Privacy Policy

When you create an account the following data is stored in the EU backend (Netlify Pro, eu-central-1 Frankfurt):

• Email address (used for login and license binding)
• No password: sign-in is passwordless via a 6-digit one-time code sent by email. The code is stored only as a salted hash and is deleted when used or after 15 minutes.
• Refresh-token family (for session management, stored as hashes only; family revocation on reuse detection)
• Hardware IDs of the devices activated so far (for license binding)
• HWID-switch counter (max. 3 hardware switches per rolling 30 days, for abuse prevention)
• Timestamp of the most recent license validation or session renewal ("last used", incl. application version)
• A coarse location region derived from it server-side (country, city, region coordinates rounded to roughly 1 km). The derivation happens on the EU server from the connection IP; the IP address itself is not stored.

The activity and region data serves license and service administration only (e.g. detecting inactive accounts, abuse prevention, support). No movement profile is created: only the most recent state is stored, no history.

Organisations: an organisation is managed by one or two administrators, who do not need to hold a seat themselves. The purchaser of an organisation becomes its first administrator; a second administrator is appointed by an administrator. Buying a new organisation does not give the purchaser a seat. If we can match the purchase to the purchaser's account (or to an organisation they already administer), they become administrator right away. Otherwise the purchase email address receives a link to claim the administration and, while it is not claimed, up to two reminders; the purchase confirmation page also offers the claim after signing in. When the administration is claimed by an account with another email address, the billing email address of the organisation is notified, with the claiming address in masked form. An organisation whose administration has not been claimed 30 days after the purchase is passed on to the provider's support, which can send a new link to the purchase email address. For each seat, the administrators see on the organisation page: the account email address, a shortened form of the hardware ID the seat is bound to, the time of the last sign-in, the version of AnyAutomation Studio used most recently and the date it was last used. The location region is not shown. The administrators also see the email addresses of the administrators and of the people invited to a seat or to the administration. The information is shown only to the administrators, for managing the organisation, and is no longer visible to them once the seat is released or you leave the organisation. If your licence is a seat in an organisation, your account page shows the email addresses of its administrators, so that you know whom to contact about your seat.

End of the administrator role: the role ends when the other administrator removes it, when the administrator steps down or hands the role over to someone else, when the account is deleted, or when the organisation ends. Its only administrator can delete their account when nobody else uses the organisation; the organisation then ends.

Organisation record: for every organisation the backend keeps a record of changes to its administration and its seats: administrators appointed, removed or handed over, seats invited, given, revoked or left, invitations, changes to billing contacts, openings of the billing portal, and the end or reactivation of the organisation. Each entry holds the time, the action and references to the accounts involved; an email address is stored only in masked form (for example jo***@example.com). The record is visible to the administrators of the organisation and to the provider, for managing the organisation, support and tracing changes. Each entry is deleted 365 days after it was written. When an account is deleted, the references to it and its masked email address are removed from the record.

Former administrators: when an organisation ends, the backend keeps a note of the accounts that administered it at that time, so that they can be appointed again if the organisation is reactivated and, for 90 days after the end, can still view its past invoices (read only). This note is deleted 365 days after the organisation ended, earlier if the organisation is reactivated or the account is deleted.

Organisation notifications: the administrators of an organisation receive notification emails about its administration, its seats and its billing. These emails name the people concerned by their email address, for example a member who accepted, left or lost a seat, or an invitation that expired unused, and each administrator receives a copy of the invitations they send. Billing notices contain the amount, the invoice or credit note number and, for a payment method, only the card brand and its last four digits. If an organisation has no administrator, these notices go to the holder of its first seat, otherwise to its billing email address, otherwise to the address a purchase is waiting to be claimed by. The holders of a seat receive the notices that concern their seat, for example when the organisation has no administrator any more or ends. For 90 days after an organisation ends, the accounts that administered it at that time receive notices of refunds and credit notes for its invoices. Once sent, these emails are in the recipients' mailboxes and are not affected by the deletion periods described here.

Billing of an organisation: the administrators manage the billing of an organisation paid through Stripe in the Stripe Customer Portal (payment method, plan, number of seats, cancellation and invoices) and receive its billing and service notifications. While the organisation has no administrator, these notifications go as described under "Organisation notifications". For an organisation billed directly by the provider, billing is handled by the provider.

Billing email address of an organisation: the invoices of an organisation paid through Stripe go to the billing email address stored with Stripe and in the licence record. An administrator can set it to their own address, which also changes it at Stripe. When the billing email address changes, all administrators and the previous billing email address are notified; when the payment method changes, all administrators are notified, with the card brand and its last four digits only. When an administrator whose address is the billing email address deletes their account, the address is replaced by that of the remaining administrator, at Stripe and in the licence record. If no administrator remains, the address stays at Stripe so that the invoices of the ending billing period can still be issued; the provider removes it after the final invoice. Invoice records are kept as bookkeeping law requires (see section 6).

Engineering data or TIA Portal project contents are NEVER transmitted to the backend.