SOFTLOAF LAB
Privacy notice
Effective: 2026-10-15
What we process
SoftLoaf Lab provides the website, account portal, and SoftLoaf Negative account and licensing services. We process information only as needed to provide those services. Send product feedback, account questions, and privacy requests to support@softloaflab.com.
Registration and account
To create an account, we collect an email address and password over an encrypted connection. Only an Argon2id password digest is stored, together with verification state and the versions and times of terms, privacy, and cross-border consent. We use this data to create and secure the account, verify email, sign in, reset passwords, handle privacy requests, and prevent abuse. Without the required registration data and consents, an account cannot be created.
Licenses and devices
Licensing processes account ID, a SHA-256 digest of the device identifier, device label, platform, app version, seat status, entitlement, and necessary security events to issue and verify entitlements, enforce seats, and investigate security issues. Photographs and project files are processed locally and are not uploaded as account or licensing data.
Trial eligibility and duration
The seven-day full trial starts only after a new user signs in, explicitly consents, and successfully activates; it does not require an annual-plan purchase. Windows and macOS share the same start and expiry, each platform has at most one active installation-key binding, and an approved replacement restores only time remaining before the original deadline. To determine one-time eligibility, issue short-lived entitlements, prevent repeated grants, and investigate security events, we process account ID, HMAC-protected verified email, installation public-key digests, platform and app channel, app version, trial start and expiry, status, and necessary audit records. Reinstalling, changing keys, or changing the local clock does not reset the server deadline.
Website and essential cookies
Public product pages use no advertising trackers, profiling, or analytics cookies. The account portal uses only security cookies required for sign-in and CSRF protection. The server processes minimal connection address, request path, time, status, and request ID data for security, rate limits, and fault diagnosis; container log rotation limits size and copies.
Retention
Email, account, consent, entitlement, and trial issuance/expiry records are kept until an account deletion request is completed; trial history enforces the one-trial-per-account-and-product boundary. Records strictly needed for law, disputes, or account security are deleted or anonymized when that need ends. Email verification and password-reset codes expire after 10 minutes; web sessions expire after at most 30 days. Tokens are stored only as irreversible digests and are handled with the related account on deletion.
Processors and transfers
The account database and service run in Tencent Cloud's Shanghai region in Mainland China. Resend, located in the United States, supplies verification, recovery, and support mail, so only email addresses, message metadata, and the related transactional-message content undergo cross-border processing. We do not sell personal data or use it for advertising. See the Cross-border processing notice for the overseas recipient, purposes, methods, categories, retention, and rights channels; registration obtains separate consent. Payments are closed, so this version does not process payment data.
Your rights
Use the signed-in portal to request a data export or account deletion. Email support@softloaflab.com for access, correction, copying, restriction or objection, consent withdrawal, and other requests. We verify the requester's relationship to the account and respond within applicable legal time limits. Withdrawal does not affect earlier lawful processing; withdrawing consent needed for transactional email may make email verification, recovery, or support unavailable without affecting Mainland account and licensing processing itself.
Children, updates, and security
The service does not knowingly offer account registration to children under 14. We use encrypted transport, least privilege, isolated secrets, digested credentials, and tested backup and recovery. No internet service can promise absolute security. We may update this notice to comply with applicable law, regulatory requirements, or material service changes. Where an update materially affects your rights or requires renewed consent, we will notify you as applicable law requires and obtain it when required.