Privacy Policy

Version 1, in force from ... 2026 · All legal documents

For us, the confidentiality and security of personal data are among the main concerns in the development of the Slim Archiver software, which was designed from the outset to process your files exclusively on your own computer and to send us only the minimum data necessary to manage licences and to answer your requests.

In this context, we have implemented measures which comply with the obligations imposed by Regulation (EU) 2016/679 (the "GDPR"), by Law no. 190/2018 on measures for the implementation of the GDPR and by Law no. 506/2004 on the processing of personal data and the protection of privacy in the electronic communications sector, and we wish to assure you of the highest standards of security and transparency regarding the personal data we process in our activity.

Since the processing of a limited set of personal data is necessary for our activity of developing, licensing and supporting a file-compression, archiving and encryption application for Microsoft Windows, sold through resellers acting as Merchants of Record, we guarantee that your data will be processed in compliance with the principles of lawfulness, transparency, data minimisation and security.

The purpose of this Privacy Policy is to help you understand what data we collect, why we collect them, what we do with them and, equally important, what data we do not collect. We have drafted it in a language as simple as possible, so that it is clear and intelligible to you. The capitalised terms which are not defined in this Policy (such as Software, Website, Edition, Licence, Licence Key, Activation, Archive or Merchant of Record) have the meaning given to them in the Terms of Service of Slim Archiver (the "Terms").

Definitions

a. "personal data" means any information relating to an identified or identifiable natural person ("data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to that person. Your e-mail address, your Licence Key associated with your order or the hardware identifier of your computer are, for example, personal data;

b. "processing" means any operation or set of operations which is performed on personal data, whether or not by automated means, such as collection, recording, organisation, storage, consultation, use, disclosure by transmission, restriction, erasure or destruction;

c. "controller" means the natural or legal person which, alone or jointly with others, determines the purposes and means of the processing of personal data;

d. "processor" means a natural or legal person which processes personal data on behalf of the controller, on the basis of its instructions;

e. "pseudonymisation" means the processing of personal data in such a manner that the data can no longer be attributed to a specific person without the use of additional information, which is kept separately, such as the hardware identifier calculated by the Software as a one-way hash;

f. "Merchant of Record" means the reseller which sells the Licence to you in its own name, namely Lemon Squeezy for the Pro edition and Paddle.com Market Limited for the Enterprise edition, and which acts as an independent controller for the purchase data.

A. The controller of personal data

The controller of personal data in relation to you is SLIMARCH SOFTWARE S.R.L., with its registered office in Cluj-Napoca, ..., fiscal identification code (CUI) ..., registered with the Trade Register under no. ..., EUID ... email: office@slimarchiver.com ("Slimarch", "we" or "us").

You can contact us for any matter regarding your personal data by e-mail, at privacy@slimarchiver.com, through the support form on the Website, or by post, at the registered office indicated above.

Slimarch acts as controller for the data of the visitors of the Website, of the persons who contact our support, of the customers who purchase and activate Pro Licences and of the representatives of organisations which subscribe to the Enterprise edition. The Merchants of Record act as independent controllers for the data they collect when selling Licences, under their own privacy policies, and the organisations which use the Enterprise edition act as controllers for the data processed through the features they configure on their own computers and systems.

Categories of data we process

I. If you are a visitor of the Website, we process only:

• technical data of the device and of the connection, processed by our hosting provider when delivering each page: IP address, approximate country, type and version of the browser and of the operating system, the pages requested, the date and time of the request.
• aggregate statistics on the pages visited, obtained through Cloudflare Web Analytics, which does not use cookies, does not track you across other websites and does not build an individual profile of you.

These data are collected automatically from your browser. The Website does not use advertising cookies, social-network plugins or third-party tracking technologies.

II. If you contact our support or our sales department, by e-mail or through the support form, we process:

• your e-mail address, your name, if you provide it, and, if you represent an organisation, its name. Legal basis: Article 6(1)(f) GDPR, our legitimate interest in answering the requests addressed to us;
• the content of your message and of the subsequent correspondence, including any attachments, and, if you choose to provide it, your Licence Key.
• for messages sent through the support form, your IP address and technical information about your browser, which are sent to Cloudflare Turnstile to check that the message comes from a person and not from an automated program, and which are not stored by us.

These data are collected directly from you. Messages are delivered to our mailbox, hosted by Google Workspace.

III. If you purchase and activate a Pro Licence, we process:

• the Licence Key, the activation identifier issued by Lemon Squeezy and the e-mail address associated with your order or, if the order has no e-mail address, your name, which Lemon Squeezy transmits to our licensing service from the order.
• the hardware identifier of the computer on which you activate the Licence, a 32-character value calculated on your computer as a one-way hash of hardware characteristics such as the serial numbers of the motherboard and of the system or, where these are not available, of the system drive, and the identification data of the processor, from which these characteristics cannot be derived and which therefore never leave your computer in clear form.
• the data relating to the status of the Licence, namely the date of Activation, the deactivation of a computer, the transfer of the Licence to another computer and, where applicable, the revocation of the Licence Key after a refund or chargeback.
• the payout statements and the order data made available by Lemon Squeezy in its dashboard, such as the order number, the date, the product, the amount and the country of the buyer.

These data are collected from the Software, when you activate the Licence, and from Lemon Squeezy, which processes as an independent controller, under its own privacy policy, your identification, billing and payment data. We do not receive and do not store your payment card data. We do not record your IP address, the details of your hardware, the names or contents of your files or any history of your use of the Software.

IV. If you represent an organisation which purchases or uses the Enterprise edition, we process:

• your name, your position, your professional e-mail address and, if you provide it, your telephone number, as well as the content of our correspondence for the negotiation, conclusion and performance of the subscription.
• the data included in the licence file and in the manifest of the Outlook add-in, namely the name of the organisation or of the person who ordered the subscription, the number of seats, the expiry date and the e-mail domains of the organisation, as well as our record of the licences issued, of the renewals and of the seat declarations.
• the billing and payment data of the organisation, processed by Paddle.com Market Limited as Merchant of Record and independent controller, of which we receive only the payout statements.

These data are collected directly from you, during the negotiation of the subscription, and from Paddle. Where the data concern the organisation itself and not a natural person, such as its name or its e-mail domains, they are not personal data.

V. If you use the Software, including the Enterprise edition within an organisation, the following data are processed exclusively on your computer and never reach us:

• the files, folders and Archives you process, their names and contents, the passwords and keys with which you encrypt them and the settings of the Software;
• the signed licence file, the timestamps of the licence checks and the secrets you configure for optional integrations, which are stored encrypted in the Windows Credential Manager;
• in the Enterprise edition, the audit log (time, Windows user name, action, file paths, result), the log of the data-loss prevention feature, in which the sensitive values detected are masked, and, if your organisation enables it, the entries forwarded to the Windows Event Log and to the organisation's own logging servers;
• the data exchanged with the services configured by you or by your organisation, such as cloud storage, password vaults and single sign-on through Microsoft Entra ID, which travel directly between your computer and those services, under your account and their terms.

For these data the controller is you or, where you use the Software within an organisation, the organisation, which is solely responsible for informing its employees, for establishing the legal basis of the processing and, where applicable, for complying with the rules on the monitoring of employees, and to which you should address any question about this processing. Single sign-on is performed by Microsoft, with your organisation's account, on the basis of an application registered by your organisation in its own Microsoft Entra ID tenant, and the basic profile information obtained in this way remains on your computer. The code of the Outlook add-in is loaded by Outlook from our domain outlook.slimarchiver.com, hosted by Cloudflare, which processes the technical data of the request, while the attachments processed by the add-in remain in your Outlook and are never sent to us.

Data we do not collect

The Software contains no telemetry, analytics, crash-reporting or usage-reporting functions, and the update check downloads a static file from the Website which carries no Licence Key, hardware identifier or other data about you. We do not request and we do not seek to collect special categories of data, national identification numbers, payment card data or data of persons under 18 years of age, who are not allowed to purchase Licences. If you include such data in a message addressed to us, we process them only to the extent necessary to answer you and we delete them upon request.

B. Purposes of the processing

We use the data we collect only for the purposes described below, each of which relies on a single legal basis, chosen as the most appropriate for that processing.

a. Delivery and security of the Website

We process the technical data of visitors in order to display the Website correctly, to deliver the downloads and documentation, to protect the Website against attacks, abuse and excessive traffic and to obtain aggregate statistics on its use.

b. Licensing of the Software

We process the data of Pro customers in order to activate and validate the Licence, to ensure that a Pro Licence is used on one computer at a time, to deactivate a computer and to transfer the Licence to another computer at your request, to apply free upgrades where the pricing page provides for them, to revoke the Licence after a refund or chargeback and to keep the list of revoked Licence Keys so that they cannot be reused.

c. Administration of Enterprise subscriptions

We process the data of the representatives of organisations in order to negotiate the subscription, prepare quotes, issue and renew licence files, verify the number of seats, communicate about renewals and support and keep the record of the licences issued.

d. Customer support and communication

We process the data of the persons who contact us in order to answer their questions, requests and complaints, to provide technical support, to handle the reports of errors and vulnerabilities, to answer pre-sale enquiries and to keep the record of the communication, as well as to protect the support form against automated abuse.

e. Accounting and tax obligations

We process the payout statements and the order data made available by the Merchants of Record in order to record our revenue, to keep the accounting records and to fulfil our tax obligations, including the tax credit for the taxes withheld abroad.

f. Defence of our rights

We process the data necessary for establishing, exercising or defending our rights in court, before authorities or in amicable procedures, including in case of fraud, misuse of Licences or infringement of our intellectual property rights, for a period of 3 years from the moment the right to bring the action arises, corresponding to the general limitation period provided by the Romanian Civil Code.

We undertake not to use your data for a purpose other than the ones described in this Policy without informing you beforehand and, where the law requires it, without obtaining your consent. We do not carry out profiling and we do not take decisions based solely on automated processing which produce legal effects concerning you or similarly significantly affect you.

Updating your personal information

If the information you have provided to us is wrong or changes, for example you have changed the e-mail address associated with your Licence, please contact us at privacy@slimarchiver.com and we will update it, it being possible that we ask you for information confirming that you are the holder of the Licence. To the extent that an alteration of the data occurs because they were provided to us incorrectly, incompletely or insufficiently, we are not liable for its consequences.

Disclosure of personal data

We do not sell your personal data and we do not transmit them to third parties for their own marketing purposes. We send personal data only to the recipients listed below, only to the extent necessary for the purpose indicated for each of them, and under the safeguards described in this Policy.

a. Our processors, which process data only on our behalf and on the basis of our instructions:

• Cloudflare, Inc. (United States): hosting of the Website and of the Outlook add-in, operation of the licensing service, delivery of messages sent through the support form, the Turnstile bot check, cookieless web analytics, security and protection against attacks.
• Data concerned: technical data of requests (IP address, browser, pages requested), Licence Keys, hardware identifiers, activation identifiers, the e-mail addresses associated with orders, and the content of support-form messages.
• Safeguards: data processing agreement; transfers under the EU-U.S. Data Privacy Framework and the standard contractual clauses.
• Google, through Google Workspace: hosting of our e-mail, including the support and sales mailboxes, and storage of our encrypted backups, including the records of Enterprise licences.
• Data concerned: the e-mail addresses, names and content of the messages you send us, and our replies, as well as, in encrypted form, the name of each customer organisation, the names and e-mail addresses of its representatives, its e-mail domains, the number of seats and the expiry date of its licence.
• Safeguards: data processing agreement; transfers outside the European Economic Area under the EU-U.S. Data Privacy Framework and the standard contractual clauses.

b. The Merchants of Record, which act as independent controllers for the purchase data:

• Lemon Squeezy (United States): sale of Pro Licenses, payment processing, invoicing, taxes, refunds and chargebacks, and issuing of License Keys.
• Data exchanged with us: the Licence Key, the activation identifier, the e-mail address or name associated with the order, the refund or chargeback status, and the payout statements.
• Safeguards: the Lemon Squeezy privacy policy governs its own processing; transfers under the EU-U.S. Data Privacy Framework or the standard contractual clauses.
• Paddle.com Market Limited (United Kingdom): sale and invoicing of Enterprise subscriptions, payment processing, taxes and renewals.
• Data exchanged with us: the name of the organization, the details of the order and of the renewals, and the payout statements.
• Safeguards: the Paddle privacy policy governs its own processing; transfers under the European Commission’s adequacy decision for the United Kingdom.

c. Our professional advisers, bound by confidentiality:

• Our accountant (Romania): keeping our accounting records and fulfilling our tax obligations, on the basis of the payout statements and order data of the Merchants of Record.
• Our lawyer (Romania): legal assistance, including for defending our rights, on the basis of the data strictly necessary for the matter concerned, under professional secrecy.

d. Other recipients, only where required:

• Public authorities and courts (Romania or the European Union): where we are required to disclose data by law or by a final decision, or where disclosure is necessary to establish, exercise or defend our rights.
• A successor of our business: in the event of a transfer of the Software or of the company, which will be bound by this Policy and of which you will be informed.

e. Data we do not send to anyone, because they never reach us:

• your files, Archives, file names and contents, passwords and encryption keys, which are processed exclusively on your computer;
• the logs of the Enterprise edition and the data of the data-loss prevention feature, which remain on your computer and in your organisation’s systems;
• the data exchanged with the services configured by you or by your organisation, such as cloud storage, password vaults and Microsoft Entra ID single sign-on. These travel directly between your computer and those services, and Microsoft processes them under the agreement concluded with your organisation.

Transfer of data outside the European Economic Area

Some of our providers are established, or process data, outside the European Economic Area. Transfers to the United States are made to providers certified under the EU-U.S. Data Privacy Framework, on the basis of the adequacy decision adopted by the European Commission through Implementing Decision (EU) 2023/1795, and, where a provider or a sub-processor is not certified, on the basis of the standard contractual clauses approved by Implementing Decision (EU) 2021/914, which are also included in the data processing agreements of our providers. Transfers to the United Kingdom are made on the basis of the adequacy decision adopted by the European Commission in respect of the United Kingdom. You may obtain information about these safeguards, and a copy of them where applicable, by writing to us.

Retention period of your personal data

We keep your personal data only for as long as necessary for the purposes for which they were collected, after which we delete or anonymise them, as follows:

• the activation record of a computer is kept until that computer is deactivated, and the minimum Licence data, namely the Licence Key, the activation identifier and the e-mail address associated with the order, are kept for as long as the Licence confers rights on you and for a further 3 years, corresponding to the general limitation period;
• revoked Licence Keys are kept, without other personal data, for as long as the Licence would otherwise have been valid, so that they cannot be reused;
• the data of Enterprise customers and of their representatives are kept for the duration of the subscription and for 3 years after its end;
• the correspondence with our support and sales department is kept for 3 years from the last message on the matter concerned;
• accounting documents, including the payout statements of the Merchants of Record, are kept for the periods laid down by Accounting Law no. 82/1991;
• the technical data of the requests to the Website and to the licensing service are kept by Cloudflare only for the short periods provided by its security and operation policies and are not exported or kept by us.

Where the data are necessary for the defence of our rights in a pending dispute or investigation, we keep them until its final resolution.

Your rights

In accordance with the GDPR, you have the following rights in relation to your personal data, which you may exercise free of charge:

• the right of access, namely to obtain confirmation as to whether we process your data and, where this is the case, access to them and to the information about their processing;
• the right to rectification of inaccurate data and to the completion of incomplete data;
• the right to erasure ("right to be forgotten"), where the data are no longer necessary, where you withdraw your consent, where you object to the processing and there are no overriding legitimate grounds, or where the data have been processed unlawfully, except where we must keep them to comply with a legal obligation or to defend our rights;
• the right to restriction of processing, where you contest the accuracy of the data, where the processing is unlawful, where we no longer need the data but you need them for a legal claim, or where you have objected to the processing, pending verification;
• the right to data portability, namely to receive the data you have provided to us, processed on the basis of the contract or of your consent, in a structured, commonly used and machine-readable format, and to have them transmitted to another controller;
• the right to object, at any time, on grounds relating to your particular situation, to the processing based on our legitimate interest, as well as the right to object at any time to the processing for marketing purposes;
• the right to withdraw your consent at any time, without affecting the lawfulness of the processing carried out before withdrawal;
• the right not to be subject to a decision based solely on automated processing, which we do not carry out;
• the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, Bucharest, www.dataprotection.ro, or with the supervisory authority of the Member State of your habitual residence or place of work, and the right to address the courts.

Please note that the erasure of the data relating to an active Licence, or the objection to their processing, may make it impossible to validate the Licence or to transfer it to another computer, in which case we will inform you of these consequences before acting on your request.

C. Response times to requests regarding your rights

You may exercise your rights by writing to privacy@slimarchiver.com or by post, at our registered office. We will answer your request within one month of its receipt, a period which may be extended by two months where necessary, taking into account the complexity and number of requests, in which case we will inform you of the extension and of its reasons within the first month. Where we have reasonable doubts as to your identity, we may ask you for additional information, such as the Licence Key or the order number, in order to confirm it, without asking for more data than necessary.

Requests are handled free of charge. Where requests are manifestly unfounded or excessive, in particular because of their repetitive character, we may charge a reasonable fee or refuse to act on them, informing you of the reasons.

Use of artificial intelligence systems

Neither the Software nor our licensing and support processes use artificial intelligence systems to analyse, evaluate or take decisions about you. The data-loss prevention feature of the Enterprise edition detects sensitive patterns defined by the organisation, such as identification or card numbers, through deterministic rules applied on the user's computer, without the use of artificial intelligence and without any data being transmitted to us.

Cookies

The Website does not use cookies for analytics, advertising or tracking, and our analytics tool, Cloudflare Web Analytics, does not use cookies. Cloudflare, as our hosting and security provider, may set, in certain circumstances, a strictly necessary cookie used to distinguish legitimate visitors from automated traffic, which is not used for any other purpose and, in accordance with Article 4(5) of Law no. 506/2004, does not require consent.

The name and duration of any security cookie set on the live Website are to be confirmed before publication.

Security of personal data

We follow high standards to protect the data we process, both during their transmission to us and afterwards, and we have adopted technical and organizational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access and any other form of unlawful processing, taking into account the limited nature of the data we process.

a. In order to guarantee security, we apply, in general, the following measures:

• access to personal data is limited to the administrator of Slimarch, who is bound to keep them confidential, and to our processors, only to the extent necessary for the services they provide to us;
• two-factor authentication is enabled on all accounts with access to personal data, namely the accounts with Cloudflare, Lemon Squeezy, Paddle and Google Workspace, and these accounts are protected by strong and unique passwords;
• the data are stored exclusively in electronic form, without physical archives, and all communications between the Software, the Website and the licensing service are encrypted in transit through HTTPS (TLS);
• the hardware identifier is transmitted and stored only as a one-way hash, from which the characteristics of your computer cannot be derived;
• the licensing service stores only the data strictly necessary for Activation and does not record IP addresses, hardware details, file names or usage history;
• licence files are digitally signed with a private key kept confidential and backed up only in encrypted form, so that any modification of a licence file invalidates it;
• the records of Enterprise licences are kept on encrypted devices, separately from the source code, and their backups are encrypted;
• complete payment card data never reach us, being processed exclusively by the Merchants of Record and by their payment providers;
• the Software contains no telemetry, analytics or crash-reporting functions, and the update check carries no personal data;
• we verify the network traffic of the Software before major releases, in order to confirm that no data other than those described in this Policy are transmitted;
• our accountant and our legal advisers are bound by confidentiality obligations, contractual or professional, and may not disclose the data to third parties.

b. Archives that you encrypt with the Software are protected as follows:

• the encryption keys are derived on your computer from your password through the Argon2id algorithm;
• the contents and, at your choice, the names of the files are protected through authenticated encryption with the XChaCha20-Poly1305 algorithm;
• your passwords and keys are never transmitted to us, so that we cannot access the contents of your encrypted Archives or recover them if you lose the password.

c. In the event of a personal data breach:

• we will document the breach, its effects and the remedial measures taken;
• where the breach is likely to result in a risk to your rights and freedoms, we will notify the ANSPDCP within 72 hours of becoming aware of it;
• where the breach is likely to result in a high risk, we will inform you without undue delay, describing the nature of the breach, its likely consequences and the measures taken or proposed to address it.

Minors

The Website and the Software are not directed at persons under 18 years of age, who are not allowed to purchase Licences. If we find that we have received personal data of a minor without the consent of the legal representative, we will delete them.

Changes to this Policy

We may update this Privacy Policy to reflect changes in the Software, in our providers, in our processing activities or in the law, by publishing the new version on the Website, with the date from which it applies, and, where the changes are significant and we have your contact details, by informing you by e-mail before they take effect. Where a change requires your consent, we will ask for it before applying the change to your data.