1. Information We Collect
We collect only the minimal data required to process orders, deliver license keys, and authenticate machine activations:
- Purchase Information: Email address, plan tier, order ID, and transaction timestamps.
- License Activation Data: One-way cryptographically hashed hardware identifiers (machine fingerprint) to enforce single-workstation limits.
- Free-Tier Device Records: For the free tier, the same one-way hardware hash plus first-seen and last-seen timestamps and a blocked flag, used for abuse prevention and device counts. No IP address or country is stored with free-tier records.
- Customer Portal Sessions: Authentication tokens generated when you request a magic login link to manage activations.
- Support Communications: Inquiries, bug reports, and diagnostic logs you voluntarily provide.
2. Payments & Financial Security
All checkout transactions are processed by PCI-DSS Level 1 certified payment infrastructure. HairStorm never receives, handles, transmits, or stores your credit card numbers, CVVs, or banking passwords.
3. Hardware Fingerprinting & License Authority
To prevent unauthorized redistribution while preserving privacy, HairStorm generates a one-way SHA-256 hash from local hardware components (CPU, motherboard, and system volume ID). This fingerprint cannot be reversed to discover personal details or inspect your local files.
4. Offline Operation & Zero Content Telemetry
HairStorm does not upload, scan, or analyze your 3D assets, imported head meshes, guide curves, baked texture maps, or .hairstorm project files. Your creative intellectual property never leaves your local workstation. Once activated, the application operates completely offline.
5. Data Retention & Customer Rights
We retain license and purchase records for active accounts to facilitate license recovery, deactivation, and tax compliance. Free-tier device records (hardware hash, first-seen and last-seen timestamps, blocked flag) are retained indefinitely for abuse prevention and device counts. You have the right to request access to, correction of, or deletion of your account information by contacting support — a verified request for your device record permanently deletes its row from our database. Note that if the same device contacts our servers again afterwards, a fresh unblocked record is created on that contact.
6. Contact Us
If you have questions about this policy or our data protection practices, please contact us at contact@cgnas.com or via ourSupport Page.