Privacy policy
Effective date: 16 October 2026
This policy explains how SunDevs (Pvt) Ltd ("SunDevs", "we", "us") handles personal data in connection with SunLicense (the "Service"). It is written to meet the Sri Lanka Personal Data Protection Act, No. 9 of 2022, the EU and UK General Data Protection Regulation (GDPR), and similar laws.
Two roles: controller and processor
SunLicense handles two kinds of personal data, and our role is different for each.
| Whose data | Our role | |
|---|---|---|
| Account data | You and your staff: the people who sign up for and use the dashboard and API | Controller. This policy applies. |
| Customer Data | Your customers, the people who buy and run your software: names and emails you attach to licenses, their machines, their validation history | Processor. You (the software vendor) are the controller. We process this data only on your instructions, under the Data processing addendum. |
If you are an end user of software that uses SunLicense, the vendor of that software decides what data is collected about you and why. Please read their privacy policy and contact them first. If you contact us, we will pass your request on to them.
What we collect
Account data (you and your staff)
- Sign-up and profile: organization name, email address, password. Passwords are stored only as a bcrypt hash; we never see or store the plain password.
- Organization membership: the staff you invite, their email, role and whether they are active.
- Credentials: API keys are stored as a SHA-256 hash plus a short visible prefix. Platform and session tokens are short-lived.
- Usage of the Service: the products, policies and licenses you create, plan and usage counters, and actions taken in the dashboard.
- Communications: emails you send us and our replies.
- Billing (once paid plans start): plan, invoices and billing contact. Card and bank details are handled by our payment provider; we do not store full card numbers.
Customer Data (processed for you)
- License holders: the customer name and email you choose to attach to a license.
- Machines: a machine fingerprint (a hash your software sends, such as a hardware ID), the machine's hostname if your software sends one, and when it was activated, last seen and deactivated.
- Validation history: for each validation call, the license key, the machine fingerprint, the result (for example valid, expired, too many machines) and the time.
- Approximate location: country, city and approximate coordinates of each validation call, taken from headers added by our CDN, Cloudflare. We do not store the IP address of validation calls in our databases.
- Discord (only if you connect a Discord server): the server's ID and settings, the Discord user IDs of staff who link their account, and the Discord user ID of each license holder who claims a license there.
Technical data
- IP addresses are seen by Cloudflare and our servers when you or your software connect. They are used briefly in memory for rate limiting and abuse protection, and may appear in server access and error logs, which are kept only for a short time (see the Data retention policy).
- Browser storage and cookies. The dashboard keeps your sign-in token in your browser's local storage so you stay signed in; it expires automatically and is removed when you sign out. We do not use advertising cookies, third-party analytics, tracking pixels or fingerprinting on sunlicense.com, the dashboard or the docs. Cloudflare may set strictly necessary cookies to protect the sites from bots and attacks. Because we only use strictly necessary storage, we do not show a cookie banner.
- Usage analytics. To learn which pages and features are used, sunlicense.com, the dashboard and the docs report page views and clicks (the page address, the link or button text, browser type, screen size, language and country) to our own, self-hosted copy of Umami. It sets no cookies, stores no IP address, and counts visits with an anonymous identifier that changes every month, so it can't follow you across sites or over time. On the dashboard, ids in page addresses are removed, only plain button labels are sent (never names, emails or keys you entered), and the system-administrator console isn't measured. The data stays on our servers and is not shared.
- Bug reports. If you use Report a bug, we receive what you type, the email you give (optional), any screenshot you attach, the page address (without query strings or tokens), your browser version and recent script errors, and, if you're signed in, your user and organization ids. We use it to fix the problem and to reply to you, keep it in our own systems (including our self-hosted project board), and delete it when it's no longer needed.
Why we use it, and our legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Provide the Service: create your account, sign you in, issue and validate licenses, show your dashboard | Account data, Customer Data | Performance of our contract with you; for Customer Data, your instructions as controller |
| Keep the Service secure: rate limiting, abuse prevention, debugging, incident investigation | Account data, technical data | Legitimate interests in running a secure, reliable service |
| Understand how the sites are used and improve them (cookieless, self-hosted usage analytics) | Usage analytics | Legitimate interests in improving the Service, with no cookies and no profile of you |
| Fix bugs you report and reply to you | Bug reports | Legitimate interests; your request |
| Communicate about the Service: security alerts, changes to terms, outages, replies to support requests | Account data | Contract; legitimate interests |
| Product news and announcements | Consent, which you can withdraw at any time. We do not send marketing email without it. | |
| Billing, tax and accounting (once paid plans start) | Billing data | Contract; legal obligation |
| Comply with law and enforce our terms | Any relevant data | Legal obligation; legitimate interests |
We do not sell personal data, share it for cross-context behavioural advertising, or use Customer Data for our own purposes beyond running, securing and improving the Service. We do not use automated decision-making that produces legal effects about you. Validation results are decided by the rules you configure, such as expiry dates and machine limits.
Who we share it with
- Subprocessors that host and deliver the Service, listed on the Subprocessors page.
- Your organization. Staff in your organization can see data according to the role the Owner gives them.
- Discord, if you connect a Discord server. At your instruction we post to the channels you choose (product and policy names, masked keys, customer names and masked emails, approximate location of key-sharing attempts) and send license holders their own license by direct message. Discord handles this data under its own terms; it is a recipient you choose, not our subprocessor.
- Authorities or others when required by law, or when needed to protect the rights, safety or property of our users, the public or SunDevs. Where the law allows, we tell you first.
- A successor if SunDevs is involved in a merger, acquisition or sale of assets, under the same protections as this policy.
International transfers
SunDevs is based in Sri Lanka. The Service is hosted on Oracle Cloud Infrastructure in the United States and delivered through Cloudflare's global network, so personal data is processed outside the country where you are. Where the law requires it (for example for data from the EU, EEA, UK or Switzerland), we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.
How long we keep it
See the Data retention policy. In short: account data and Customer Data are kept while your organization exists, and deleted within 30 days of a request to close it; logs are kept only for a short time.
How we protect it
See Security: encryption in transit, hashed passwords and API keys, strict separation between organizations, and least-privilege access by our staff.
Your rights
Depending on where you live, you may have the right to:
- access the personal data we hold about you and get a copy of it;
- correct inaccurate data;
- have your data deleted;
- receive your data in a portable format;
- object to or restrict certain processing, including processing based on legitimate interests;
- withdraw consent at any time, where we rely on consent;
- complain to a data protection authority, such as the Data Protection Authority of Sri Lanka or the supervisory authority where you live or work.
To use any of these rights, email [email protected] with "Privacy" in the subject. We reply within 30 days and may need to confirm your identity first. Some changes, such as updating your organization or disabling staff, you can make yourself in the dashboard.
If your request concerns Customer Data (you are an end user of a vendor's software), we will forward it to the vendor, who is the controller, and help them respond.
California residents: we do not sell or share personal information as defined by the CCPA/CPRA, and we will not discriminate against you for exercising your rights.
Children
The Service is for businesses and developers and is not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.
Changes
We will post changes here and update the effective date. For material changes we give at least 30 days' notice in the dashboard or by email.
Contact
SunDevs (Pvt) Ltd, Sri Lanka · [email protected]