Privacy Policy

Last updated: 4 July 2026

1. Controller

The controller responsible for processing personal data on this website is:

Beatrix Willius
Moth Software
Im Flürchen 6
55481 Schwarzen
Germany

Telephone: +49 151 75080190
Email: [email protected]
Website: https://www.mothsoftware.com

A data protection officer has not been appointed because there is no legal obligation to appoint one.

2. General information

We process personal data only when this is necessary to provide this website, respond to enquiries, deliver software licenses, provide customer support, fulfil contracts or comply with legal obligations.

The relevant legal bases are, in particular:

Article 6(1)(a) GDPR where you have given consent;
Article 6(1)(b) GDPR where processing is necessary to enter into or perform a contract;
Article 6(1)(c) GDPR where processing is necessary to comply with a legal obligation; and
Article 6(1)(f) GDPR where processing is necessary for our legitimate interests and those interests are not overridden by your rights and interests.

We do not use automated decision-making or profiling that produces legal effects or similarly significantly affects you.

Our website, software and newsletter are not directed at children. We do not knowingly collect personal data from children.

3. Requirement to provide personal data

You are not required by law to provide personal data merely by visiting this website.

If you contact us by Email or through the contact form, we need the information required to process and answer your enquiry. If you do not provide the required contact information or message content, we may not be able to respond.

If you subscribe to the newsletter, we need your Email address and confirmation of your subscription. Without this information, we cannot send the newsletter.

If you purchase software, the personal data required by FastSpring and by us for order processing, license delivery, invoicing, tax compliance and customer support is necessary to enter into and perform the contract. If the required information is not provided, the purchase cannot be completed, the license cannot be delivered and support may not be available.

Some data must be retained because of statutory commercial and tax retention obligations. In such cases, deletion before the end of the statutory retention period may not be possible.

4. Hosting and server log files

This website is hosted by Power-Netz / Symgenius GmbH & Co. KG, Im Hüttenkamp 1, 38685 Langelsheim, Germany. The hosting provider processes technical connection data and server log files on our behalf.

When you visit this website, the web server automatically processes technical information required to deliver the requested pages and maintain the security and stability of the website. This information may include:

your IP address;
the date and time of access;
the requested page or file;
the amount of data transferred;
the referring website;
the browser and operating system used; and
information about whether the request was successful.

The processing is based on Article 6(1)(f) GDPR. Our legitimate interests are the technically reliable provision of the website, detection of faults and protection against attacks, misuse and unauthorised access.

Server log files are rotated daily and normally retained for 10 days, unless longer storage is necessary to investigate a specific security incident or to establish, exercise or defend legal claims.

We have concluded a data processing agreement with the hosting provider where required by Article 28 GDPR.

5. Cookies and local storage

This website does not use cookies for cross-site tracking.

Technically necessary cookies or comparable technologies may be used where they are required to provide a function expressly requested by you, to maintain security or to store a privacy preference. Such storage or access is based on Section 25(2) TDDDG. Where personal data is processed in connection with these technologies, the legal basis is Article 6(1)(f) GDPR or, where applicable, Article 6(1)(b) GDPR.

This website also uses Google Analytics, described in Section 7 below, which stores or accesses information on your device beyond what is technically necessary.

6. Website analytics with Matomo

We use the open-source web analytics software Matomo to obtain basic statistical information about the use of our website. Matomo is operated on our own webspace. Analytics information collected with Matomo is not transmitted to Google Analytics, Matomo Cloud or an advertising network.

Matomo is configured as follows:

IP addresses are shortened before storage;
we do not use a User ID;
we do not use cross-domain tracking;
we do not combine analytics information with customer or order data;
we do not use the information for advertising profiles; and
we do not attempt to identify individual visitors.

The information processed may include the shortened IP address, approximate geographic region, browser type, operating system, referring page, pages viewed, time of access, screen size and technical information about the visit.

The processing is based on Article 6(1)(f) GDPR. Our legitimate interest is to understand in aggregate how the website is used, identify technical problems and improve the structure and content of the website.

Raw analytics data is deleted after 2 years. Aggregated reports that no longer permit identification of individual visitors may be retained for longer.

You may object to this processing at any time on grounds relating to your particular situation by contacting us. You may also prevent analytics processing technically by using browser settings, content blockers or tracking protection.

7. Website analytics with Google Analytics

This website also uses Google Analytics, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google").

Google Analytics may set or read identifiers on your device and process information such as your IP address, device and browser information, approximate location, pages viewed, referring pages, and interactions with this website. This information is transmitted to and processed by Google, including outside the European Economic Area.

The storage of or access to information on your device for Google Analytics falls within the scope of Section 25(1) TDDDG, which generally requires consent for storage and access technologies that are not technically necessary.

You may prevent Google Analytics processing technically by using browser settings, content blockers, tracking protection, or Google's opt-out browser add-on.

Google LLC is certified under the EU-U.S. Data Privacy Framework, which the European Commission has recognised as providing an adequate level of data protection for personal data transferred to certified US organisations. Where this certification does not apply to specific processing, transfers rely on the European Commission's Standard Contractual Clauses.

Further information is available in Google's privacy policy: https://policies.google.com/privacy

8. Contact by Email or contact form

When you contact us by Email or through a contact form, we process the information you provide. This normally includes your name, Email address, message and any files or technical information you send to us.

The contact form uses a simple anti-spam question. This is processed only to check whether the form was submitted by a person and does not involve a third-party CAPTCHA or anti-spam provider.

If your enquiry concerns a purchase, license, existing contract or a request made before entering into a contract, processing is based on Article 6(1)(b) GDPR. For other enquiries, processing is based on Article 6(1)(f) GDPR. Our legitimate interest is to respond to enquiries and maintain business correspondence.

Support requests may contain diagnostic information voluntarily provided by you. Please do not send passwords or unrelated personal information. Where a support request contains personal data belonging to another person, you are responsible for ensuring that you are authorised to provide it.

Diagnostic files are processed only when you choose to send them to us for support purposes.

Enquiries are deleted when they are no longer required, unless continued storage is necessary for contractual documentation, accounting, the establishment or defence of legal claims, or compliance with statutory retention obligations.

9. Newsletter

You may subscribe to our newsletter to receive product news, release information and related offers.

The newsletter is sent on the basis of your consent under Article 6(1)(a) GDPR. Registration uses a double opt-in procedure. After registration, you receive an Email asking you to confirm your subscription. We retain information about the registration and confirmation, including the time of registration and confirmation and, where recorded, the relevant IP address. This information is required to document that valid consent was obtained.

We use Encharge to manage newsletter subscriptions and send newsletters. The provider is PXCH Holding I LLC, operating as Encharge, 2423 SW 147th Ave #2262, Miami, FL, 33185, United States. Encharge processes newsletter subscriber data on our behalf, including Email addresses, subscription status, consent records, unsubscribe information and technical delivery information.

Encharge states that its primary data centre for app data is located with Amazon Web Services in Ireland. Encharge may use subprocessors to provide the service. Encharge lists Amazon Web Services EMEA SARL as a required subprocessor and Twilio SendGrid as an optional Email-sending subprocessor.

Encharge is operated by a US company. Where personal data is transferred to or accessed from countries outside the European Union or European Economic Area, we rely on the safeguards agreed in our data processing agreement with Encharge, in particular the European Commission's Standard Contractual Clauses where no adequacy decision applies.

You can find more information in Encharge's privacy information and GDPR information:

https://encharge.io/privacy-policy/
https://gdpr.encharge.io/

We do not use newsletter opening tracking, tracking pixels or personalised link-click tracking.

You may withdraw your consent at any time by using the unsubscribe link included in each newsletter or by contacting us. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

After unsubscribing, your address may be retained in a suppression list to ensure that no further newsletters are sent to you. This processing is based on Article 6(1)(f) GDPR. Our legitimate interest is to comply reliably with your withdrawal and prevent unwanted Email.

10. Purchases through FastSpring

Our software is sold through FastSpring, an independent merchant of record. When you select a purchase link, you leave our website and are taken to a checkout operated by FastSpring.

The FastSpring companies include FastSpring B.V., Fred. Roeskestraat 115, 1076 EE Amsterdam, Netherlands, and affiliated FastSpring companies. FastSpring processes information required to complete the purchase, provide payment services, prevent fraud, calculate and collect taxes, issue invoices and fulfil its legal obligations.

FastSpring acts as an independent controller for the operation of its checkout, payment processing, fraud prevention and tax compliance. The nature and scope of FastSpring's processing are governed by FastSpring's own privacy policy:

https://fastspring.com/privacy/

After a purchase, FastSpring provides us with order information required to supply and administer the software license and provide customer support. Depending on the purchase, this may include your name, company name, Email address, country, product purchased, license quantity, order number, purchase date, refund status and payment or tax-related status. We do not normally receive complete credit-card or bank-account details.

We process this order information under Article 6(1)(b) GDPR to fulfil the license agreement and provide support. Information contained in invoices, transaction records and accounting records is also processed under Article 6(1)(c) GDPR to comply with statutory commercial and tax retention obligations.

Business correspondence and accounting documents are generally retained for the statutory retention periods applicable in Germany. Depending on the type of document, these periods may be six, eight or ten years. The period begins at the end of the relevant calendar year.

11. Software downloads, update checks and license administration

When you download software from our website, the request may be recorded in the server log files described above.

Our software may contact our server to check whether a newer version is available. During this request, technical connection data such as the IP address, time of access, requested update file, application name, application version and operating system version may be processed in server log files.

The processing is based on Article 6(1)(f) GDPR. Our legitimate interest is to provide updates, maintain compatibility and improve software security.

Where a license key, download information or product update is sent to you, we process the necessary customer, product and license information to fulfil the contract, administer the license and provide updates and support. The legal basis is Article 6(1)(b) GDPR.

We do not receive the contents of Emails, messages or archives that you process locally with our software merely because you use the software. Unless a specific product feature expressly states otherwise, archive data remains on systems or storage locations selected by you.

12. Recipients of personal data

We disclose personal data only where this is necessary and legally permitted. Recipients may include:

hosting and Email service providers acting on our behalf;
Encharge for newsletter management and newsletter delivery;
FastSpring in connection with purchases and order administration;
Google, for website analytics;
tax advisers and accounting service providers;
IT service providers where required for maintenance or security;
courts, authorities or legal advisers where disclosure is required by law or necessary to establish, exercise or defend legal claims.

Service providers acting on our instructions are contractually bound in accordance with Article 28 GDPR where applicable.

13. Transfers outside the European Economic Area

Some recipients or service providers may process personal data outside the European Union or European Economic Area.

Where such a transfer takes place, it is based on an adequacy decision by the European Commission, appropriate safeguards such as the European Commission's Standard Contractual Clauses, or another transfer mechanism permitted by Articles 44 to 49 GDPR.

FastSpring may process or transfer purchase-related information through affiliated companies and service providers outside the EEA. Further information about these transfers is available in FastSpring's privacy policy.

For Encharge, the primary processing location for app data is stated to be Amazon Web Services in Ireland. Because Encharge is operated by a US company and may use subprocessors outside the EEA, access from or processing in third countries may occur. Such transfers are based on the safeguards agreed in the data processing agreement, in particular the European Commission's Standard Contractual Clauses where no adequacy decision applies.

For Google Analytics, personal data is transferred to Google in the United States. Further information is provided in Section 7 above.

14. Retention of personal data

We retain personal data only for as long as necessary for the relevant purpose. We then delete or anonymise it unless continued retention is required by law or necessary for the establishment, exercise or defence of legal claims.

Server log files are rotated daily and normally retained for 10 days. Raw Matomo analytics data is deleted after 2 years. Aggregated analytics reports may be retained for longer where they no longer permit identification of individual visitors.

Newsletter subscription and consent records are retained for as long as the subscription exists and, where necessary, for a reasonable period afterwards to document consent or withdrawal. Suppression-list entries may be retained to ensure that unsubscribed addresses are not contacted again.

Applicable German commercial and tax laws may require certain business records to be retained for six, eight or ten years. Contractual claims are generally subject to statutory limitation periods, which may also affect how long relevant correspondence and records are retained.

15. Your rights

Subject to the applicable legal requirements, you have the following rights:

the right of access under Article 15 GDPR;
the right to rectification under Article 16 GDPR;
the right to erasure under Article 17 GDPR;
the right to restriction of processing under Article 18 GDPR;
the right to data portability under Article 20 GDPR;
the right to object under Article 21 GDPR; and
the right to withdraw consent at any time under Article 7(3) GDPR.

Where processing is based on Article 6(1)(f) GDPR, you have the right to object at any time on grounds relating to your particular situation. We will then stop the processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms or the processing is required for the establishment, exercise or defence of legal claims.

You may object to processing for direct-marketing purposes at any time. Personal data will then no longer be processed for that purpose.

To exercise your rights, contact us using the details stated above.

16. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority under Article 77 GDPR.

The supervisory authority responsible for us is:

The State Commissioner for Data Protection and Freedom of Information Rhineland-Palatinate
Hintere Bleiche 34
55116 Mainz
Germany

Website: https://www.datenschutz.rlp.de

You may also contact the supervisory authority in the EU or EEA member state in which you live or work or in which the alleged infringement occurred.

17. Security

We use appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure and unauthorised access. Data transmitted between your browser and this website is protected using TLS encryption.

No method of transmission or electronic storage can provide absolute security.

18. Changes to this privacy policy

We may update this privacy policy where our website, services, service providers or legal obligations change. The current version is published on this page. The date of the latest revision is shown at the beginning of the policy.