PRIVACY

Privacy Policy

Effective September 3, 2026

This Privacy Policy explains how Lacerta Film Lab ("Lacerta," "we," "us," or "our") handles information when you visit lacertafilmlab.com, purchase or activate Lacerta Film Lab, use Lacerta License Manager, or contact support.

Plain-language summary. Lacerta does not maintain a separate customer-account database. Purchases are handled by Lemon Squeezy. If you voluntarily subscribe to Lacerta Film Lab emails, Brevo stores your email address and subscription records for that mailing list. The license service processes the minimum information needed to validate a purchase and bind one license seat to one machine. Your raw hardware identifier never leaves your machine. The plugin does not transmit footage, rendered frames, grades, LUT content, project settings, or usage telemetry. Lacerta does not sell personal information or use it for targeted advertising.

1. Information handled

Website visits and demo downloads. Lacerta's website and public release service are hosted and protected by Cloudflare. Cloudflare may process an IP address, request time, requested URL, browser and device information, network and routing information, and security signals needed to deliver and protect them. When a demo platform is requested and when the release service starts an installer response, Lacerta records aggregate counts by UTC date, event type, operating-system platform, release version, coarse source page, and crawler classification. The aggregate counts do not include an IP address, email address, cookie, user-agent string, device identifier, or unique visitor identifier. Requests are not proof of a completed download, installation, or individual person. Lacerta does not use advertising pixels or cross-site advertising profiles.

Optional analytics cookie. If you allow analytics cookies, downloads.lacertafilmlab.com sets a random first-party cookie named __Host-lacerta_demo for up to 30 days. A cryptographic hash of its random value is stored separately with the consent date, policy version, expiry, and daily demo-request counts. This helps distinguish repeat requests from consenting browsers. It is not linked to an email, purchase, license, hardware identifier, or browsing on other sites. Known crawlers are excluded from this browser-level count, but unrecognized automation may remain. You may decline without losing access to the demo. Cookie consent does not enroll you in email marketing.

Remembering your choice. The website stores your allow or decline preference and its expiry in this browser's local storage under lacerta.analytics-choice.v1 for up to 30 days. This preference does not contain a unique identifier. Cookie settings in the footer lets you change your choice. Declining stops optional browser counting immediately and requests deletion of this browser's cookie and linked analytics records. If deletion cannot reach the server, the website reports the problem and retries on your next visit. Clearing browser storage or changing devices may prevent us from associating a later request with the old random identifier.

Optional email signup. If you enter your email address, select the separate mailing-list checkbox, and confirm through the email Brevo sends you, Brevo stores your email address, subscription and confirmation events, delivery and engagement events, unsubscribe or blocklist status, and related mailing-list records. Lacerta uses this information to send plugin updates, new-feature announcements, setup and usage guidance, and occasional offers. Email signup is optional and is not required to download the demo, purchase, activate, or use Lacerta. Analytics-cookie consent does not provide email consent, and email consent does not enable analytics cookies. The release service records only daily aggregate signup-request outcomes by source page in its D1 database; those aggregate records contain no email address or unique identifier.

Purchases. Lemon Squeezy acts as merchant of record. It may collect and retain your name, email address, billing address, country, tax information, payment information, order history, IP address, device information, and other information needed for checkout, fraud prevention, receipts, taxes, refunds, chargebacks, and legal compliance. When checkout begins through lacertafilmlab.com, the website also passes version identifiers for the EULA and Privacy Policy acknowledged before checkout into the Lemon Squeezy order metadata. Lacerta does not receive or store your complete payment-card or bank-account details. Lemon Squeezy generates the license key and makes it available in your receipt and My Orders page.

Activation and transfer. Lacerta License Manager sends the license service your license key, normalized checkout email, an app-specific machine hash, and, when applicable, the Lemon Squeezy license-instance identifier. The service uses Lemon Squeezy purchase metadata and license instances to verify the key and email. Lemon Squeezy's configured activation limit determines whether the one-machine seat is available. The service then returns a signed lease bound to the machine hash.

The raw operating-system hardware identifier is transformed locally with an application-specific cryptographic hash and is never transmitted. The service applies a second keyed hash before using a shortened device tag as the Lemon Squeezy instance name. License keys, emails, request bodies, raw device identifiers, and full leases are not intended to be written to Lacerta service logs or a Lacerta database. Cryptographically derived, truncated tags may be processed for rate limiting and abuse prevention.

Local license data. A signed machine-bound lease is stored in the operating system's per-user application-data location so the plugin can verify the license without network or credential-store access inside DaVinci Resolve. On macOS, the license key, checkout email, and instance identifier are stored in the device-only macOS Keychain. On Windows, they are stored in Windows Credential Manager for the local computer. On Linux, they are stored in Linux Secret Service when that service is available. If Linux Secret Service is unavailable, activation still installs the signed local lease, but Lacerta does not persist the license key, checkout email, or instance identifier; the customer must retain the receipt and may need to enter the key and email again for deactivation or transfer. The lease contains license and instance identifiers, the app-specific machine hash, Lemon Squeezy product and variant identifiers, issue and validity timestamps, and a random nonce. A perpetual lease remains locally verifiable on the activated computer without routine server contact. Copying that lease to another computer does not unlock the Software.

Refunds, chargebacks, and revocation. A previously issued perpetual lease cannot be remotely erased from the original computer. A refund, chargeback, fraudulent purchase, or license revocation may terminate licensed use under the End User License Agreement and may block later activation, deactivation, transfer, downloads, updates, or support. Lemon Squeezy and Lacerta may retain transaction or dispute records as required for fraud prevention, accounting, legal compliance, and dispute resolution.

Support. If you contact support, Lacerta receives your email address and whatever information you choose to provide, such as your name, order number, operating system, Resolve version, diagnostic details, screenshots, or project information. You should never email a complete license key or confidential client footage unless specifically requested through a secure method.

2. Why information is used

Information is used to:

  1. deliver the website and Software and measure aggregate demo-download activity;
  2. process purchases, issue receipts and license keys, and meet tax and accounting obligations;
  3. verify purchase ownership, activate or deactivate one seat, transfer a seat, and reject copied or shared licenses on other computers;
  4. prevent fraud, abuse, credential stuffing, and attacks on the website or license service;
  5. provide support, diagnose problems, and communicate about a request;
  6. send requested Lacerta Film Lab emails and administer confirmations, unsubscribes, and suppression; and
  7. comply with law and protect Lacerta, customers, and third parties.

Where data-protection law requires a legal basis, these activities rely on performance of a contract, compliance with legal obligations, and legitimate interests in operating and securing the product. Optional browser-level analytics relies on your consent, which you can withdraw through Cookie settings. Marketing email relies on separate consent, which you can withdraw using the unsubscribe link in any marketing email. Lacerta will request separate consent if a future use requires it.

3. Service providers and disclosures

Lemon Squeezy provides checkout, payment processing, taxes, receipts, license-key generation, license instances, downloads, refunds, and chargebacks. Lemon Squeezy is merchant of record and handles information under its Privacy Policy and Buyer Terms.

Cloudflare provides website hosting, DNS, network security, the license-service and public-release Workers, rate limiting, and aggregate demo analytics. Cloudflare may process IP addresses, routing metadata, and security information under its Privacy Policy and applicable service terms.

Brevo provides double-opt-in confirmation, mailing-list storage, marketing-email delivery, unsubscribe and suppression handling, and delivery and engagement reporting. Brevo processes mailing-list information under its Privacy Policy and applicable service terms.

Google's Gmail service processes support email sent to [email protected] under Google's Privacy Policy.

Information may also be disclosed when reasonably necessary to comply with law, respond to valid legal process, protect rights or safety, investigate fraud or abuse, or complete a merger, acquisition, financing, reorganization, or sale of the product or business. Lacerta does not sell personal information and does not share it for cross-context behavioral advertising.

4. Retention

Optional browser identifiers expire 30 days after consent and are not extended by repeat downloads. Expired identifiers immediately stop contributing to browser reports. An hourly cleanup removes expired identifiers and their linked daily records in bounded batches; deletion may take longer if there is a backlog or service interruption. Withdrawal requests deletion earlier. Aggregate counts without browser identifiers are retained separately and are not removed when a cookie is withdrawn.

Brevo mailing-list records are retained while you remain subscribed and as reasonably necessary to operate the list, document consent, honor unsubscribes and suppression, protect deliverability, resolve disputes, and meet legal obligations. Unsubscribing stops future marketing email but may require retaining a minimal suppression record so the address is not added again accidentally. You may also request deletion where applicable.

Lacerta keeps information only as long as reasonably necessary for the purposes described here, including support, security, dispute resolution, and legal obligations.

The Lacerta license service is designed to process activation credentials in memory without a separate customer-information database. Aggregate daily demo counts may be retained as ongoing business-measurement records because they contain no personal or unique visitor identifier. Cloudflare may retain analytics, rate-limit, security, and infrastructure records according to the account configuration and Cloudflare's policies. The local credential-store record, when available, and signed lease remain on the computer until you deactivate the seat, remove them, or erase the computer. On Linux without Secret Service, no key, email, or instance identifier is retained by Lacerta after activation. Support correspondence is retained only as long as reasonably needed to resolve the request, preserve necessary business records, or establish or defend legal claims.

Lemon Squeezy, Cloudflare, Brevo, and Google determine retention for information they process under their own policies. Purchase, tax, fraud, and transaction records may need to be retained by Lemon Squeezy for legal and accounting reasons even after you ask Lacerta to delete information it controls.

5. Security

Lacerta uses measures designed to reduce unnecessary collection and protect license data, including HTTPS, request-size limits, rate limiting, protected operating-system credential storage when available, application-scoped hashing, a second server-side keyed hash, signed machine-bound leases, strict product and store validation, and keeping network and credential-store access out of the Resolve render process. No electronic system can be guaranteed completely secure.

6. International processing

Lacerta is based in Michigan, United States. Lemon Squeezy, Cloudflare, Brevo, Google, and their service providers may process information in the United States and other countries. Those countries may have different privacy laws. Each provider describes its international-transfer safeguards in its own privacy materials.

7. Your choices and rights

Depending on where you live, you may have rights to request access, correction, deletion, restriction, objection, portability, or information about the handling of your personal information. You may also have the right to complain to a privacy or data-protection authority.

To exercise a right concerning information controlled by Lacerta, email [email protected]. Lacerta may need to verify your identity and purchase before completing a request. Deleting local activation data or information needed to verify a license may prevent activation, transfer, or support. Requests about checkout, payment, tax, receipt, or Lemon Squeezy account data should also be directed to Lemon Squeezy because it controls those records.

You can withdraw mailing-list consent at any time using the unsubscribe link in a Lacerta Film Lab marketing email. An unsubscribe applies to marketing email and does not disable essential purchase receipts, licensing responses, or direct support replies.

8. Children

The website and Software are intended for professional and creative users and are not directed to children under 16. Lacerta does not knowingly collect personal information from a child under 16. If you believe a child has provided information directly to Lacerta, contact us so it can be reviewed and deleted where required.

9. Third-party links

The website, installer, receipts, or documentation may link to third-party sites. Their privacy practices are governed by their own policies, not this Privacy Policy.

10. Changes

Lacerta may update this Privacy Policy to reflect product, service-provider, legal, or operational changes. The effective date above will be updated when material changes are published. If a change materially affects how existing customer information is used, Lacerta will provide notice where required by law.

11. Contact

Lacerta Film Lab Michigan, United States [email protected] Use the subject: Lacerta Privacy Request