Privacy Policy and Cookie Notice
Last updated: —
1. Key Terms
| Term | Definition |
|---|---|
| Personal Data | Any information that can directly or indirectly identify a natural person (e.g., name, email, IP address, Stripe customer ID). |
| Processing | Any operation performed on personal data, including collection, storage, use, transmission, deletion, etc. |
| Controller | The entity that determines the purposes and means of data processing. Under this Policy, it is our company (see Chapter 2). |
| Processor | An entity commissioned by the Controller to process data (e.g., Stripe / Cloudflare / Resend; see Chapter 5 and Appendix A). |
| Subprocessor | A further processor commissioned by a Processor (e.g., Stripe's card-issuing bank / Cloudflare's data centers). |
| Sensitive Data | Highly sensitive categories such as health, biometrics, sexual orientation, religion, and criminal records. We do not collect such data. |
2. Data Controller Identity
| Item | Details |
|---|---|
| Company Name | Datability Limited (current); to be changed to CyteEditor Limited upon corporate restructuring |
| Place of Registration | Hong Kong Special Administrative Region |
| Registered Address | Flat 2401-16, Wing Shing Industrial Building, 26 Ng Fong St, San Po Kong, Hong Kong |
| Contact Email | legal@cyteeditor.com (dedicated to data protection matters) |
| Support Email | support@cyteeditor.com |
| Legal Email | legal@cyteeditor.com |
| Data Protection Representative | Currently served by a company director; an independent EU representative will be appointed under GDPR Art. 27 when EU monthly active users exceed 5,000 |
| EU Representative (pending) | To be appointed upon reaching the EU customer threshold |
| UK Representative (pending) | To be appointed upon reaching the UK customer threshold |
Entity Transition Notice: Pursuant to Article 7 of the EULA (Assignment Right), our company may, upon no less than 90 days' written notice, assign the data controller rights and obligations under this Policy to an Affiliate or Successor Entity (such as CyteEditor Limited). Such assignment shall not alter the purposes, scope, or your rights regarding data processing.
3. Data Types Collected
We collect different types of data in different scenarios. All collection follows the principle of data minimization.
3.1 Account and Billing Data (collected at purchase)
| Data Item | Source | Purpose | Legal Basis (GDPR Art. 6) |
|---|---|---|---|
| Email address | Stripe Checkout form | Send License Key, invoices, renewal reminders | (b) Contract performance |
| Billing address | Stripe Checkout form | Issue compliant invoices (including country / city / postal code) | (c) Legal obligation (tax law) |
| Company name (B2B, optional) | Stripe Checkout form | Invoice header | (b) Contract performance |
| VAT/GST tax number (B2B, optional) | Stripe Checkout form | Reverse charge record retention | (c) Legal obligation |
| Stripe customer ID | Stripe API | Link subscription / refund / License | (b) Contract performance |
| Last 4 digits of payment method / card brand | Stripe (display only; we do not store full card numbers) | Customer service payment verification | (b) Contract performance |
We do not directly handle full credit card numbers, CVC codes, passwords, or other PCI data — all payment input is completed on Stripe's hosted page; we receive only desensitized metadata from Stripe.
3.2 License Verification Data (collected when the editor SDK makes a call)
When you (or your end users) trigger a License Key verification in an application loaded with the CyteEditor SDK, the SDK sends a request to api.cyteeditor.com/license/verify, and we record the following at the receiving end:
| Data Item | Purpose | Legal Basis | Retention |
|---|---|---|---|
| License Key (JWT) | Verify signature and status | (b) Contract performance | Not persisted (log only, 30 days) |
| Request origin domain | Anti-piracy (initial domain binding + subsequent matching) | (f) Legitimate interest (preventing unauthorized use) | License lifecycle |
| Request IP address | Rate limiting / anomaly detection / audit | (f) Legitimate interest (abuse prevention) | Aggregated and anonymized after 30 days |
| User-Agent | Debugging / compatibility statistics | (f) Legitimate interest | 30 days |
| Request timestamp | Audit / abuse detection | (f) Legitimate interest | 30 days |
Key Statement: We do not collect the actual content of the rich text editor in your application (user-entered document text / images / media). This content always remains in your application / on your servers and is never transmitted to our servers.
3.2.1 Client SDK Local Cache (IndexedDB / 24h TTL)
To reduce network round-trips and ensure offline availability, the @cyte-editor/license client SDK writes the following strictly necessary local data in your browser or host application:
| Storage Location | Data Item | Purpose | Retention | Transmitted to Us? |
|---|---|---|---|---|
IndexedDB (database cyte-editor-license) | Last verification result (payload / status / lastVerifyAt) | Offline fast verification at startup, avoiding network requests each time | 24-hour TTL, automatic expiration | No |
| IndexedDB | Monotonic timestamp (maxObservedTime) | Detect system clock rollback attempts, preventing expired License Key reuse | Same as License lifecycle | No |
| IndexedDB (strict mode only) | Last successful online verification timestamp (lastOnlineSuccessAt) | Supports offlineGraceDays (default 14 days) for offline grace period determination | Same as License lifecycle | No |
Boundary with §3.2 Data Collection:
- The above IndexedDB entries exist only in your browser / your application locally and are never transmitted to our servers;
- When the SDK is configured with
online: false(fully offline mode), we collect zero data; - When the SDK is configured with
online: 'lazy'or'strict', it only sends requests toapi.cyteeditor.com/license/verify, transmitting only the 5 items listed in the §3.2 table; - When IndexedDB is unavailable (browser private mode or disabled), the SDK automatically degrades to
sessionStorage, then to in-memory cache, without affecting our data collection scope.
Data Subject Rights: Pursuant to GDPR Art. 15 / Art. 17, you may at any time view or delete the above local data through your browser's developer tools (Application → IndexedDB panel); deletion does not affect the validity of the License Key itself but will trigger re-verification on the next launch.
3.3 Website Visit Data (collected when browsing the homepage)
We use Plausible Analytics (or self-hosted Umami), characterized by:
- No cookies written;
- No IP address collection (only briefly used for session identification, immediately hashed and discarded);
- No cross-site tracking;
- Only aggregated statistics on page views, source country (coarse-grained), and device type.
| Data Item | Personal Data? | Purpose | Legal Basis |
|---|---|---|---|
| Page URL (excluding query string) | No (aggregated) | Traffic analysis | (f) Legitimate interest |
| Referer (source) | No | Marketing channel analysis | (f) Legitimate interest |
| Browser type | No | Compatibility optimization | (f) Legitimate interest |
| Country (coarse-grained) | No | Regional market analysis | (f) Legitimate interest |
| Screen size (range) | No | Responsive design optimization | (f) Legitimate interest |
We do not use Google Analytics, Facebook Pixel, TikTok Pixel, LinkedIn Insight, Hotjar, Clarity, or other cookie-based tracking tools. If introduced in the future, we will update this Policy and trigger the Cookie banner to re-solicit consent.
3.4 Customer Service and Sales Communication Data
When you communicate with us via email / ticket / form, we collect:
| Data Item | Purpose | Legal Basis | Retention |
|---|---|---|---|
| Your voluntarily provided name, email, content | Respond to your request | (b) Contract performance / (f) Legitimate interest | 5 years (per Hong Kong telecommunications law and statute of limitations) |
| Email IP / email headers | Anti-spam / security audit | (f) Legitimate interest | 90 days |
4. Summary of Purposes and Legal Bases
Per GDPR Art. 6(1), the 6 legal bases under which we process personal data:
| Processing Purpose | Legal Basis | Data Category (see Chapter 3) |
|---|---|---|
| Fulfilling contractual obligation to deliver License Key and invoices | (b) Contract performance | 3.1 Account & Billing |
| License verification, renewal, revocation | (b) Contract performance | 3.1 + 3.2 |
| Retaining records for tax / AML / business registration laws | (c) Legal obligation | 3.1 |
| Preventing unauthorized use, piracy, abuse; network and information security | (f) Legitimate interest | 3.2 |
| Improving product quality, traffic analysis, market decisions | (f) Legitimate interest | 3.3 |
| Responding to customer service / sales inquiries | (b) Contract performance / (f) Legitimate interest | 3.4 |
| Cookie banner not placing non-essential cookies prior to consent | (a) Consent | 9.1 |
We do not process data under "(d) vital interests of the data subject" or "(e) public interest tasks."
5. Data Sharing and Processors
We do not sell or rent your personal data. We share data only under the following three circumstances:
5.1 Commissioned Processors (Subprocessors)
To provide our services, we must work with the following subprocessors (see Appendix A for details):
| Subprocessor | Purpose | Data Category | Data Residency |
|---|---|---|---|
| Stripe Inc. | Payment processing, subscription management, invoice generation | 3.1 Account & Billing data | US (GDPR SCC + Stripe DPA) |
| Cloudflare, Inc. | Website hosting, CDN, Worker compute, D1 database, KV cache | 3.2 + 3.3 | Global (Cloudflare DPA + SCC) |
| Resend Inc. | Transactional email sending | Email address + email body | US (Resend DPA) |
| Sentry, Inc. | Error monitoring (automatic PII redaction) | Error stacks (non-personal data) | US (Sentry DPA) |
| Plausible / Umami | Website visit statistics (no cookies / no IP) | 3.3 aggregated data | EU (Plausible self-hosted) / self-hosted on Cloudflare D1 |
We have signed or will sign a DPA (Data Processing Agreement) with each Subprocessor, using SCC (Standard Contractual Clauses, 2021/914) as the legal basis for cross-border transfers.
5.2 Legal Compliance Sharing
Only under the following circumstances may we disclose personal data without your prior consent:
- A lawful written request from a court, regulatory authority, or tax authority with jurisdiction;
- Fulfilling criminal, anti-money laundering, or anti-terrorism financing legal obligations;
- Protecting our legitimate rights, property, or personal safety (e.g., cooperating with DDoS attack investigations or IP infringement litigation).
We will notify you in advance to the extent permitted by law.
5.3 Business Transfer
Pursuant to Article 7 of the EULA (Assignment Right), our company may transfer the business along with your personal data to an Affiliate or Successor Entity upon 90 days' written notice. The transferee shall be equally bound by this Policy.
6. Cross-Border Data Transfer
As our infrastructure is globally distributed (Stripe US, Cloudflare global, Resend US), your personal data may be transferred to the EU, US, or other jurisdictions. We take the following measures to ensure legality:
| Cross-Border Path | Legal Basis |
|---|---|
| HK → EU | (1) No Adequacy Decision between HK and EU; (2) SCC executed with each Subprocessor (2021/914 Module 4: processor-to-processor) |
| HK → US | SCC + each party's DPF (Data Privacy Framework) participation with Stripe / Resend / Cloudflare / Sentry |
| HK → Other | Case-by-case assessment + SCC fallback |
| EU resident data → HK | SCC Module 1 (controller-to-controller) + supplementary measures where necessary |
If you reside in the EU/UK and wish to obtain copies of the SCCs we have executed with our Subprocessors (with sensitive commercial terms redacted), please email legal@cyteeditor.com.
7. Data Retention Periods
| Data Category | Retention | Basis |
|---|---|---|
| Stripe account and billing records | 7 years (from transaction date) | Hong Kong tax law / dispute resolution |
| License JWT + database license records | License lifecycle + 5 years after revocation | Anti-piracy audit + customer dispute resolution |
| License verify call logs (IP / UA / timestamp) | Aggregated and anonymized after 30 days; original records deleted | Legitimate interest + minimization |
| Customer service email communications | 5 years | Statute of limitations and dispute resolution |
| Website visit statistics (aggregated) | Permanent (no longer personal data) | Legitimate interest |
| Cookie consent records | 13 months (re-consent cycle) | GDPR / ePrivacy practice |
| Error monitoring stacks (Sentry) | 90 days | Legitimate interest |
Upon expiration, we will securely delete or irreversibly anonymize the corresponding data. Data in backup media will be deleted within the next backup rotation cycle (maximum 14 days).
8. Your Rights
The following table summarizes the data subject rights we recognize across different jurisdictions:
| Right | GDPR (EU/UK) | PDPO (HK) | CCPA (CA) | PIPL (CN) |
|---|---|---|---|---|
| Right to be informed | ✅ Art.13/14 | ✅ DPP1 | ✅ §1798.100 | ✅ Art.17 |
| Right of access | ✅ Art.15 | ✅ DPP6 | ✅ §1798.110 | ✅ Art.45 |
| Right to rectification | ✅ Art.16 | ✅ DPP6 | ✅ §1798.106 | ✅ Art.46 |
| Right to erasure / forgotten | ✅ Art.17 | ⚠️ Limited | ✅ §1798.105 | ✅ Art.47 |
| Right to restriction | ✅ Art.18 | ❌ | ❌ | ✅ Art.44 |
| Right to data portability | ✅ Art.20 | ❌ | ❌ | ✅ Art.45 |
| Right to object | ✅ Art.21 | ❌ | ❌ (Opt-out for sale) | ✅ Art.44 |
| Right against automated decisions | ✅ Art.22 | ❌ | ⚠️ Limited | ✅ Art.24 |
| Right to withdraw consent | ✅ Art.7 | ✅ | ❌ | ✅ Art.15 |
| Right against discrimination (post-exercise) | ✅ Art.21 | ✅ | ✅ §1798.125 | ✅ Art.50 |
8.1 How to Exercise Your Rights
Send an email to legal@cyteeditor.com and provide:
- Your identity verification (order email + Stripe customer ID or last 8 digits of License Key);
- The specific right you wish to exercise and the scope of data involved;
- Your preferred response method (email / postal address).
We commit to:
- Completing processing within 30 calendar days (GDPR Art. 12 standard);
- If an extension of up to 60 days is needed, we will inform you of the reason within the first 30 days;
- First exercise is free; from the second exercise of the same right in the same calendar year, a reasonable cost fee of USD 30 may be charged (only if the request is deemed "manifestly unfounded or excessive").
8.2 Right to Complain
If you are not satisfied with our response, you have the right to file a complaint directly with your local supervisory authority:
| Jurisdiction | Supervisory Authority | Contact |
|---|---|---|
| Hong Kong | Office of the Privacy Commissioner for Personal Data (PCPD) | https://www.pcpd.org.hk |
| EU Member States | Each member state's DPA | https://edpb.europa.eu/about-edpb/board/members_en |
| UK | Information Commissioner's Office (ICO) | https://ico.org.uk |
| US-California | California Privacy Protection Agency | https://cppa.ca.gov |
| China | Cyberspace Administration of China / local public security cyber department | 12377 / 12321 |
9. Cookies and Similar Technologies (Cookie Notice)
9.1 Cookie Categories
| Category | Consent Required? | Currently Used? |
|---|---|---|
| Strictly Necessary Cookies | ❌ On by default | ✅ Used (see 9.2) |
| Functional Cookies | ✅ Consent required | ❌ Not used |
| Analytics Cookies | ✅ Consent required | ❌ Not used (using cookie-free Plausible / Umami) |
| Marketing Cookies | ✅ Consent required | ❌ Not used |
9.2 Complete List of Currently Used Cookies
We use only 4 strictly necessary cookies, with no analytics or marketing cookies (see Appendix B for technical details):
| Cookie Name | Purpose | TTL | Type |
|---|---|---|---|
__stripe_mid | Stripe fraud prevention (Checkout page) | 1 year | Strictly necessary (governed by Stripe DPA) |
__stripe_sid | Stripe session identification | 30 minutes | Strictly necessary |
cyte_consent | Records your Cookie banner choice, preventing repeated display | 13 months | Strictly necessary |
i18n_redirected | Records your selected website language, avoiding re-routing each visit | 1 year | Strictly necessary |
9.3 Impact of Refusing Cookies
Since the above cookies are all strictly necessary, fully disabling cookies in your browser will affect:
- ❌ You will not be able to complete Stripe Checkout payment (Stripe fraud prevention required);
- ❌ You will need to re-select the language each visit;
- ❌ The Cookie banner will reappear each visit.
Strictly necessary cookies do not require your prior consent — this is an explicit statutory exemption under GDPR Recital 30 and ePrivacy Directive Art. 5(3), second subparagraph.
9.4 Cookie Banner Behavior
On your first visit to this website, you will see a bottom banner indicating that this site uses strictly necessary cookies. After clicking "Got it" to dismiss the banner, the cyte_consent cookie records your dismissal action, and the banner will not reappear for 13 months.
We currently do not display "Accept / Reject Analytics Cookies" complex options, because we do not use any non-essential cookies. If we introduce analytics or marketing cookies in the future, we will:
- Update this Policy 30 days in advance;
- Force-reset all users'
cyte_consentcookie, triggering the banner to reappear; - Provide granular options (Accept all / Necessary only / Custom).
The legal authorization text for the Cookie banner is set forth in Appendix C.
10. Security Measures
We take the following technical and organizational measures to protect your data security:
| Category | Measure |
|---|---|
| Transport encryption | Site-wide TLS 1.3 + HSTS (max-age=31536000) + HTTP/3 |
| Storage encryption | Cloudflare D1 encryption at rest (AES-256) + Workers Secrets isolation |
| Key management | License JWT private key stored only in Workers Secrets, never in the repository / never leaves the Worker boundary |
| Access control | Admin endpoint ADMIN_TOKEN + optional TOTP two-factor authentication + rate limiting |
| Backup & recovery | D1 daily automatic snapshots + weekly encrypted export to Cloudflare R2 (retained 12 weeks) |
| Network security | Cloudflare WAF + DDoS protection (automatic) + Bot Fight Mode |
| Intrusion monitoring | Sentry error aggregation + critical alert email trigger within seconds |
| Input validation | All API endpoints use Zod strict schema validation |
| Least privilege | Workers have only necessary D1/KV/Email permissions; no write permissions beyond Stripe Refund |
| Personnel management | Currently only the founder; keys rotated periodically; all credentials stored in 1Password team vault |
10.1 Data Breach Notification
In the event of a "personal data breach" (as defined in GDPR Art. 4(12) / PDPO practical guidance), we commit to:
- Reporting to the supervisory authority of the affected EU/UK data subjects' location within 72 hours (GDPR Art. 33);
- If the breach is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay (GDPR Art. 34);
- The notification will include: the nature of the breach, likely consequences, measures taken or to be taken, and contact person.
11. Children's Data
CyteEditor does not provide services to children under 16. We do not knowingly collect personal data from children under 16.
If we discover that we have collected data from a child under 16, we will delete it within a reasonable time. If you are a parent / guardian and discover that your child has provided data to us, please email legal@cyteeditor.com, and we will delete it within 7 days.
Note: After the CyteEditor SDK is loaded into your own application, the age composition of your end users is assessed and complied with by you as the data controller — see Article 4 of the EULA.
12. Policy Change Notification
| Change Type | Notification Method | Effective Date |
|---|---|---|
| Material Change (e.g., new Subprocessor / new data category / new non-essential Cookie / data controller entity change) | ① Top banner notice 30 days in advance; ② Email notification to all active customers; ③ Cookie banner reset | 30 days after notification |
| Non-Material Change (e.g., term clarification, typo correction, Subprocessor business address change in Appendix A) | "Last updated" label at the top of the homepage /legal/privacy page | Immediately |
All historical versions of this Policy are permanently accessible at: https://cyteeditor.com/legal/privacy/history, allowing you to trace the Policy content at any point in time.
13. Complaints and Contact
| Matter | Contact |
|---|---|
| Data subject rights exercise | legal@cyteeditor.com |
| Customer service | support@cyteeditor.com |
| Legal / compliance | legal@cyteeditor.com |
| Postal address | Datability Limited, Flat 2401-16, Wing Shing Industrial Building, 26 Ng Fong St, San Po Kong, Hong Kong |
| Data protection representative (current) | Served by a company director, reachable via legal@cyteeditor.com |
Appendix A — Complete Subprocessor List
This appendix is maintained and periodically updated by us; the latest version is always published at
https://cyteeditor.com/legal/privacy#appendix-a.
| # | Subprocessor | Legal Entity | Place of Registration | Purpose | Data Residency | DPA / SCC Status |
|---|---|---|---|---|---|---|
| 1 | Stripe | Stripe, Inc. | US-Delaware | Payment processing + subscription management + invoicing | US (with EU backup) | ✅ DPA + SCC + DPF certified |
| 2 | Cloudflare | Cloudflare, Inc. | US-Delaware | Website hosting + CDN + Worker + D1 + KV + R2 | Global (Workers edge) | ✅ DPA + SCC |
| 3 | Resend | Resend Inc. | US-Delaware | Transactional email sending | US | ✅ DPA + SCC |
| 4 | Sentry | Functional Software, Inc. | US-California | Error monitoring | US (after redaction) | ✅ DPA + SCC |
| 5 | Plausible or Umami (self-hosted) | Plausible Insights OÜ (Estonia) / self-hosted | EU / Cloudflare | Website visit statistics (no cookies / no IP) | EU / Cloudflare | ✅ Plausible EU-based, no SCC required |
When adding a new Subprocessor, we will notify active customers 30 days in advance per the procedure in Chapter 12; you have a 14-day objection window; if you object, we may choose not to introduce the Subprocessor or terminate the contract (with refund handled per EULA terms).
Appendix B — Complete Cookie Technical List
| Cookie Name | Source | Domain | Path | Type | TTL | HttpOnly | Secure | SameSite | Purpose |
|---|---|---|---|---|---|---|---|---|---|
__stripe_mid | Stripe Checkout | .stripe.com | / | 1st-party (Stripe domain) | 1 year | ❌ | ✅ | None | Stripe fraud prevention machine fingerprint |
__stripe_sid | Stripe Checkout | .stripe.com | / | 1st-party (Stripe domain) | 30 min | ❌ | ✅ | None | Stripe session identification |
cyte_consent | Our company | .cyteeditor.com | / | 1st-party | 13 months | ❌ | ✅ | Lax | Records Cookie banner dismissal status |
i18n_redirected | Our company (@nuxtjs/i18n) | .cyteeditor.com | / | 1st-party | 1 year | ❌ | ✅ | Lax | Records user language selection |
Our servers never write
__stripe_*cookies to your browser — they are written by Stripe Checkout on its hosted pagecheckout.stripe.com, forming a compliance loop with our servers atcyteeditor.comthrough SCC + Stripe DPA.
Appendix C — Cookie Banner Legal Authorization Text
This appendix contains only the legal authorization text for the banner, not the Vue component implementation. For the technical implementation of the banner, see the Website Implementation Spec.
C.1 Banner Main Text
We use only strictly necessary cookies to make this site work — no analytics, no advertising, no tracking. See our Cookie Notice for the complete list.
Got it
C.2 Close Button aria-label
Close cookie notice and accept strictly necessary cookies
C.3 Banner Trigger and Re-display Rules
- First visit: Display
- User clicks "Got it": Write
cyte_consent=v1cookie (TTL 13 months) - Same browser revisits cyteeditor.com: Do not display
- After 13 months: Cookie naturally expires, banner re-displays
- We proactively adjust Cookie policy: Reset
cyte_consenttov2, banner re-displays - User clears browser cookies: Banner re-displays
C.4 Entry Paths and Accessibility
- The footer permanently displays "Privacy Policy" / "Cookie Notice" links
- The bottom-right footer permanently displays "Cookie Settings" (currently clicking only displays the current Cookie list, with no "reject" option; if non-essential Cookies are introduced in the future, a full Settings UI will be enabled)
- After dismissing the banner, you can review the Cookie list at any time via the footer "Cookie Settings" link