our websites visited as well as similar data and diagnostic information.
  • Software update checks. When one of our applications checks for software updates, it contacts our server. This request transmits the application name and version, your macOS version, a per-installation identifier, and — where applicable — license status information. We use this data to deliver the correct update information, to prevent misuse, and to compile aggregate statistics about the number of active installations.
  • Usage and debugging information. Our support and crash reporting services may collect additional information to help us provide customer support, detect and address problems. This typically includes operating system and software versions used, error logs, license information and, if provided, contact information.
  • Cookies and tracking. We use cookies and related technologies to collect information, store preferences and track activity on our Service. Cookies are used by websites to store small amounts of data on your computer or other device. This data is sent back when you return to the website. Cookies may include an anonymous unique identifier. This allows us to recognize returning visitors. If you consent to analytics, our website sets a first-party visitor cookie (named "__id", valid for 30 days) and records your IP address, browser type, the page through which you arrived on our website, and the site that referred you. We use this data to understand how visitors find our websites and which downloads and purchases result from which referrals.
  • Information included in your communications with us. For example, when you contact us by email your message typically includes your computer's Internet protocol address, email software used and operating system used. When you contact us through social networks, we may collect personal data such as your user name and public profile on that network.

Examples of cookies we use:

  • Strictly necessary cookies. This includes, for example, cookies that enable you to log in to certain areas of our websites or store your language preference
  • Analytical cookies. These allow us, for example, to analyze how our websites are used
  • Preference cookies. These allow us, for example, to remember your preferences and personalize website content

Please note that service providers may also use cookies, over which we have no control. These cookies are likely to be analytical cookies.

Your Cookie Choices

When you first visit our website, a consent banner lets you choose whether to allow analytics cookies. Strictly necessary cookies do not require consent. Analytics cookies and the related tracking described above are set only after you have given your consent. You can change or withdraw your choice at any time using the cookie icon displayed on our web pages.

You may also, at any time, use the features of your browser to prevent the setting of cookies or delete existing cookies. If you choose to deactivate cookies, some portions of our Service may not function fully.

Data Use and Legal Bases

We use the collected data for the following purposes. For each purpose, we indicate the legal basis on which we rely where the GDPR applies:

  • To provide and maintain our Service to you. For example, to provide you with a license key to one of our software applications, or to deliver software updates. Legal basis: performance of a contract (Art. 6(1)(b) GDPR)
  • To provide customer support for our Service and to provide you with information you have requested. Legal basis: performance of a contract or steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR)
  • To notify you of changes to our Service or our policies. Legal basis: performance of a contract (Art. 6(1)(b) GDPR) or compliance with a legal obligation (Art. 6(1)(c) GDPR)
  • To process payments and to comply with tax, accounting, and other statutory obligations. Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and compliance with a legal obligation (Art. 6(1)(c) GDPR)
  • To analyze usage, further develop and improve our Service, and to measure the effectiveness of our communication. Legal basis: your consent (Art. 6(1)(a) GDPR) where cookies or similar technologies are used; otherwise our legitimate interest in understanding and improving our Service (Art. 6(1)(f) GDPR)
  • To provide you with news, information relating to our Service, product announcements, special offers, and related content. Legal basis: your consent (Art. 6(1)(a) GDPR)
  • To allow you to participate in our discussion forums. Legal basis: performance of a contract (Art. 6(1)(b) GDPR)
  • To monitor, detect, and prevent misuse, fraud, security incidents, and technical problems with our Service. Legal basis: our legitimate interest in the security and integrity of our Service (Art. 6(1)(f) GDPR)
  • To remember your preferences and personalize your experience. For example, to provide website content in your preferred language. Legal basis: our legitimate interest in providing a convenient service (Art. 6(1)(f) GDPR)

We will send you our newsletter only if you have opted in to receive it. You can unsubscribe at any time by following the unsubscribe link in our newsletter or by contacting us directly. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

We do not use automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you.

Data Sharing

As a general rule, we don't share personal data with any third party. There are a few exceptions where we may have to disclose personal data:

  • To meet applicable laws, regulations, legal processes, or enforceable governmental requests
  • To protect rights, property, or safety of Houdah Software s.à r.l., our data processors, our customers, or others
  • To prevent, investigate, or address misuse, fraud, or other wrongdoing in connection with our Service
  • To prevent, investigate, or address security or technical issues with our Service
  • To enforce applicable terms of service or license agreements
  • With your consent

We also share personal data with the service providers listed below, which process it on our behalf and on our instructions.

Data Security

We use appropriate technical and organizational measures to protect personal data. These include encrypted connections (TLS) for our websites and services, access controls, and authenticated, signed requests for internal administration interfaces. Nevertheless, Internet-based data transmissions and electronic data storage can never be guaranteed to be completely secure. Thus, we cannot guarantee absolute protection of your data.

International Data Transfers

Some of our service providers are located outside of the European Economic Area ("EEA"), in particular in the United States. Where personal data is transferred outside of the EEA, we rely on the following safeguards:

  • An adequacy decision of the European Commission, such as the EU-U.S. Data Privacy Framework for U.S. providers certified under that framework (this includes, among others, Google, Microsoft, Amazon, and Cloudflare)
  • Standard Contractual Clauses approved by the European Commission, where no adequacy decision applies

You may contact us for further information on the safeguards applied to a specific transfer.

Data Retention

We retain personal data only for as long as is needed for the purposes set out in this privacy policy, or as necessary to comply with our legal obligations, resolve disputes, and enforce agreements. In particular:

  • The first-party visitor cookie expires after 30 days. IP addresses are removed from website visit records after 7 days, and the records themselves are deleted after 60 days of inactivity
  • Download records are anonymized after 7 days by removing IP addresses, visitor identifiers, and browser details. The remaining anonymous statistics (product, date, operating system, referring site) may be retained indefinitely
  • Purchase and license records are retained for the lifetime of your license and thereafter as required by statutory retention obligations (up to 10 years under Luxembourg accounting law)
  • Newsletter subscription data is retained until you unsubscribe
  • Support correspondence is retained for as long as needed to resolve your request and to provide follow-up support
  • Software update check records are stored as per-installation counters and retained for aggregate statistics about active installations. Records of installations that have not been seen for 3 years are deleted

Data that is no longer needed is routinely deleted.

Data Protection Rights

Where the European Union General Data Protection Regulation applies, you have the following rights:

  • Right of access: You can contact us to obtain confirmation as to whether or not personal data concerning you is being processed and, where that is the case, to obtain a copy of that data along with information about how it is used
  • Right to rectification: You can contact us to have inaccurate or incomplete personal data rectified
  • Right to erasure: You can contact us to request erasure of your personal data. We will honor such requests unless we are required or permitted by law to retain the data, for example under statutory retention obligations
  • Right to restriction of processing: You can contact us to request that the processing of your personal data be restricted
  • Right to withdraw consent: Where processing is based on your consent, you can withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal
  • Right to data portability: You can contact us to receive personal data concerning you, which you provided to us, in a structured, commonly used and machine-readable format
  • Right to lodge a complaint: You can lodge a complaint with a data protection supervisory authority, in particular with the Luxembourg Commission nationale pour la protection des données (CNPD, https://cnpd.public.lu) or the authority of your habitual residence or place of work

Right to object: You can object, on grounds relating to your particular situation, to processing of your personal data that is based on our legitimate interests. Where personal data is processed for direct marketing purposes, you can object at any time and we will stop processing your data for such purposes.

To exercise any of these rights, contact us at support@houdah.com. We will respond within one month. In order to protect the privacy of data subjects, we may ask you to verify your identity before responding to such requests.

Do-Not-Track Signal

There are different ways you can prevent tracking of your online activity. One of them is setting a preference in your browser that informs websites that you do not want to be tracked. This is referred to as a Do-Not-Track ("DNT") signal.

We do not respond to Do-Not-Track signals. Instead, analytics and tracking on our website are disabled unless you opt in through our consent banner, as described above.

Children's Privacy

Our Services are not directed to children. We do not knowingly collect personal data from children under the age of 16 in the European Economic Area, or under the age of 13 elsewhere, without parental consent. If we become aware that a child has provided us with personal data without parental consent, we will take steps to delete such information. If you become aware that a child has provided us with personal data, please contact us.

Data Processors and Service Providers

We rely on Service Providers to help us provide our Service, provide the Service or part of it on our behalf, or to assist us in the collection and use of data.

Web Analytics

Web analytics is the collection, gathering, and analysis of data about the number and behavior of visitors to websites. Analytics services on our website are loaded only after you have consented through our cookie banner.

Google Analytics is a web analytics service operated by Google LLC (for users in the EEA: Google Ireland Limited)
For further information on what data is collected, how it is used, your options and rights, refer to https://policies.google.com/privacy

Clicky is a web analytics service operated by Roxr Software Ltd.
For further information refer to https://clicky.com/terms/privacy

Jetpack is a WordPress toolkit operated by Automattic Inc. It is used on our blog at blog.houdah.com
For further information refer to https://automattic.com/privacy/

Payment Processing

We rely on payment processors to securely process payment for our Service.

Paddle operated by Paddle.com Market Limited and Paddle Payments Limited
For further information refer to https://paddle.com/privacy-buyers/

FastSpring operated by Bright Market, LLC d/b/a FastSpring
For further information refer to https://fastspring.com/privacy/

Some of our products are distributed through the iOS and Mac App Stores operated by Apple, Inc.
Products obtained through these stores are also subject to the Apple Privacy Policy

Some of our products are distributed as part of a Setapp.com subscription.
Products obtained by the way of this service are also subject to the Setapp Privacy Policy

Web Hosting and Email

Stablehost.com operated by Stable Host, LLC
For further information refer to https://www.stablehost.com/privacy.php

Website Toolbox operated by Website Toolbox, Inc.
For further information refer to https://www.websitetoolbox.com/privacy

CloudFlare workers web services operated by Cloudflare, Inc.
For further information refer to https://www.cloudflare.com/en-gb/privacypolicy/

Gmail operated by Google LLC
For further information refer to https://policies.google.com/privacy

Campaign Monitor operated by Campaign Monitor Pty Ltd.
For further information refer to https://www.campaignmonitor.com/policies/#privacy-policy

Amazon Simple Email Service operated by Amazon.com, Inc.
For further information refer to https://aws.amazon.com/privacy/

Advertising

We may promote our products through advertising on third-party platforms such as search engines and social networks. We currently do not embed any advertising cookies, web beacons, pixels, or similar third-party tracking technologies on our websites. Advertisements you see on third-party platforms are subject to the privacy policies of those platforms.

You can opt out of personalized advertising from many companies via the consumer choice tools created under self-regulation programs, such as the US-based aboutads.info (https://www.aboutads.info/choices/) choices page or the EU-based Your Online Choices (https://www.youronlinechoices.eu/).

Customer Support, Crash Reporting and App Analytics

Replies operated by Replies AG
For further information refer to https://replies.io/privacy_policy.html

Sentry operated by Functional Software, Inc.
For further information refer to https://sentry.io/privacy/

AppCenter operated by Microsoft Corporation. Used for crash reporting in older versions of our applications and being phased out in favor of Sentry
For further information refer to https://privacy.microsoft.com/en-us/PrivacyStatement

Embedded Content

You may encounter embedded videos and files on our websites. Such content may be hosted by third party services such as YouTube, Vimeo, or DropBox.

Third-Party Websites and Services

Please note that we cannot assume any responsibility for the content or the privacy policies of third-party websites or services.

Changes To Our Privacy Policy

This policy was last changed and is effective per the date indicated below and is updated periodically. Any changes we make to our Privacy Policy will be posted to this page. Where appropriate, we will notify you of significant changes by email and/or a notice on our Service. We encourage you to periodically review this privacy policy.

Effective date: July 19, 2026.