Privacy Policy

Last updated: October 23, 2026 · Animotion Conteúdo Criativo LTDA, Brazil

1. Who we are (controller)

Animotion Conteúdo Criativo LTDA, a company established in Brazil, registered under CNPJ 41.663.648/0001-25, operates under the Animotion Labs brand and is the controller of the personal data described here. Data subject and data protection contact: privacy@animotionlabs.com.

2. The apps (Starsweep and Stardrop)

Starsweep and Stardrop run on your Mac. We do not collect file names, file contents, download history, usage analytics or telemetry. Stardrop does not send downloaded links or videos to our servers. Activation and validation of licenses require only the limited communication described below.

3. Data we process and why

We process only the data needed for the purposes below. Under the GDPR, the corresponding grounds are performance of a contract (Article 6(1)(b)), legal obligations (Article 6(1)(c)) and legitimate interests (Article 6(1)(f)).

Data	Purpose	Legal basis — LGPD Article 7
Purchase: email, product, amount, payment status and country, provided by Stripe	Deliver the license; provide support and refunds	Performance of a contract — Article 7(V)
Sales and tax invoice records	Comply with legal and tax duties	Legal obligation — Article 7(II)
License key, anonymous SHA-256 hash of the Mac identifier, device name, app version and macOS version	Validate the license and the limit of 3 Macs. The hash is a pseudonymous identifier and may constitute personal data when linked to a license.	Performance of a contract — Article 7(V)
IP address in requests to the site and license API	Security and abuse prevention, including attempt limits, balanced against your rights	Legitimate interests — Article 7(IX)
License recovery: email address provided	Resend license keys	Performance of a contract — Article 7(V)
Anonymous visit measurement: pages, product viewed, approximate country, device type, language, referring domain, campaign parameters (UTM) and an anonymous daily session identifier — no cookies and no IP address	Understand site usage in aggregate	Legitimate interests — Article 7(IX)

4. Payment data

Payment card data is processed by Stripe. We never receive or store your card number or card security code. We receive only the purchase and payment information needed to manage your license, support and refunds.

5. Sharing with processors

We use Stripe for payments, Resend for email delivery, and Lovable Cloud for hosting and database services. These providers process data needed to provide their services, in accordance with their applicable terms and privacy policies. We do not sell personal data or share it for advertising. Data may also be disclosed when required by law.

6. International transfers

Our providers may store or process data outside Brazil, including in the United States. International transfers must comply with Article 33 of the LGPD and applicable safeguards, such as approved contractual clauses. Where the GDPR applies, transfers are subject to its Chapter V requirements, including an applicable adequacy decision or appropriate safeguards. You may contact us for information about the safeguards applicable to your data.

7. Retention

License data is retained while the license exists; sales and tax records for 5 years; and IP security logs for up to 30 days. After these periods, data is deleted or anonymized, subject to mandatory legal retention requirements.

8. Data subject rights (Article 18)

You may request confirmation, access, correction, anonymization, blocking or deletion, portability subject to applicable regulation, information about sharing, withdrawal of consent where used, and objection to processing that does not comply with the law. Deletion is subject to legal retention exceptions. To exercise your rights, email privacy@animotionlabs.com; we respond within 15 days. We may request proportionate verification of identity. You may complain to the ANPD (gov.br/anpd). For EU visitors where the GDPR applies, these rights also include restriction, objection to processing based on legitimate interests, and a complaint to the competent supervisory authority, using the same privacy contact.

9. Cookies and local storage

We store your language preference in your browser as essential local storage. We measure visits anonymously and in aggregate, without cookies and without storing IP addresses, to understand how the site is used (legitimate interests, LGPD Article 7(IX)). Event data is deleted after 13 months. For this measurement, the browser stores only campaign parameters (UTM) and an anonymous daily session identifier in session storage, erased when you close the browser. Hosting security services use the Cloudflare __cf_bm cookie for automated traffic protection. The checkout loads Stripe scripts, which may use cookies and other identifiers for payment security and fraud prevention; the administration area may store an authentication session. Fonts are loaded from Google Fonts, which receives technical connection data such as your IP address. We do not use advertising pixels or third-party analytics scripts. If we introduce optional analytics or advertising technologies, we will request consent before activating them, where required by law.

10. Security

We use HTTPS and restricted database access. License verification and management take place on the server; private signing keys are never sent to the browser or the apps. Customers receive their license keys to activate the apps. These measures reduce risk, but no system is completely secure. When required by law, we will notify the competent authority and affected individuals of relevant personal data incidents.

11. Children

Our products are not directed at anyone under 18. If you believe a child has provided personal data, contact us so we can assess the situation and take appropriate action.

12. Changes to this policy

We may update this policy to reflect changes to our services or legal requirements. The date below identifies the latest revision. Material changes will be communicated appropriately; consent will be requested if legally necessary.

Last updated: October 23, 2026