Privacy Policy

Last updated: 26 September 2026

This Privacy Policy explains how IB Enterprises Oy ("we", "us") handles personal data in connection with the Pelaa website (pelaa.tv) and the Pelaa macOS application.

1. Data controller

IB Enterprises Oy
Y-tunnus (business ID): 3365722-8
Likolammintie 15, 49860 Klamila, Finland
Email: [email protected]

2. Data we collect

• Waitlist email (closed). Before launch the site had a waitlist form. If you submitted your email through it, we hold the address and the timestamp so we can tell you Pelaa is available. The form is gone; nothing new is collected this way.
• Customer information. When you purchase Pelaa, Lemon Squeezy (lemonsqueezy.com) collects the data needed to complete the transaction (name, email, billing details, country, tax info). We receive a record of your purchase, license key, and email. Lemon Squeezy acts as Merchant of Record for the sale. Our trial service on Cloudflare keeps a copy of the purchase record (email, order number, plan, amount, subscription status and renewal date), refreshed daily from Lemon Squeezy, so that a paying customer is never sent an email asking them to buy.
• Support correspondence. If you email us, we keep the messages so we can help you and improve the product.
• Free-trial registration. When you start the 14-day free trial, the app sends the email address you enter, the name you would like to be called (optional, used only to address you in trial emails), a device identifier, and your macOS version to our trial service so we can track active trials, offer one trial per person and per device, and contact you about your trial (for example, before it ends). The device identifier is derived from your Mac's hardware and one-way hashed on your device before it is sent, so the hardware serial itself never leaves your Mac, and, unlike data the app stores, it persists across reinstalls of the app and macOS. The same hashed identifier is sent when you later activate a license (see below), which is how we recognise that a trial started on one address and a purchase made on another are the same Mac. No payment information is collected. The trial record is kept in the macOS Keychain on your device and on our server; you can ask us to delete the server-side record at any time via [email protected]. When a trial starts, we are notified by email with the same details plus the country the request came from, taken from Cloudflare's network data. City-level location is not used or kept.
• License activation and validation. When you activate Pelaa with a license key, the app sends the key, your Mac's hostname (e.g. "Ivan's MacBook Pro"), and part of the same hashed device identifier described above to Lemon Squeezy. This ties the license to your Mac, enforces the per-device activation limit, and lets us tell that a trial and a purchase made from two different email addresses came from one Mac, so that once you have paid we stop sending you trial emails that ask you to buy. It is a prefix of the hash, not your hardware serial, and it cannot be turned back into anything about your Mac. Pelaa 1.0.20 and earlier sent a randomly generated identifier here instead. On every launch the app sends the key and the activation id that Lemon Squeezy issued, not a device identifier, to confirm the license is still valid; if the request fails (for example, no internet), Pelaa continues to work offline for up to seven days using the most recent validation result. You can release the Mac at any time from Pelaa → License → Deactivate This Mac, which also removes the identifier from the activation record at Lemon Squeezy.
• Crash and hang diagnostics. So bugs can be found and fixed quickly, Pelaa sends anonymous diagnostic reports through Sentry when the app crashes or freezes. These reports include device model, macOS version, app version, the type of exception, the stack trace where the crash occurred, and recent application events ("breadcrumbs"). They do not include your project files, video content, account name, or email. File-path strings from your computer may appear inside a stack frame if a crash happens while Pelaa is reading a file. Diagnostics are on by default; you can disable them at any time in Pelaa → Settings → Privacy → Crash diagnostics.
• Update checks. Pelaa periodically requests pelaa.tv/appcast.xml to see whether a new version is available. The request is a standard HTTP fetch and does not include any account information, license key, or device identifier.

We do not use tracking cookies or advertising trackers on this website. We do use cookieless, privacy-preserving analytics, and Cloudflare may set a security cookie of its own; see section 10.

3. Why we use your data

• To deliver the Pelaa software and license to you.
• To respond to support requests.
• To notify you about Pelaa availability if you joined the waitlist.
• To run your free trial and contact you about it, including help getting started and a reminder before the trial ends.
• To activate, validate, and enforce the license you purchased.
• To improve product reliability through anonymous crash and hang diagnostics.
• To comply with our legal obligations (accounting, tax, consumer protection).

4. Legal bases (GDPR Article 6)

• Consent — for the waitlist signup.
• Contract — to provide Pelaa to customers who have purchased it, including license activation and validation, and to take steps at your request before any contract is entered into, which is what your free trial is. This covers running the trial and contacting you about it.
• Legal obligation — to keep records required by Finnish and EU law.
• Electronic direct marketing — when we email you about continuing with Pelaa at the end of your free trial, we rely on section 200 of the Finnish Act on Electronic Communications Services (917/2014), which implements Article 13(2) of the ePrivacy Directive. It covers marketing our own similar products to people who obtained Pelaa from us. You can opt out when you start the trial and from a link in every such email, free of charge, and we will stop.
• Legitimate interest — to operate and secure the website and the app, to enforce the license you accepted at purchase, and to maintain product quality through anonymous crash and hang diagnostics. You can object to the diagnostics processing at any time by turning it off in the app's Privacy settings.

5. Processors and recipients

• Lemon Squeezy (lemonsqueezy.com) — Merchant of Record. Payment processing, billing, tax invoicing, license activation and validation, refund processing.
• Cloudflare — website hosting, the free-trial and (closed) waitlist endpoints, the storage behind them, DNS, bot protection, cookieless web analytics (see section 10), and email routing: mail sent to [email protected] passes through Cloudflare on its way to our mailbox.
• Sentry — anonymous crash and hang diagnostics. On by default; can be disabled in the app's Privacy settings.
• Resend (resend.com) — sends the trial verification-code and trial-related emails on our behalf; receives your email address for that purpose. Resend relays mail through Amazon Web Services (SES) in the EU.
• Google — our operational mailbox runs on Gmail. Support mail, replies to trial emails, the notification we receive when a trial starts, and a daily internal summary of active trials and purchases are received and stored there. Waitlist signups were also copied to a Google Sheet. Separately, the tutorial videos on pelaa.tv/tutorials are hosted on YouTube and play in a window on that page; see section 10 for what that means and when it happens.
• Telegram — short operational alerts to the operator's phone: that a trial started or lapsed (with the email address), and that a message to [email protected] could not be delivered (sender and subject). Nothing else about you is sent there.

We do not sell or rent personal data to anyone.

6. Retention

• Waitlist emails are kept until you ask us to delete them, or until 24 months after launch (June 2026) if we have not contacted you successfully.
• Trial registrations (email, device identifier, trial dates) are kept for up to 24 months after the trial ends, or until you ask us to delete them. A daily job deletes records that have passed that point. Your opt-out from trial emails is kept longer, so that a later trial from the same address is not emailed again.
• The copy of your purchase record in our trial service is refreshed daily from Lemon Squeezy and is deleted on request.
• The device identifier in your activation record at Lemon Squeezy is kept for as long as the activation is live. Deactivating the Mac in the app removes it; asking us to delete your trial record removes the copy we hold.
• Customer records (invoicing data) are kept for as long as Finnish accounting law requires (currently 6 years from the end of the financial year).
• Support emails are kept for up to 24 months unless ongoing support requires longer retention.
• Crash and hang diagnostics are retained by Sentry in line with their published retention policy and then automatically deleted.
• Cloudflare Web Analytics aggregates are retained in line with Cloudflare's published retention policy. No data on this service identifies you personally.

7. International transfers

Some of our processors operate outside the EEA:

• Lemon Squeezy — operated by a US-based company; payment infrastructure routes through US payment networks.
• Cloudflare — US-based, with global edge infrastructure.
• Sentry — US-based.
• Resend — US-based; the mail itself is relayed from an EU region.
• Google — US-based.
• Telegram — operated from outside the EEA.

Where personal data is transferred outside the EEA, the transfer is covered by Standard Contractual Clauses or an equivalent safeguard recognised under GDPR Article 44–46.

8. Your rights

Under GDPR you have the right to:

• Access the personal data we hold about you.
• Request correction or deletion.
• Restrict or object to certain processing.
• Receive your data in a portable format.
• Withdraw consent at any time (for example, to leave the waitlist), and opt out of trial emails at any time using the link in any of them or by emailing us.
• Lodge a complaint with the Finnish Data Protection Ombudsman (Tietosuojavaltuutettu, tietosuoja.fi).

To exercise any of these rights, contact us by email or post:

IB Enterprises Oy
Likolammintie 15, 49860 Klamila, Finland
[email protected]

Please include the email address associated with your purchase or your order number so we can locate the relevant records.

9. Security

We use HTTPS for the website (with HSTS and TLS 1.2 or newer), restrict access to systems containing personal data, and rely on reputable processors with their own security programs. No system is perfectly secure; in the event of a personal data breach we will notify the supervisory authority and affected users in line with GDPR Article 33–34.

10. Cookies, storage, and analytics

The Pelaa website sets no cookies of its own, does not use advertising trackers, and does not write to your browser's local storage or session storage. Cloudflare, which serves the site and protects it from automated abuse, may set a security cookie (such as cf_clearance or __cf_bm) when it checks that a request comes from a real browser. That cookie is strictly necessary to serve the site, identifies nothing about you to us, and is not used for tracking.

We use Cloudflare Web Analytics to understand how the site is used (anonymised page views, country, browser family, device type, page load time). This service is cookieless and stores no data on your device. It does not collect personal information, does not fingerprint visitors, and does not enable cross-site tracking. The beacon sends only anonymised, aggregated metrics to Cloudflare. These analytics serve our legitimate interest in operating and improving the website; no consent banner is shown because no consent is required under GDPR or the EU ePrivacy Directive for cookieless, non-identifying analytics. Details of what Cloudflare Web Analytics collects (and what it does not) are available in Cloudflare's documentation.

The checkout is provided by Lemon Squeezy inside an overlay on this site; what it stores is covered by Lemon Squeezy's privacy policy.

The tutorial videos on pelaa.tv/tutorials are hosted on YouTube and play in a window on that page. Nothing is requested from Google until you click a video: the page ships no YouTube script, and until that click the player does not exist. When you do click, the video loads from youtube-nocookie.com, Google's privacy-enhanced domain, and what it then stores on your device is covered by Google's privacy policy. If you would rather not load it at all, every video on that page is also a plain link you can open on YouTube directly, or skip.

11. Changes to this policy

We may update this policy from time to time. The "last updated" date at the top of this page reflects the most recent revision. Material changes will be communicated by email to active customers.

This document is provided for transparency. It is not legal advice. If you operate a business and are reading this for compliance reasons, consult your own lawyer.