Effective 5 August 2026. This policy explains what data Licentry ("we", "us") handles when you use licentry.cc, the vendor dashboard, the Licentry API, the Licentry Discord bot and the Licentry integration plugin, and what your choices are. The controller is the private individual who operates Licentry from Sweden. No business is registered behind it yet, so the registered name, address and numbers a controller would normally give you do not exist yet either; section 12 of the Terms of Service sets out what is published today and what is added when a business is registered, and this page is updated in the same change. Contact for anything privacy related: [email protected].
Two roles matter here. For vendor accounts (the businesses that sign up), we decide how the data is used, as the controller. For end user licensing data (the people who run software licensed through a vendor), we process technical data on that vendor's behalf so their licensing works; the vendor is the controller of that data and your first point of contact about it.
The integration plugin, and where your source code goes. The plugin you install into your own AI coding agent reads your source on your own machine to work out where licensing has to go, and then writes code into your files. None of that reaches us. What your agent reads goes to whichever AI provider you have that agent configured to use, under the agreement you already have with that provider; that provider is not our subprocessor, we do not contract with it on your behalf, and we receive nothing from it. We also do not receive the plan file the plugin writes, the answers you give its questions, or the names of your files.
What reaches us is the plugin fetching our public documentation pages and its manifest over HTTPS, which is byte for byte the request your browser makes for the same pages. Like every other request to the site it passes through Cloudflare first, as section 5 describes. It is logged the way any request to licentry.cc is logged: the address it came from, the method, the path, the status and the user agent, kept for up to 90 days, sooner if that log reaches its size limit. Those pages have no sign in, so what the record holds is a request from an address rather than a request from an account. One page, the hardening guide, does sit behind the dashboard sign in, and the plugin cannot fetch it at all; it asks you to save your own copy locally instead, and to keep that copy out of version control, for the reason section 4 of the Terms gives.
When software licensed through Licentry activates or validates a key, the API records:
If a vendor ships the optional Licentry desktop loader, that component reports more: the network adapter address, several network addresses seen on the machine, the account address, location derived from the IP down to postal code along with the internet provider and the network operator, and a snapshot of the running environment used to detect tampering. The adapter address and the account address arrive as they are and are kept only as keyed hashes; unlike the licensing API, the hashing happens on our side rather than in the client, so those two values do reach us in readable form before they are stored. Keyed hashing means we can tell whether two reports came from the same machine without being able to read the underlying identifier. Vendors who integrate the API directly, which is the normal case, send none of this.
Purpose: making licence checks work, enforcing the device and session limits the vendor configured, and giving the vendor evidence when one key is shared by many people. We never sell this data or use it for advertising.
Retention. Validation logs are deleted after 90 days, dashboard sign in history after 180 days, loader reports after 90 days, download records after 365 days, and the security audit trail after 365 days. The separate record of a Licentry administrator acting on a vendor's account, which carries that vendor's id and email address, is kept for 730 days, because it is the first thing anyone asks for after an incident. A sweep runs once a week, and each kind of record has its own window rather than a window shared with the sweep: a runtime session goes 30 days after its refresh window expires, a device record only once a vendor has cleared it and then 90 days later, expired sessions and used one time codes a week past their expiry, and queued notifications after 30 days. Encrypted backups on the server itself are kept as the three most recent copies of each kind rather than by age, and the off site copies for up to 30 days, sooner if that store reaches its size limit.
Invoices are the exception to all of that. Swedish accounting law requires us to keep them, and the records that belong with them, for seven years counted from the end of the calendar year in which the financial year ended rather than from the date on the invoice, so an invoice raised during 2026 is kept into 2033. That is bokföringslagen (1999:1078) 7 kap. 2 §. It is an obligation on us rather than a choice we made, so it survives a request to delete your account: when the account goes, the invoices stay for as long as that law says.
The bot connects a vendor's Discord server to their Licentry account. This section is the complete inventory of what it touches.
What the bot does not do. It does not read messages (it is built without the message content intent), does not collect member lists or presence, does not track voice, and only sends a DM when the vendor turned on DM confirmations and you redeem a key. It never posts publicly on your behalf.
Sharing. Discord bot data is visible to the vendor whose server and keys are involved, and to us for operating the service. It is not sold and not shared with anyone else. Discord itself processes everything you do inside Discord under its own privacy policy.
Removal. A vendor can detach any customer from a key in the dashboard, and can disconnect the whole server at any time; kicking the bot from the server ends all collection for that server. If you are a customer and want your Discord link removed, ask the vendor who sold you the key, or email [email protected] with the server name and we will handle it.
The dashboard sets one session cookie so you stay signed in, plus a short lived cookie during two factor sign in and another while you connect a Discord account. The customer portal sets its own session cookie for end users who sign in there. Every one of them is needed for the page it belongs to, so none of them asks for consent. On the pages where you pay by card, Stripe's own script runs and sets its own cookies, which Stripe uses to detect fraud across the sites it serves; that is part of taking a card payment rather than something we could turn off and still charge a card. Beyond that we run no advertising cookies and no analytics scripts, ours or anyone else's.
All of those except Stripe handle data only to provide their service to us, on our instructions. Stripe, alongside what it does for us, also handles payment data for its own regulatory purposes, as its entry above describes. We disclose data beyond that only if the law forces us to, and we tell you when we are allowed to.
Two things that are not that kind of relationship. To notice that an invoice has been paid we query public blockchain explorers with the payment address we generated for it, and those operators hold no account with you while the transaction is already public on the chain anyway. The country a licensing call came from is looked up on our own server against a data file rather than by calling a geolocation service, so no address leaves the machine for that.
Secrets are encrypted at rest under a master key that is not held in the database, credentials are stored as hashes rather than as reversible values, session tokens are stored hashed so a copy of the database cannot be used to sign in as you, transport is TLS everywhere, and each vendor's licensing material is sealed with cryptographic material specific to that account. Administrative actions land in an audit log owned by a separate database role that the application can add to but cannot edit or delete, and each entry is chained to the one before it so a removal is detectable.
No system is unbreakable, and we would rather describe the limits than imply there are none. Anyone who compromised the running server would be able to read what the server itself can read. If a breach ever affects your data we will tell you what we know, what we do not yet know, and what you should do, without undue delay.
You can ask us for a copy of your data, ask us to correct it or delete it, and object to a specific use. Vendors can self serve most of this in the dashboard: revoke keys, unlink Discord accounts, disconnect the server, or ask support to close the account. Depending on where you live (for example under the GDPR or the CCPA) these rights are backed by law, and you can also complain to your local supervisory authority. We answer every request at [email protected], normally within 30 days.
Licentry is a business tool and is not directed at children under 16. We do not knowingly collect their data; if you believe a child's data ended up here, write to support and we will delete it.
When this policy changes in a way that matters, we announce it in the dashboard or by email before it takes effect. The date at the top is always the current version. Earlier versions are available from support on request.