Legal
Privacy
Last updated 15 September 2026.
CoreForge Labs, based in Wellington, New Zealand, is the data controller for the information described here. The trading name and the individual behind it are identified in the terms of sale. Contact me at info.coreforgelabs@gmail.com about anything on this page.
What I hold, and why
| Data | Why | Kept |
|---|---|---|
| Your email address | To send your activation codes and to support you afterwards. Without it I cannot deliver what you bought. | While the licence exists |
| Licence and order records, which plugin, how many, the Paddle transaction reference | To prove you own the licence, reissue it after a Core replacement, and handle refunds. | 7 years (tax records) |
| Q-SYS Core Locking ID | A hardware identifier. It is what a licence binds to, and what makes offline activation possible. It identifies equipment, not a person. | While the licence exists |
| Activation history | So support can see what happened when something goes wrong, and to detect abuse. | While the licence exists |
What I do not hold
I never see your card details. Payment is handled entirely by Paddle; nothing about your card, billing address or tax status reaches my systems.
I run no advertising trackers and build no profiles of you. Measurement comes from two cookieless sources that never identify you: my own first-party counter, and Cloudflare Web Analytics (aggregate traffic figures, collected by my hosting provider without cookies or cross-site tracking). My own counter records page views, plugin downloads and add-to-carts so I can see what is popular and how the shop performs. For each page view I record the page path, the site that sent you (just its address, e.g. google.com, never the full link or any search terms), and a random per-tab session number that lets me count visits and conversion. None of this identifies you, there are no cookies, and it honours your browser's Do-Not-Track setting. I do not sell or share your data with anyone for marketing.
Who processes data for me
- Paddle.com Market Ltd (UK), Merchant of Record. Takes payment, handles tax, holds billing details. Paddle is a controller in its own right for that data; their privacy notice applies.
- Cloudflare (US/global), hosting, database, file storage, and cookieless aggregate site analytics.
- Resend (US), sends the activation and support emails.
These providers operate internationally, so your data may be processed outside New Zealand, including in the EU and United States, under the safeguards those providers maintain.
Cookies
This site sets no tracking or advertising cookies. Your cart is kept in your browser's local storage so it survives a page reload, it holds only which plugins you selected and how many, it never leaves your device except when you check out, and you can clear it by emptying your cart. Paddle's checkout sets its own cookies as part of taking payment.
Your rights
You can ask me for a copy of what I hold about you, to correct it, or to delete it. Email info.coreforgelabs@gmail.com and I will respond within 20 working days, as required by the Privacy Act 2020.
One honest limit: deleting your order record means I can no longer prove you own your licences, so I could not reissue one after a Core failure or verify a support request. I also have to keep transaction records for tax purposes. If you ask for deletion I will explain exactly what can and cannot be removed before doing anything.
If you are in the EU or UK you also have the right to complain to your local data protection authority. In New Zealand, that is the Office of the Privacy Commissioner.
How I protect it, and what happens if something goes wrong
I take reasonable technical and organisational steps to protect the information above. Access to customer records requires an administrator credential, data is held with the providers listed under Who processes data for me rather than on personal devices, and I keep the amount I hold deliberately small, I never see or store your card details.
If a privacy breach happens that is likely to cause you serious harm, I will notify you and the Office of the Privacy Commissioner as required by Part 6 of the Privacy Act 2020.