PresetSync Privacy Policy

Effective date: 19 July 2026 Last updated: 27 July 2026

1. Who we are

PresetSync is operated by:

DResearch Lab Limited 51 Bracken Road Dublin D18 CV48 Ireland Email: [email protected]

DResearch Lab Limited is the controller for the personal data described in this Policy, except where we expressly act as a processor for a business customer.

This Policy applies to the PresetSync website, desktop applications for macOS and Windows, account and licensing services, PresetSync Cloud, support, and related services (the “Services”).

2. Our role

We act as controller for account, purchase, licence, website, communications, security, service-administration, and operational-diagnostics data.

Where a business customer uses PresetSync Cloud to synchronize personal data for its own purposes, that customer may be the controller and we may be its processor. The customer is responsible for its lawful basis, notices, access controls, and data-subject requests. A data processing agreement may be available where required.

Payment providers and customer-selected Cloud Folder providers may act as independent controllers for processing they determine under their own legal duties and privacy notices.

3. Personal data we process

3.1 Account and contact data

We may process:

• name, email address, billing address, country or region;
• company or trading name and VAT or tax information;
• username, password hash, and authentication records;
• support messages, attachments, and other communications.

3.2 Purchases and subscriptions

We may process products and plans purchased; order, invoice, customer, and transaction identifiers; subscription and renewal status; payment status; currency, tax, billing, refund, cancellation, and payment-failure information.

Stripe, PayPal, or another provider offered at checkout processes complete payment credentials. We do not ordinarily receive or store a complete card number, security code, or online-banking credential.

3.3 Licences and computers

We may process:

• account and licence identifiers, licence type, and authorization status;
• authorized-computer, installation, and pseudonymous device identifiers;
• operating-system type, version, and architecture;
• PresetSync version, build, and environment;
• authorization, deauthorization, activation, and trial timestamps;
• relevant IP addresses, security events, and limit overrides.

The application may store an installation-bound offline licence receipt on your computer. App licensing and PresetSync Cloud credentials are separate.

3.4 PresetSync Cloud content and metadata

We process content you choose to synchronize and the metadata required to do so, which may include:

• preset bytes, collection and folder names, filenames, extensions, and relative paths;
• file sizes, content hashes, timestamps, and immutable versions;
• file, collection, repository, origin-device, and operation identifiers;
• synchronization journals, per-device cursors, revisions, and status;
• deletion candidates, tombstones, Trash, conflicts, and recovery copies;
• migration, validation, quota, and transfer metadata.

Names, paths, or preset content may contain personal data if a user puts it there. Do not include unnecessary personal or sensitive data. We do not use synchronized preset content for advertising or to train general-purpose artificial-intelligence models.

3.5 Cloud Folder

In Cloud Folder mode, files are stored with the provider and account you select, such as iCloud Drive, Dropbox, Google Drive, OneDrive, or another compatible provider. That provider’s terms and privacy notice apply to its independent processing. We may still process licensing, application, support, security, and diagnostic data. PresetSync Cloud does not receive your Cloud Folder repository merely because you use the desktop application.

3.6 Default crash and error telemetry

The macOS and Windows applications send limited crash and error telemetry by default to help us detect crashes, diagnose defects, measure reliability, and protect the Services. The first release does not provide an application setting to disable this collection. You may object or request deletion as described in Section 12.

Client telemetry may include:

• PresetSync version, build revision, release channel, and environment;
• operating-system version and architecture;
• crash type, stack trace, thread state, and symbolicated call locations;
• stable internal error codes and recoverability classes;
• limited, scrubbed breadcrumbs immediately preceding an error;
• limited timestamps, event identifiers, correlation IDs, and network information such as IP address where received by the service.

We may upload our own dSYM and PDB symbol files to a diagnostics provider so that memory addresses in crash reports can be resolved to PresetSync function names and source locations. Those symbol files are build artifacts belonging to PresetSync; they are not copied from your personal files.

Client telemetry is designed to exclude:

• preset bytes or the content of synchronized files;
• filenames, collection names, logical paths, and absolute filesystem roots;
• email addresses, names, support messages, and billing details;
• passwords, access or refresh tokens, licence keys, signed receipts, private signing material, storage credentials, and payment credentials.

Scrubbing reduces risk but cannot guarantee that a stack trace, operating-system message, or breadcrumb never contains information that relates to a person. IP addresses, pseudonymous identifiers, and crash information may themselves be personal data. We therefore protect and process telemetry under this Policy rather than describing it as anonymous.

Client crash telemetry is separate from local diagnostics, security logs, transaction records, support information you choose to send, and essential server-side logs needed to provide and secure PresetSync Cloud.

3.7 Server health and service logs

PresetSync Cloud generates bounded server logs, metrics, and traces concerning health, uptime, error rates, latency, resource use, authentication or entitlement denials, storage and journal counts, transfer completion, webhook/job/retry age, quota, purge and garbage collection, and backup/restore verification.

These records use correlation IDs and bounded labels. They are designed not to contain preset bytes, complete paths, credentials, tokens, keys, or payment details. Security and access logs may include IP address, request time, endpoint category, response status, user agent, and account or device identifiers where necessary.

3.8 Website, cookies, and communications

We may process IP address, browser and device details, pages or endpoints accessed, request time, approximate region, cookie choices, account-session data, marketing preferences, and communication history.

Strictly necessary cookies may be used for authentication, checkout, security, and privacy preferences. Non-essential analytics or marketing cookies are used only after any consent required by law. You can reject them and later change your choice.

When you contact support, we process your message, attachments, account details, and relevant diagnostics. If you voluntarily provide a preset or diagnostic package, we examine it only for support, troubleshooting, security, or legal purposes.

4. Why we process data and our legal bases

We process personal data for the following purposes and legal bases:

Our legitimate interests include keeping the Services secure and reliable, finding defects across supported systems, preventing unauthorized access, maintaining appropriate records, and defending legal claims. For default client telemetry, we limit the fields, scrub prohibited content, separate environments, restrict access, limit retention, and provide the right to object.

You may withdraw consent at any time without affecting earlier lawful processing. You may object to legitimate-interest processing as described in Section 12. Some data is necessary to provide a requested Service; without it we may be unable to provide that Service.

We do not sell personal data and do not use synchronized content for unrelated profiling.

5. Providers, processors, and other recipients

Only providers relevant to your use receive data. A named provider does not necessarily receive every category of data. Providers can change; we will update this Policy or give additional notice where required.

Payment providers may collect more information directly from you than we receive and may use fraud-prevention or legally required automated systems under their own notices. The checkout interface identifies the provider before you pay.

We may also disclose information where required by law or a competent authority; to investigate fraud, abuse, unlawful activity, or security incidents; to protect rights, safety, or property; at your direction; or in a merger, financing, restructuring, acquisition, or sale subject to appropriate protections.

6. International transfers

We aim to keep PresetSync Cloud customer object storage in a private EU-jurisdiction environment. This does not mean all personal data stays in Ireland or the European Economic Area. Providers or their subprocessors may process account, payment, email, support, security, or telemetry data elsewhere.

Where required, we use an applicable transfer mechanism such as an adequacy decision, the European Commission’s Standard Contractual Clauses, and supplementary technical, contractual, or organizational safeguards. You may request information about relevant safeguards.

7. Retention

We keep personal data only as long as reasonably necessary for the stated purpose, including contractual, security, tax, accounting, and legal needs.

Records may be retained longer where reasonably necessary for an incident, fraud prevention, litigation hold, legal claim, or legal obligation.

After the 90-day expired-Cloud retention period, active content, Trash, recovery versions, conflicts, journals, paths, and associated Cloud metadata may be permanently deleted. Logical deletion may precede physical cleanup from caches and backups. Account purge does not erase a separate perpetual licence or records we must lawfully retain.

8. Shared Studio accounts

Authorized users of a shared Studio account may be able to access account information, synchronized content, collections, computers, and subscription information. The customer organization controls access, protects credentials, removes former users, and provides any required employee or contractor privacy information. Do not place information in a shared account that other authorized users must not access.

9. Security and data breaches

We use technical and organizational measures appropriate to the risk. Measures may include protected transport, private object storage, access controls, authentication, restricted administration, integrity checks, redaction, environment separation, secure development and deployment, backups, recovery testing, monitoring, vulnerability management, and incident response.

No system can be guaranteed completely secure. Risks include attacks, unknown vulnerabilities, compromised customer devices or credentials, insider misuse, third-party failure, and events outside reasonable control. PresetSync is a synchronization service with limited recovery, not your only backup. Maintain an independent, current, tested backup.

If we become aware of a personal-data breach, we will investigate, document, contain, and mitigate it and notify the competent supervisory authority and affected people where required by law.

10. Automated decision-making

We do not use synchronized preset content for solely automated decisions that produce legal or similarly significant effects about you. Payment and fraud-prevention providers may independently use automated systems under their own legal responsibilities and privacy notices.

11. Children

The Services are intended for adults and professional or business users. They are not directed to children under 16, and we do not knowingly collect personal data from children under 16. Contact us if you believe a child has provided personal data.

12. Your data-protection rights

Subject to applicable conditions and exceptions, you may have the right to:

• obtain confirmation and access;
• correct inaccurate or incomplete data;
• request deletion or restriction;
• receive certain data in a portable format;
• object to processing based on legitimate interests;
• object to direct marketing at any time;
• withdraw consent;
• request information about transfer safeguards; and
• complain to a supervisory authority.

To exercise a right, object to default crash/error telemetry, or request deletion of telemetry already received, email [email protected]. We may need to verify your identity. Rights are not absolute; for example, we may retain records required by law or needed to administer an active perpetual licence or defend legal claims.

You may complain to the Irish Data Protection Commission or the competent authority where you live, work, or believe an infringement occurred.

13. Changes to this Policy

We may update this Policy for changes to the Services, processing, providers, or law. We will publish the revision date and provide additional notice where a change materially affects processing and notice is required or reasonably appropriate.

14. Contact

For privacy questions, rights requests, or complaints:

DResearch Lab Limited 51 Bracken Road Dublin D18 CV48 Ireland Email: [email protected]