VectorStyler Privacy Notice
Last updated: 5 November 2026
This Privacy Notice explains how NumericPath Oy processes personal data in connection with VectorStyler for macOS, Windows, and Linux, its website, purchases, license administration, crash reporting, and community forum. It explains why information is used, how long it is kept, and your rights.
NumericPath processes personal data in accordance with the EU General Data Protection Regulation (Regulation (EU) 2016/679, or GDPR) and applicable Finnish law. This notice complements the VectorStyler End-User License Agreement (EULA). Accepting the EULA does not constitute consent to optional analytics or marketing.
1. Controller and contact details
NumericPath Oy is the controller responsible for the processing described in this notice, except where another provider acts as a separate controller as explained below.
- Finnish Business ID: 2919266-7
- VAT ID: FI29192667
- Registered office: Salo, Finland
- Privacy contact: support@vectorstyler.com
- Website: www.vectorstyler.com
Please use the email address above for privacy enquiries and requests concerning your personal data. You do not need a forum account or a particular subject line to exercise your rights. Do not post a privacy request containing personal information on the public forum.
2. Your artwork belongs to you
As between you and NumericPath, your artwork belongs entirely and unconditionally to you. NumericPath acquires no ownership of your artwork, designs, documents, or other creative work because you use VectorStyler, register a license, or request support. Your ownership does not depend on keeping a license active, agreeing to analytics or marketing, or continuing to use the application. Rights belonging to other people in materials you incorporate remain unaffected.
VectorStyler does not upload artwork or other user files to its license server, either automatically or through a manual file-upload feature. Its application communications are limited to trial and license administration, activation and update checks, and crash reporting as described in Section 3. The application does not make third-party connections. Website analytics and the separate Paddle and Apple purchase channels are described separately in this notice.
If you independently supply an example file for testing or correction of a reported bug, we use it only to investigate and address that issue. The file remains yours. We delete our working copies when the bug is fixed, or earlier when they are no longer needed. Any longer retention requires a specific individual arrangement and a lawful reason for retaining any personal data in the file. Backup copies are handled under Section 10.
Posting a file on the public forum makes it available to other people; it does not transfer ownership to NumericPath. Files provided through an individually agreed private support arrangement are not made public merely because you supplied them. A license to use suggestions or Feedback under the EULA does not transfer ownership of accompanying artwork or remove anyone’s data protection rights.
3. Personal data we process and its sources
The information involved depends on how you interact with us. Not every category applies to every person.
| Activity | Information involved and source |
|---|---|
| Trial registration | The email address you provide and minimum registration information needed to administer the trial and prevent repeated use of the same trial entitlement. |
| Paddle purchases | The purchaser’s name and email address supplied by Paddle, used to issue and send the License Key and associate it with the purchase. NumericPath does not receive or store payment-card details. |
| License administration | Registration name and email address, License Key, activation or registration records, and license status. If a license is cancelled or revoked, the key’s status and information necessary to administer that cancellation or revocation are retained. These records originate from registration, purchase information, and our license administration. |
| Activation and update checks | The application version, operating-system name, and purchaser’s name and email address are transmitted to NumericPath to associate the request with the activation. Relevant trial or license information is used to check the entitlement. |
| Crash reporting | Crash information generated by the operating system is sent automatically to NumericPath to investigate application failures. Contents depend on the operating system and report format. We treat identifiable diagnostic information as personal data. |
| Website and server security | Connection information received when your device contacts our services, including IP addresses and technical request or security-event information recorded in server security logs. |
| Forum and support | Account and contact details you provide, account authentication information, username, optional profile information, posts, relevant moderation records, and information or files you independently submit for help. Reports from other participants may identify the account or post concerned. |
| Website analytics | Information collected through Google Analytics 4 (GA4) with the consent described in Section 9, including online identifiers, page views and interactions, referral information, browser or device characteristics, and approximate location. |
| Communications and privacy requests | Relevant email addresses, communication preferences, records of consent or objections, and correspondence needed to handle a privacy request or legal claim. |
Purchases through Apple’s App Store are addressed in Section 6. We do not receive or store payment-card details from that channel either.
If an employer or institution supplies a user’s details to arrange a license, it is a source of those details. Its purchase does not constitute the user’s consent to optional marketing or analytics.
The information needed to issue, deliver, and verify a license is required for those functions; without it, we may be unable to complete registration or activation. Information necessary to fulfil a statutory obligation must also be retained where the law requires it. We identify the relevant need when requesting information. Optional analytics, marketing, public forum participation, and files unrelated to a support issue are not conditions of owning a paid license.
4. Purposes and legal bases
We identify a legal basis for each purpose. Collection does not become necessary for a contract merely because it is mentioned in the EULA.
| Purpose | GDPR legal basis |
|---|---|
| Provide an individual’s requested trial or paid license, send the License Key, perform necessary activation and entitlement checks, and supply included updates | Article 6(1)(b): steps at your request before a contract or performance of the contract with you, to the extent objectively necessary. |
| Administer an organization’s licenses and assist its authorized users | Article 6(1)(f): our and the organization’s legitimate interests in delivering and administering the licensed application. |
| Fulfil an individual customer’s request for contractual support | Article 6(1)(b): performance of the contract with that customer. |
| Investigate crashes and bugs, respond to other support enquiries, and improve reliability | Article 6(1)(f): our legitimate interest in diagnosing faults and correcting the application, subject to necessity, proportionality, and your rights. Where consent is required for collecting or transmitting diagnostic information, we obtain it and rely on Article 6(1)(a) for that consent-based processing. |
| Prevent trial abuse, misuse of cancelled or revoked keys, fraud, and security incidents | Article 6(1)(f): our legitimate interests in protecting license entitlements and maintaining secure services. |
| Operate and moderate the forum | Article 6(1)(f): our and participants’ legitimate interests in providing a support community and preventing abuse. |
| Meet accounting, tax, data protection, or other binding legal duties | Article 6(1)(c): compliance with the relevant legal obligation. |
| Establish, exercise, or defend legal claims | Article 6(1)(f): our legitimate interest in protecting and enforcing legal rights. |
| Analyze website use through GA4 | Article 6(1)(a): your consent, together with compliance with rules governing storage of or access to information on your device. |
| Send promotional announcements or offers | Article 6(1)(a): your consent, unless the limited existing-customer exception in Section 5 applies. Under that exception, the GDPR basis is Article 6(1)(f), subject to your unconditional right to object to direct marketing. |
| Keep minimum evidence of consent, withdrawal, objections, and handling of privacy requests | Article 6(1)(c): our GDPR accountability and rights-handling obligations, limited to what is necessary. |
A customer’s contract does not automatically provide a contractual basis for data about other people in a test file. Where we act as controller, necessary handling of that incidental data is assessed under the relevant lawful basis, ordinarily our legitimate interest in resolving the reported problem. Sensitive personal data requires an additional applicable legal condition. Please remove unnecessary personal or confidential information before providing a test file.
The legal basis for subsequent use of a crash report does not replace consent separately required for accessing information on your device or transmitting it. Where that consent is required, automatic reporting must not begin before it is obtained. You may contact our privacy email to withdraw consent or object to crash-data processing; accepting the EULA is not a blanket waiver of those choices.
5. Forum support and email communications
Ordinary support and community discussions take place through the VectorStyler forum, operated by NumericPath. Public posts and attachments can be read or copied by others and may be indexed by search engines. Keep License Keys, private correspondence, and confidential or personal files out of public posts.
Email is also used to deliver License Keys, respond to privacy requests, and provide necessary individual license or security communications. These are distinct from promotional messages.
We may send emails about major releases or offers. A message promoting an upgrade, purchase, or offer is direct marketing even if described as an update notification. For trial users, promotional email requires prior consent unless a separately applicable legal exception exists; trial registration and failure to opt out are not, by themselves, that consent.
For an existing customer, we may use the limited legal exception for marketing our own similar products or services only if all applicable conditions are met, including lawful collection of the contact details in connection with a sale and a clear, free opportunity to object both at collection and in each message. A purchase through a reseller or the App Store does not automatically establish that this exception applies to NumericPath.
Each promotional email provides a straightforward way to unsubscribe. You may also opt out by emailing support@vectorstyler.com. We stop direct marketing following withdrawal or objection. A minimal suppression record may be kept to ensure that we do not contact you again for that purpose.
Declining marketing or website analytics does not terminate your perpetual license, reduce an existing update entitlement, or prevent necessary support.
6. Paddle and Apple’s App Store
Paddle handles purchases through its checkout as the authorized reseller or merchant of record. It is separately responsible for data used for payment processing, tax, fraud prevention, and its other purposes. NumericPath receives the purchaser’s name and email address to issue and deliver the License Key. We do not receive or store payment-card details. See Paddle’s Privacy Policy.
Apple handles App Store purchases and the associated Apple account and payment information under its own terms and privacy information. NumericPath is responsible for any entitlement information it actually processes and information you separately provide for registration or support. We do not receive or store payment-card details. See Apple’s Privacy Policy and the App Store’s privacy information.
Requests about records independently controlled by Paddle or Apple should be directed to that provider. NumericPath remains responsible for information it holds and will help identify the relevant provider where appropriate.
7. Hosting, access, and disclosures
NumericPath’s own records are stored on dedicated Hetzner servers located in Finland. NumericPath operates its email, support, and forum services. Access is limited to authorized people who need the information for the purposes in this notice.
Relevant recipients or categories of recipients are:
- Hetzner, as infrastructure provider, to the extent involved in hosting, maintaining, or protecting the servers under applicable service and data-processing arrangements;
- Google, for GA4 website analytics;
- Paddle and Apple, for their respective purchase channels;
- professional advisers, competent authorities, or courts, where disclosure is necessary and lawful for a specific obligation, investigation, or claim;
- a business successor or prospective acquirer, where necessary for a genuine business transaction, subject to minimization, confidentiality, and the required legal basis and safeguards; and
- forum participants and the public, for information you choose to publish.
Providers processing data on our behalf must be subject to appropriate instructions, confidentiality obligations, and data-processing terms. Providers determining their own purposes have separate controller responsibilities. Using a provider does not itself make that provider a processor for every activity.
8. Processing outside Finland and the EEA
Storage of NumericPath’s own records in Finland is distinct from processing by Google, Paddle, and Apple. Their services can involve processing outside Finland or the European Economic Area (EEA), including in the United States. This notice therefore does not represent that every item of information involved in analytics or a purchase remains in Finland.
For transfers for which NumericPath is responsible, an applicable GDPR transfer mechanism must be in place. Google’s applicable Data Processing Terms provide for international processing and relevant transfer arrangements, including an applicable adequacy-based arrangement or Standard Contractual Clauses where required. We assess the protection provided and any necessary additional safeguards. Analytics consent does not replace that assessment or the required transfer mechanism.
You may request information about the recipients and destinations relevant to our processing, the applicable transfer mechanism, and a copy of relevant safeguards by emailing our privacy contact. Paddle and Apple explain transfers they independently control in their own notices.
9. Google Analytics 4 and cookies
We use Google Analytics 4 (GA4) on the VectorStyler website to understand visits, interactions, and the usefulness of website content. Google is the analytics service provider. GA4 is separate from the desktop application’s trial checks, license checks, and crash reporting.
Analytics may involve online identifiers, page and interaction events, referral information, approximate location, and browser or device characteristics. Such information is not necessarily anonymous merely because it does not display your name.
We require prior consent for optional analytics. Rejecting analytics must not prevent necessary website functionality. Before consent, the website’s consent information identifies the technologies used, their provider, purpose, storage duration, relevant sharing, and available choices. Additional analytics or advertising features require appropriate disclosure and any necessary consent before being enabled.
You can withdraw consent through the website’s consent controls or contact us for assistance. Withdrawal stops future consent-based collection and does not affect the lawfulness of earlier processing. EULA acceptance, silence, or continued browsing does not constitute analytics consent.
Cookies or similar storage strictly necessary to transmit communications or provide a service you request may be used without cookie consent. Associated personal-data processing still needs a valid GDPR basis. See Google’s Privacy Policy for its handling of information. NumericPath remains responsible for explaining its website’s use of GA4 and the configured retention periods.
10. Retention and deletion
We keep personal data for the applicable purpose and delete or irreversibly anonymize it when no longer needed, unless a legal duty or another specific lawful basis requires further retention. Replacing a name with a code does not necessarily anonymize information.
| Record category | Retention rule |
|---|---|
| Name, email address, and active-license records | While you use VectorStyler and to the extent necessary to administer continuing license and update rights. If you permanently stop using the application, you may notify us and request deletion. We remove information no longer needed and explain any limited records retained for a separate purpose below. Lack of recent activation activity is not proof that a perpetual license has ended. |
| Trial registration email addresses | Minimum information is retained to prevent repeat use of the same trial entitlement while the earlier registration remains relevant to trial eligibility. We review that need and delete or irreversibly anonymize records when the earlier registration can no longer affect eligibility or another lawful need has ended. These records are not, by themselves, a marketing list. |
| Cancelled or revoked License Keys | The key and necessary status are retained while needed to prevent use or reactivation of an invalid entitlement. Names and email addresses are retained only where separately necessary. We reassess records when the validation system or entitlement rules no longer require them. |
| Server security logs | 30 days. Records relevant to a particular incident or claim may be separated and kept only for the investigation or claim, with restricted access. |
| Crash reports | Only while reasonably necessary to investigate and correct the failure and verify the correction. We remove unnecessary personal details and delete or irreversibly anonymize identifiable reports when no longer needed. An unresolved issue does not justify retaining every report indefinitely. |
| Artwork and example files supplied for testing or bug correction | Working copies are deleted once the bug is fixed, or earlier if no longer needed. Longer retention requires an individual arrangement and a continuing lawful basis. Public forum copies can also be removed by the user; backups follow the cycle below. |
| Forum accounts and associated posts | Users can remove their accounts and associated posts. Accounts are not deleted solely because of inactivity. We nevertheless review whether retaining personal data remains necessary, and statutory deletion and objection rights continue to apply. Necessary evidence of specific abuse or a claim may be retained separately. |
| GA4 information | For the configured user/event periods disclosed with the website’s analytics consent information and only as long as necessary for the stated purposes. Cookie lifetimes are identified separately. Personal data in exports or reports is subject to the same necessity assessment. Withdrawal and deletion requests are handled under the GDPR. |
| Marketing preferences and consent records | Contact details are used for marketing only while permission or a lawful exception remains valid. Following an opt-out, only minimum evidence and a suppression record are retained as needed to demonstrate and honor the choice. |
| Privacy requests and legal-claim records | During handling and, where justified, for up to five years after the request is completed or the claim is finally resolved. Records are removed sooner if no longer needed. Longer retention requires a specific legal obligation, preservation requirement, or continuing claim. Five years is NumericPath’s maximum ordinary policy period, not a period prescribed by GDPR. |
| Legally required accounting or tax records | Only the records NumericPath is legally required to retain are kept for the applicable period. Finnish accounting law generally requires at least six years for vouchers and transaction correspondence, counted from the end of the calendar year in which the financial year ended, and at least ten years from the financial year-end for specified core accounting records. Those duties do not apply indiscriminately to application or forum data. |
Backups follow a rolling cycle of no more than three months. Deletion from active systems may be followed by removal from backups within that cycle. Data awaiting backup expiry is kept out of ordinary use, and applicable deletions are reapplied following restoration. Legally required preservation is limited to relevant records rather than extending the entire routine backup cycle.
Paddle and Apple determine retention for records they independently control.
11. License verification and automated processing
Trial and license checks use registration and entitlement information to determine whether the relevant use is authorized. An unsuccessful check can prevent activation or continuation of the requested use. A technical error does not, by itself, establish misuse or terminate a valid perpetual license.
If you believe a result is incorrect, contact support@vectorstyler.com without posting your License Key publicly. You may explain your circumstances, contest the result, and request review by a person able to reconsider it.
For a solely automated decision with a legal or similarly significant effect, Article 22 GDPR restrictions and safeguards apply. Such a decision requires a legally permitted basis and meaningful information about the relevant logic and consequences. EULA acceptance does not waive those rights. This notice does not treat all license checks as automatically exempt from these requirements.
12. Your data protection rights
Subject to the applicable GDPR conditions, you may:
- ask us to correct inaccurate or incomplete information;
- request deletion or restriction of processing;
- withdraw consent without affecting the lawfulness of earlier consent-based processing; and
- exercise the protections concerning qualifying automated decisions described in Section 11.
You may object, on grounds relating to your particular situation, to processing based on legitimate interests. We must stop unless we establish compelling overriding grounds or need the information for legal claims.
You may object to direct marketing at any time, without giving a reason. We then stop using your information for that purpose.
Email support@vectorstyler.com to exercise your rights. If we reasonably doubt your identity, we may request proportionate additional information; we do not routinely require identity documents for every request.
We respond without undue delay and within one month, unless a permitted extension is necessary because of the complexity or number of requests. An extension may be up to two additional months, and we explain it within the first month. Requests are normally free. A reasonable fee or refusal is possible only where GDPR permits it, such as a demonstrably manifestly unfounded or excessive request.
These rights are not all absolute. If we cannot comply fully, we explain why, identify any information that must be retained, and explain complaint and judicial remedies. Exercising your privacy rights does not, by itself, cancel your software license.
13. Complaints
You may raise a privacy concern with us or complain directly to a competent supervisory authority without first completing a forum or support process. You may complain in the EEA country where you habitually live or work, or where the alleged infringement occurred.
In Finland, the authority is the Office of the Data Protection Ombudsman:
- Website: tietosuoja.fi/en
- Email: tietosuoja@om.fi
You also retain available judicial remedies.
14. Security and younger users
We apply technical and organizational measures appropriate to the risks, including restricting access to authorized people, controlling provider access, and maintaining procedures for security incidents. Where a personal-data breach requires notification to an authority or affected individuals, we provide it as required by law.
VectorStyler may be used in family or educational settings. A parent, guardian, or institution arranging a license should provide only necessary information. Where a service is offered directly to a child and consent is the applicable basis, any parental authorization required by law must be obtained. An adult’s purchase does not automatically authorize all processing of a child’s personal data.
15. Changes to this notice
We update this notice when our processing or legal obligations change. The date above identifies the current version. Before materially different processing begins, we provide appropriate information and obtain fresh consent where required.
Publishing a revised notice or your continued use of VectorStyler does not itself supply consent to new purposes, remove your data protection rights, or change your ownership of artwork or existing EULA rights.
