Last updated: August 2026
We, SynthScript, Owner: Christoph Kretschmer, Hornisgrindestraße 9, 77855 Achern, Germany (“we” or “us”), operate the PxlMonk licence service at licences.pxlmonk.com. Below we explain which data this service processes, when, why and on what legal basis — and which rights you have.
SynthScript, Owner: Christoph Kretschmer
Hornisgrindestraße 9, 77855 Achern, Germany
Email: info@pxlmonk.com
Note: There is currently no obligation to appoint a data protection officer. If this changes, we will publish the contact details here.
This policy covers the licence service: the pages under licences.pxlmonk.com and the requests the PxlMonk application makes to it (requesting a trial, activating a licence, checking an activation, removing an activation). The website pxlmonk.com has its own privacy policy.
PxlMonk itself is a local desktop application. It transmits neither your images nor your edits nor your library metadata to us or to anyone else; all of it stays on your own computer. The only connections the application makes to us are the licence operations described here.
When you access this service, our web server automatically records the following in temporary log files:
In addition, the application writes operational logs so that failures can be traced. These may contain the email address concerned and the identifier of a payment — for instance when a licence email failed to send and we need to know which one.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in stable, secure operation and in diagnosing faults).
Storage period: Log files are kept briefly for security and fault analysis, then deleted or anonymised.
We use no analytics, tracking or advertising services on this service, and embed no external fonts or images.
One exception, and only one: pressing Buy on the buy page loads Paddle.js from
cdn.paddle.com. That is the script that opens the payment process — without it there
is no checkout on that page. It loads only there, and only when something is actually being sold;
no other page of this service loads a third-party script. Paddle learns your IP address and the
usual browser details in the process, and sets cookies of its own (see section IV). Paddle is the
controller for that; their privacy policy applies, see section VI.
This service sets no analytics or marketing cookies. Only strictly necessary cookies are set:
Legal basis: § 25(2) TDDDG (strictly necessary to provide the service you explicitly requested) together with Art. 6(1)(b) and (f) GDPR. You can delete both cookies in your browser at any time; doing so ends the customer-area session.
Paddle sets cookies of its own once you are on the buy page — for the payment itself and for fraud detection. Those are not ours: we can neither read them nor switch them off. Which they are and how long they last is in Paddle's privacy policy (section VI). On every other page of this service it stays at the two above.
When you request a 30-day trial licence in the application, we process:
Purpose: to issue and send you the trial licence, and to make sure only one is issued per email address and per computer.
Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures at your request) and, as far as limiting it to one trial is concerned, Art. 6(1)(f) GDPR (legitimate interest in preventing abuse).
Storage period: The record remains after the trial has expired — without it, the limit of one trial per address and computer could not be enforced. We will delete it on request; that also removes the block, which is why we do not then issue a further trial for the same address.
Sales of PxlMonk are handled for us by Paddle as merchant of record — that is, as a reseller in its own name: Paddle is your contracting party for the purchase, issues the invoice and accounts for VAT. Which Paddle company that is depends on your country; for buyers outside the USA and Canada it is Paddle.com Market Limited, 30 Old Bailey, London EC4M 7AU, United Kingdom.
Your payment details — card number, PayPal account, billing address, VAT identification — are entered at Paddle. We never see them, they are not passed to us, and at no point do they reside on our servers. For that data Paddle is an independent controller, not our processor; Paddle's privacy policy applies, at paddle.com/legal/privacy, privacy contact privacy@paddle.com.
Once a purchase completes, Paddle notifies us. We then ask Paddle for only what we need in order to issue and deliver the licence: your email address and, where Paddle holds one, your name. We also store the payment identifier, so that a repeated notification of the same purchase does not produce a second licence.
Legal basis: Art. 6(1)(b) GDPR (performance of the licence contract between you and us).
Transfers to third countries: Where data is processed by Paddle in the United Kingdom, the transfer rests on the European Commission's adequacy decision for the United Kingdom. For processing by other Paddle companies, the safeguards described in Paddle's own privacy policy apply.
A purchased licence covers up to three computers. For that number to be countable at all, each installation registers with us once and checks back occasionally afterwards. In doing so we process:
In return your installation receives a small signed file confirming that this licence is activated on this computer. It lives on your computer; we store nothing additional for it.
Legal basis: Art. 6(1)(b) GDPR (performance of the licence contract) and Art. 6(1)(f) GDPR (legitimate interest in observing the agreed number of devices).
Storage period: Device entries that have not been in touch for a year are removed automatically and the slot becomes free again. You can also sign a computer off yourself from within the application at any time. The licence itself we keep indefinitely — it is perpetual, and without the record we could neither re-send nor renew it. Where statutory retention periods apply, they take precedence.
The customer area shows you your licences, their periods and the computers registered against them. There is no password and no registration: you enter your email address and are sent a sign-in link.
So that this stays an honest statement: what we hold against your address is nonetheless a lasting record, with your licences and the device list belonging to them (sections V to VII). What is missing is a password and a step where you sign up — not the stored data.
Of that link we store only a hash, not the link itself — a copy of our database is therefore not a set of working ways in. Alongside it we store the email address, the expiry time and the time of use. The link is valid for 20 minutes and works once; the session itself lasts 12 hours.
Legal basis: Art. 6(1)(b) GDPR. Storage period: Expired and used sign-in links are removed.
To send this service's emails — trial licence, purchased licence, customer-area sign-in link — we use Brevo (Brevo SAS, 8 rue de Londres, 75009 Paris, France). What is transmitted is your email address, the licence file as an attachment, and the details that appear in the email (such as the trial's expiry date or the sign-in link).
Brevo processes this data as our processor under a data processing agreement pursuant to Art. 28 GDPR; the infrastructure is hosted in the EU. Brevo's privacy policy is at brevo.com/legal/privacypolicy.
Legal basis: the same as for whichever operation the email belongs to (sections V, VI and VIII).
When requesting a trial licence you may additionally — voluntarily, through a box that starts empty — subscribe to our newsletter about new versions and tips for using the application.
Double opt-in: Ticking the box does not yet add you. You receive a confirmation email and are on the list only after clicking the link in it. If you do not confirm, the entry is not carried over.
What is stored is your email address, the times of consent and confirmation, and a marker of whether you are a prospect, a customer or a former customer — so that we do not send you notices that no longer apply to you. The list is managed at Brevo (see section IX).
Legal basis: Art. 6(1)(a) GDPR (your consent). Withdrawal: Every one of these emails carries an unsubscribe link; one click is enough, and the withdrawal takes effect for the future. It has no effect whatsoever on your trial or your purchased licence — those work regardless of whether you subscribed.
The support page lets you write to us, either straight to support@pxlmonk.com or through the form on it. Through the form we process the email address you give and the text you write. Both reach us as an email; no case, no account and no ticket number is created for it.
Legal basis: Art. 6(1)(b) GDPR where your message concerns your licence or a purchase, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries).
Storage period: We delete the message once your enquiry has been dealt with, unless statutory retention periods say otherwise.
Abuse protection: So that the form cannot be used to flood our mailbox, we briefly count how many messages arrive per address and in total. No IP address is stored for this — the count is kept against the address you gave, in memory, and it is gone after ten minutes. If it turns you away, the email address is on the page: the way to us stays open either way.
This service runs on servers operated for us by a hosting provider in Germany. That provider processes data (in particular server log files, see section III) solely as our processor pursuant to Art. 28 GDPR, under a data processing agreement.
This service is reachable over TLS only (recognisable by the “https://” prefix and the padlock in your browser). The PxlMonk application's requests to the licence service also run over TLS.
Within the limits of the law you have the right to:
A message to the contact details in section I is enough to exercise these rights. Where your rights concern the purchase itself — the invoice, say, or your payment details — Paddle is the right place to ask (section VI).
We may update this privacy policy from time to time, for instance when new functionality is added or legal requirements change. The version published on this page is always the one that applies.