Skip to content
LacreDoc

LacreDoc

Privacy policy

Last updated: 14 November 2026

This policy covers LacreDoc, the app, and lacredoc.com, the website where it is sold: what each keeps about you, why and on what legal basis, who else handles it, how long it is kept, and your rights.

Who is responsible

LacreDoc and this website are made and run by Nikoloz Tarielashvili, individual entrepreneur, trading as LacreDoc, Georgia, who is responsible for the personal data this policy describes (the controller). Our address is on the Legal page. For a question about your data, or to use one of the rights below, write to [email protected].

The app: your documents stay on your computer

LacreDoc has no account, no analytics, no advertising and no tracking, and it sends us nothing about your documents. What it sends to activate a licence is in the next section.

  • Your documents. LacreDoc opens, signs and keeps your documents on your computer. On the Mac, the Document Library keeps them in a folder you choose (Documents ▸ LacreDoc at first). If that folder is one that iCloud Drive or another service syncs, that service copies it as it copies any of your files; LacreDoc itself sends no document anywhere. Export, Share and Print send a document only where you choose.
  • Your signatures and stamps. LacreDoc keeps them on your computer. On the Mac, while "Sync with iCloud" is on in its Settings (it is on unless you turn it off) and you are signed in to iCloud, it also keeps them in the private database of your own iCloud account, which Apple keeps for you so that they reach your other devices. We cannot see them. Turning the switch off stops the sync and deletes nothing.
  • Folders and settings stay on your computer.
  • Updates (Mac). Once a day, unless you turn it off in Settings, LacreDoc asks our update file whether a new version is out. Like any request on the internet it carries your IP address, and it names LacreDoc and its version; Cloudflare, which hosts the file, handles it for us. We keep no record of these requests, and LacreDoc sends nothing else with them.
  • Other services. LacreDoc signs in to no service of its own. It opens and saves files through the windows your system provides, so a service such as Google Drive or Dropbox is reached only through its own app on your computer, under its own terms.

If you get LacreDoc from the App Store, Apple handles the purchase under its own privacy policy, it needs no licence from us, and we do not learn who you are.

When you activate a licence

LacreDoc works without a licence, except Export, Print and Share; Compare works 10 times without one. When you enter a serial number, LacreDoc sends LacreDoc's licence server (license.lacredoc.com, which Cloudflare runs for us) the serial number, a code made from your computer's ID (a one-way hash: the server never receives the ID itself), whether the computer is a Mac or a PC, LacreDoc's version and its language. The server checks the serial number against its own records, records the activation, and gives LacreDoc a signed certificate for that computer. While LacreDoc is activated it checks the licence, with the same data, each time it starts and at most once a day after that, when you are online. Deactivating, moving the licence and cancelling it (Cancel License…, to ask for a refund) send the same data.

For each licence the server keeps: the email address and the language of the purchase, Paddle's ID for the purchase and what was paid for the licence, the serial number as a keyed hash and in encrypted form (sealed with a key only the server holds, so that it can send it to you again; never in plain text), whether the licence is active, refunded, cancelled or disabled, and its dates; if you cancel it, a hash of its cancellation code; for each activation, the computer's code, Mac or PC, and its dates; and the dates on which the licence was moved. Your serial numbers, a code for moving a licence to a new computer and a cancellation code are emailed to the purchase's email address through Resend. The server keeps a move code only as a hash, which stops working 15 minutes later and is deleted by a daily clean-up. So that no one can try serial numbers or codes without end, it counts requests by a keyed hash of the IP address, which the daily clean-up deletes within two days.

We use this to give your licence to one computer at a time, to send you your serial number, to let you move or cancel your licence, and to end it when a purchase is refunded. The legal basis is the performance of our contract with you.

When you visit this website

The website sets no cookies of its own, runs no analytics or advertising, and loads nothing from other companies: its fonts and pictures come from this site. The one exception is the Buy page, and only when you click Buy: it then loads Paddle's checkout (Paddle.js, from Paddle) and opens it over the page, as the next section says. If our host, Cloudflare, has to check that a visitor is not a robot, it may set a cookie needed only for that check. To show the price in your currency, the site asks Cloudflare which country your connection comes from; it keeps nothing.

Our host, Cloudflare, handles technical data such as your IP address, your browser and the addresses you ask for, downloads included, on our behalf, to deliver the site and to protect it from attacks and abuse. The legal basis is our legitimate interest in a website that works and is safe. We do not keep this data ourselves.

No other company can collect information through this website about what you do across websites, and we treat every visitor alike, whether or not their browser sends a Do Not Track or Global Privacy Control signal.

When you buy a licence

Paddle sells LacreDoc licences for us: it is the reseller and the Merchant of Record of every order. Before the checkout opens, you type your email address on our Buy page. When you click Buy, the page opens Paddle's checkout and gives it the page's language and that address, so that you need not type the address again and Paddle's receipt goes there. It also tells Paddle that you ticked the box to use LacreDoc straight away, and Paddle keeps that with your order. What you enter in the checkout (such as your name, your country and your payment details) goes to Paddle, which handles it as a separate controller under its own privacy policy. Paddle's checkout may use cookies or similar storage of its own, which that policy describes. We never see your full card number.

When you have paid, Paddle tells LacreDoc's licence server: Paddle's ID for the purchase, what was bought, how many and at what price, and the email address and language the Buy page gave it. Paddle's notice also carries its own record of how you paid (such as the card's type, its last four digits, its expiry date and the cardholder's name, or the PayPal address); the server reads none of it and keeps none of it. The server makes your serial number, keeps it as the section on activating says, and emails it to you through Resend; the Buy page then asks the server for it, with Paddle's ID for the purchase, and shows it to you. Paddle also tells the server when a purchase is refunded or a payment reversed, which ends its licence. Paddle shows us each order in its dashboard (your name and email address, your country, what you paid and when). We use this to give you your licence, to help you with your order and to refund it. The legal basis is the performance of our contract with you.

If you ask for your serial number again on the Buy page or the Contact page, the page sends the licence server the email address you type and the page's language. The server emails the serial numbers bought with that address, if there are any, and answers the same way either way, so the page does not show whether an address bought LacreDoc. So that the form cannot be used to flood an address, the server counts the requests for each address by a keyed hash of it, and the requests from each IP address by a keyed hash of that; the daily clean-up deletes these counts within two days. The legal basis is our contract with you, or, for an address that bought nothing, our legitimate interest in a form that cannot be abused.

When you write to us

Mail to our addresses, such as [email protected] and [email protected], is forwarded by Cloudflare to our mailbox at Google (Gmail): an ordinary Gmail account, not a business one. We use your email address and your message only to answer you and to keep track of the conversation. We pass them on only when you ask us to, or when we need to in order to answer you, for example to Paddle about an order you wrote to us about. The legal basis is our legitimate interest in answering the people who write to us. We keep a conversation for 12 months after its last message and then delete it, or sooner if you ask us to.

Who else handles your data

  • Cloudflare, Inc. hosts this website, LacreDoc's update file and its licence server, keeps the licence server's records in its database (D1), stores the installers (R2) and forwards our mail. It does this on our behalf, under its data processing terms. See Cloudflare's privacy policy.
  • Paddle sells LacreDoc licences as reseller and Merchant of Record: Paddle.com Market Limited, in the United Kingdom, or, for a buyer in the United States or Canada, Paddle.com Inc. or Paddle.com (Canada) Ltd. It handles your order as a separate controller under its own privacy policy, and tells the licence server about payments and refunds.
  • Resend, Inc., in the United States, sends the emails with serial numbers, codes for moving a licence and cancellation codes, on our behalf, under its data processing terms. See Resend's privacy policy.
  • Google keeps our mailbox: a consumer Gmail account, which Google runs as a separate controller under its own terms and privacy policy.
  • Apple keeps your signatures in your iCloud account if you sync them, and sells LacreDoc in the App Store, under your own agreement with Apple and Apple's privacy policy.

Cloudflare, Google, Paddle and Resend may process data outside the European Union and the European Economic Area, in particular in the United States. Cloudflare, Inc., Google LLC and Resend, Inc. take part in the EU-U.S. Data Privacy Framework and its UK Extension, and the European Commission decided on 10 July 2023 that the EU-U.S. framework protects personal data adequately. Cloudflare's data processing terms also include the European Commission's standard contractual clauses, for any transfer the framework does not cover. Paddle's privacy policy says how it protects the data it handles as controller.

We ourselves work from Georgia, for which the European Commission has made no such decision. The EU's data protection rules still apply to what we do with your data, and so does the Law of Georgia on Personal Data Protection. We do not sell your data or use it for advertising, and we pass it to no one else except as this policy says.

How long we keep it

  • The licence server's records of a licence and its activations: for as long as the licence exists, so that it keeps working and can be moved, and, once it is refunded or cancelled, so that its serial number cannot be used again; then we delete them. You can ask us to delete yours sooner; the licence then stops working on your computer. A deleted record can stay for up to 30 days in the short-term history Cloudflare keeps of the database so that it can be restored, and is then gone.
  • A move code: it stops working 15 minutes after it was sent, and the daily clean-up deletes it within a day. The counts of requests: at most two days.
  • Paddle keeps its own record of your order, as its policy says.
  • Mail: 12 months after the last message of a conversation.
  • The technical data Cloudflare handles: we keep none of it; Cloudflare keeps its own records for as long as its terms say.

Your rights

You have the right:

  • to know what data we hold about you and to get a copy of it (access);
  • to have it corrected if it is wrong (rectification);
  • to have it deleted (erasure);
  • to have its use limited while a question about it is settled (restriction);
  • to object to what we do with it on the basis of our legitimate interest (objection);
  • to receive the data you gave us in a common, machine-readable format, or have it sent to someone else (portability);
  • to complain to a data protection supervisory authority, in particular in the country where you live or work, or to the State Audit Office of Georgia, which supervises data protection there, since we work from Georgia.

Your right to object. Where we rely on our legitimate interest (the website's technical data, the counts of the form for sending serial numbers again, and mail), you can object at any time, for reasons to do with your situation. We then stop, unless we have compelling legitimate grounds that override your interests, rights and freedoms, or need the data to establish, exercise or defend a legal claim.

To use a right, write to [email protected]. It costs nothing. We answer within 10 working days, and within 3 working days if you ask us to limit the use of your data while a question about it is settled. We may ask you to write from the address the request is about, so that we know the data is yours.

No automated decisions

We make no decision about you by automated means that has a legal or similarly significant effect on you, and we do no profiling.

Children

LacreDoc and this website are not aimed at children under 16, and we do not knowingly collect data about them. If you think a child under 16 has given us their data, write to us and we will delete it.

Changes

If this policy changes, the new version will be posted on this page with a new date. If a change affects how we use an email address you gave us, we will also tell you by email before it applies.

Contact

Questions about your data and requests about your rights: [email protected]. Help with LacreDoc, a licence or an order: [email protected].