DCP SQUARE Validation Tool — Privacy Notice
Who is responsible
DCP SQUARE provides the app and subscription support. The data controller is Mario Sergio De Almeida Moreira trading as DCP SQUARE, at 28 Laughton Road, Northolt, UB5 5LL, United Kingdom. Contact info@dcpsquare.com for privacy questions or requests.
This notice concerns the app subscription, its download page and related support. Other DCP mastering services may involve different data handling and should have their own explanation.
DCP inspection and reports stay on your Mac
The app performs DCP inspection locally. Its activation requests do not upload DCP picture or audio assets, KDM contents, report contents, report logos or local file paths to the activation server.
Reports, inspection history and PDF branding settings are stored on your Mac. Activation credentials and installation private keys are stored through macOS Keychain. Local inspection/decryption keys are used on the Mac; the activation service does not need their private key material.
You control whether to share reports or assets with another person. If you ask us for support and choose to send files, screenshots or reports, we will receive what you send. Please minimise personal or confidential material, redact unrelated information and agree a suitable transfer method with us first.
Information handled online
| Information | Purpose | Source |
|---|---|---|
| Purchase name, email, business/contact details supplied at checkout, order/invoice/subscription identifiers, payment status and relevant payment-method references | Supply and administer the subscription, verify payment, deliver activation, handle cancellation, refunds and payment disputes | You and our payment provider, Square |
| Licence identifier, hashed activation-token record and encrypted code-delivery/recovery copy, installation public key or its derived identifier, paid-access dates, verification status and relevant request records | Bind access to one active Mac and verify licence eligibility | The app and our activation service |
| IP address, request time, endpoint, response status and other routine hosting/security logs | Operate, secure and troubleshoot the service | Your connection and hosting providers |
| Messages, contact details and diagnostic material you choose to send | Respond to enquiries, provide support and deal with complaints | You or an authorised contact |
| Browser/device information and website interactions, depending on enabled website features and consent settings | Deliver and maintain the website and, where enabled lawfully, measure its use | Website/browser interactions |
The app's installation identifier is derived from an app-generated key; it is not your Mac serial number. It remains an identifier linked to a licence and should not be described as anonymous data. The server stores a hashed token for licence lookup and an encrypted copy for authorised code delivery/recovery. The private code is supplied to the activation endpoint over HTTPS when used.
Square processes payment details in its checkout. We do not receive full card numbers or card security codes through the app. Payment notices can include contact information, payment references and limited card details. Our server stores payment-event notifications to verify and reconcile subscriptions.
Activation-email delivery shares your purchase email address, private activation code, installation instructions and applicable policy copies with Resend and your email provider. We record delivery identifiers and status to investigate failed or bounced messages. The automatic-delivery workflow stores queued activation messages encrypted on our activation server.
Why we use this information
We use information necessary to enter into and perform the subscription contract, including payment verification, code delivery, licence checks and requested support. For an individual consumer or sole-trader customer, this can be processing necessary for the contract. Where we handle a company employee's contact details, our legitimate interest is administering the business customer's relationship and responding to that person's work enquiry.
We rely on legal obligations where records are needed for tax, accounting or another applicable duty. Our legitimate interests also include proportionate fraud prevention, service security, troubleshooting and handling legal claims. We balance these purposes against your rights.
Optional marketing or non-essential website tracking requires an appropriate legal basis and, where required, consent. Buying the app is not blanket consent to marketing. The website provides cookie controls to accept, decline or manage non-essential cookies and to revisit your preferences. Squarespace non-essential cookies are restricted pending your choice, and its visitor activity log is disabled. This does not claim that every third-party integration has been audited. No new marketing programme is being enabled for this launch.
Providers and recipients
We use Square for payment and subscription processing, Render for the activation service, Resend for activation-email delivery, Squarespace for the website, and Google services for the app download and business email/support records. Professional advisers and authorities may receive information where reasonably necessary or legally required.
Providers may act as our processors for some activities and as independent controllers for their own payment, security or service obligations. Their own notices explain those activities:
- Square buyer privacy: https://squareup.com/gb/en/legal/general/privacy-no-account
- Resend privacy: https://resend.com/legal/privacy-policy
- Render privacy and data-processing terms: https://render.com/privacy and https://render.com/dpa
- Squarespace privacy and cookies: https://www.squarespace.com/privacy and https://www.squarespace.com/cookie-policy
- Google privacy: https://policies.google.com/privacy
The app itself does not upload inspection assets to these providers. Opening a hosted download, checkout or website exposes routine connection information to the provider operating it.
International processing
Our activation hosting is in Oregon, United States. The Resend sending region is Ireland, but this does not mean all email processing or provider administration stays in Ireland. Our website, download, payment and email providers may process information in other countries, including the United States.
For processing carried out on our behalf, the providers publish data-processing terms and international-transfer provisions. These include standard contractual clauses and the UK international data transfer addendum where applicable. Some providers also describe reliance on the UK Extension to the EU–US Data Privacy Framework where it applies. We do not treat a selected hosting region as a guarantee of UK-only processing. Contact info@dcpsquare.com for information about the safeguards applicable to your data and how to obtain a copy, with confidential information redacted where necessary.
Provider terms: Resend https://resend.com/legal/dpa; Render https://render.com/dpa; Squarespace https://www.squarespace.com/dpa; Google https://cloud.google.com/terms/data-processing-addendum/ and https://policies.google.com/privacy/frameworks.
Retention
We keep records according to their purpose and whether access, payment verification, a complaint, a dispute or a legal obligation is still active.
- Successfully processed initial-payment notification bodies and sent activation-email copies are reviewed for removal or minimisation after 30 days from verified completion and delivery. We retain the minimum identifiers needed to prevent duplicate processing and to investigate delivery. Unresolved, unverified or disputed records are kept for review; age alone does not trigger deletion.
- Licence, device-binding and necessary payment evidence remain while needed to administer access or resolve a dispute. When those purposes end, we review what must be retained for legal obligations or claims and remove or minimise what is no longer necessary.
- Accounting records are considered separately under applicable tax and accounting obligations. That does not mean all raw notifications or diagnostic data need to be kept for the same period.
- Support correspondence and material you deliberately send are retained for the support issue and any related complaint or claim, then reviewed for deletion or minimisation. Ask us if you want a particular confidential support attachment removed earlier.
- Hosting logs, provider delivery records and backups follow the relevant provider's arrangements as well as our instructions where we control them. Removing an application-store record does not immediately remove earlier backup copies. We do not claim that email already delivered to a recipient can be recalled or erased from that inbox.
Local reports and branding settings remain under your control on your Mac. Removing an app may not remove its saved reports or Keychain records; contact support if you need help identifying those locations. Copies you send us are handled under the support-retention criteria above.
Your choices and rights
Providing the information needed for payment and licence verification is necessary to supply paid activation. If you do not provide it, we may be unable to supply or maintain subscription access.
Depending on the circumstances, you can request access, correction, deletion, restriction or portability of your personal information, and object to processing based on legitimate interests. Where consent is used, you may withdraw it without affecting earlier lawful processing. Some rights have legal exceptions, including necessary accounting records.
Email info@dcpsquare.com. We may need proportionate information to verify identity; do not send identity documents unless specifically requested through an agreed secure process. You may also complain to the Information Commissioner's Office: https://ico.org.uk/make-a-complaint/.
Routine licence checks can automatically reject access when eligibility or verification fails. You can contact us for manual investigation of an incorrect result. We do not use app activation data to make decisions about employment, credit or similar matters.
We will date changes to this notice and explain material changes where appropriate. A privacy notice explains processing; accepting subscription terms is not blanket consent for every use of personal data.