Privacy Policy

What we collect, and why

Grouped by why we hold it, because that is what determines your rights over it.

To give you the account and license you bought

Lawful basis: performance of a contract.

• Your email address — it is your account identifier, where your license key is sent, and how we reach you about your plan.
• A password hash — we store a hash, never your password. We cannot read it, and nobody who obtained the database could.
• Your license and order record — which license you hold, when you bought it, how long your updates run, how many devices you may use, and for rent-to-own, how many payments you have made. Your license key itself is stored only as a hash: we can check a key you present, but we cannot recover or display one.
• Sessions — when you sign in we store a session record with the browser user-agent string and when it was last used, so you can stay signed in and so an unfamiliar session is visible.

To activate Diamond on your machines

Lawful basis: performance of a contract.

• A device identifier derived from your computer's hardware, plus the app version, when it was activated, when it last checked in, and a name for the machine if you give one. This identifier is not anonymous. It is stored against your license for as long as that license exists, which is what lets us enforce the limit on how many machines you use at once, and what lets you see and remove your own devices from your account page.

To keep the service from being abused

Lawful basis: our legitimate interest in security.

• Rate-limit counters keyed to a one-way hash of your IP address rather than the address itself, so we can stop abuse without keeping a log of who visited.
• A one-way hash of the IP address a bug report was sent from, kept on the report as the only handle we have if one address floods us. The address itself is not stored.

Because the law requires us to keep it

Lawful basis: legal obligation.

• Payment records — the order identifier, amount, currency, status, and whether it was refunded. We do not receive or store your card number, and we never see it.

Only if you choose to give it

Lawful basis: consent, withdrawable at any time.

• Waitlist email — your address, and which page you signed up from so we can tell what works. Every email we send to that list has an unsubscribe link, and unsubscribing deletes the entry.
• Bug and crash reports — what you typed, the Diamond version, and your operating system. Your email address is optional here and used for one purpose only: replying about that report. It is never added to any mailing list.
• Diagnostics attached to a report — the tail of the session log, which typically contains file paths (and therefore usually your computer username), audio device names, and the names of plugins you have installed. Diamond shows you the exact text before it sends anything, and you can send the report without it. That is a supported outcome, not a broken report.

Cookies and analytics

This site sets two cookies, __Host-dsession and __Host-dnonce. Both exist only to sign you in and keep you signed in: the first is your session, the second is a short-lived token used while you verify an email address or reset a password. Neither is set unless you take one of those actions, so browsing this site signed out sets no cookies at all, and signing out deletes them. Because they do nothing but deliver a feature you asked for, they are strictly necessary and need no consent — which is why there is no cookie banner here.

We run no analytics, and no advertising or tracking cookies of any kind. If we add analytics later it will be a cookie-free product that reports aggregate page views without building a profile of you or following you across sites. A marketing pixel would need your consent first, and this page would say so before one was added.

Where it is stored

The database holding your account, license, activation and bug-report data is pinned to the European Union. That was set when the database was created and cannot be changed afterwards, so it is a property of the system rather than a promise about configuration.

Two exceptions, stated plainly. Our support mailbox is hosted by Zoho in the United States, so anything you email us is processed there. Our payment processor operates internationally. Both rely on the standard contractual safeguards for transfers outside the EEA.

Who else processes it

We do not sell your personal data, and we do not share it for anyone else's marketing. These are the providers who process it on our behalf, each under contract and only to provide their service:

• Polar — payments. Polar is the merchant of record and therefore the seller for your purchase, handling billing, invoicing and tax. It is a controller in its own right for that transaction, under its own privacy policy.
• Cloudflare — website hosting, the licensing API, and the database.
• Zoho — our support mailbox, which holds correspondence you send us.
• Kit — marketing email, if you opted in.
• Resend — transactional email such as license keys, password resets and receipts.

We may also disclose data where the law requires it. If that ever happens, we will tell you unless we are legally prohibited from doing so.

How long we keep it

• Account, license and activation data — for as long as you hold an account, and then until you ask us to delete it.
• Sign-in tokens — minutes. They are single-use, expire about fifteen minutes after they are issued, and are destroyed after a handful of failed attempts.
• Sessions — until they expire or you sign out.
• Waitlist entries — until you unsubscribe, or until the list has served its purpose.
• Bug and crash reports — until the report is resolved and no longer useful for diagnosing the same fault, and no longer than 24 months.
• Payment records — for the period Armenian bookkeeping and tax law requires us to keep them, which is longer than the rest and is explained below.

Your rights

Depending on where you live (including under the GDPR, the UK GDPR, and California's CCPA/CPRA), you can ask us to give you a copy of your data, correct it, export it in a portable form, delete it, or restrict or object to how we use it. Where we rely on your consent, you can withdraw it at any time, and withdrawing it does not make what we did beforehand unlawful.

Email privacy@diamond-daw.com and we will answer within the time your law allows (one month under the GDPR). We do not charge for this, and we will not ask you why.

If you think we have handled your data badly, you can complain to us first, but you do not have to: you are entitled to go straight to the data protection authority where you live.

Deletion, and the one thing we keep

When you ask us to delete your data we close the account and remove your email address, your password hash, your sessions, your device activations and their identifiers, any waitlist entry, and any bug reports you sent.

We keep the payment records, and we have to. Tax and bookkeeping law obliges us to retain proof of transactions for a set period, and that obligation overrides the right to erasure for those specific records. What survives is the order: an identifier, an amount, a date, and whether it was refunded. It is unlinked from your account, and we do not use it for anything except accounting.

Deleting your account does not disable software you have paid for. Diamond keeps opening your projects on every machine you have already activated, because it reads a license file already on your computer rather than asking us.

Children

Diamond is not directed at children under 13, or under the minimum age where you live if it is higher, and we do not knowingly collect their data. If you believe a child has given us data, email us and we will delete it.

Changes

We will update this policy as the product changes. The “last updated” date above always reflects the current version, and we will tell account holders by email before a change that materially affects them takes effect.

Contact

Maksim Danilov
Manushyan St. 81/1, Arabkir, Yerevan 0012
Republic of Armenia

Data protection enquiries: privacy@diamond-daw.com. This policy is governed by the law of the Republic of Armenia, without prejudice to the data protection rights your own law gives you.