Privacy Policy
What we collect, why, and how you stay in control of it.
The short version. Visaria runs on your computer and your simulations stay there. We collect only what we need to sell and license the software: your email, your order details from our payment provider, and an identifier for the computer your licence is activated on. We do not sell your data, and we only send marketing emails if you ask for them. You can ask to see or delete your data at any time.
1. Who we are
Richard Gordon, trading as FastStep Labs ("we", "us"), is the controller of the personal data described in this policy. We are located in the United Kingdom. We are registered with the Information Commissioner's Office under registration number ZC281586.
For anything about your personal data, email privacy@visaria.dev or write to FastStep Labs, 124 City Road, London, EC1V 2NX.
This policy covers our website, the free trial, paid licences and the Visaria desktop application. Our payment provider, which sells Visaria on our behalf, is responsible for its own processing of your payment data (see section 4).
2. What we collect and why
| When | What we collect | Why | Lawful basis |
|---|---|---|---|
| You visit our website | IP address, browser and device type, the page requested, referring page, date and time, held in server logs | To deliver and secure the website and fix faults | Legitimate interests (running a secure website) |
| You start a free trial | Email address (we keep only a coded, hashed version after your key has been sent), trial licence key, trial start and end dates, computer ID and operating system (see section 3). Your IP address is checked briefly to stop abuse and is not stored by us. | To issue and manage your trial and prevent repeated trials | Contract (providing the trial you asked for); legitimate interests (preventing repeated trials and abuse) |
| You download Visaria | The date and time (UTC), the platform you chose (for example Windows), and a rough type of device or program that made the request (web browser, automated program or other). If you reach the download from the link in your trial email, that link also contains a reference code. We record it, and it is linked to your trial record. If you download from our website without that link, no reference code is recorded. To avoid counting a double click or refresh twice, we also briefly keep a scrambled one-way code made from your connection address, the platform and the link you used. It cannot be turned back into your address (see section 7). We do not store your IP address, your full browser details, your email address or your licence key in these records, and the download link sets no cookies. | To count downloads, to see which trials go on to a download, and to leave out automated link checks from our figures | Legitimate interests (knowing how many people download Visaria and which trials lead to a download) |
| You buy or renew a licence | Name, email address, country, plan, operating system version bought, order number, price paid, renewal date and status. We receive these from our payment provider. We do not receive your full card details. | To provide your licence, send renewal reminders, handle cancellations and refund requests, and provide support | Contract |
| You buy a gift | As for a purchase, plus the recipient's email address, the delivery date, time and time zone you chose and, if you add them, your name for the email and a short personal message. We get the recipient's email address from you, not from them. These details may pass through our payment provider with the order. | To email the licence key and instructions to the recipient at the time you chose, tell you when it has been delivered, and correct a wrong address | Contract (supplying the gift you bought); legitimate interests (delivering a gift to the person you chose, and supporting them) |
| You activate the Software | Licence key, computer ID, operating system, app version, activation, deactivation and 30-day licence check dates, and the IP address used for activation and checks | To check your licence is valid and used on one computer, and to reset activations when you move computers | Contract; legitimate interests (preventing licence misuse) |
| You apply for a student licence | Institution email address or evidence of study you send us, and the result of our check | To confirm eligibility for the student price | Contract (steps you ask us to take before buying) |
| You contact us | Your name, email address, the content of your message and anything you attach, such as screenshots or scenario files | To answer you and resolve problems | Legitimate interests (responding to enquiries); contract where it relates to your licence |
| You ask for product news | Email address, held by our email provider Brevo, and a record of your consent (the time, the wording you saw and where you gave it) | To send occasional news about Visaria | Consent, given by ticking a separate, optional box on the trial request form. You can withdraw it at any time using the unsubscribe link |
| For our accounts | Order and refund records | To keep the financial records required by law | Legal obligation |
We will still send you essential service emails, such as purchase confirmations, gift delivery confirmations, renewal reminders and security notices, even if you have not asked for marketing.
If you are given a Visaria gift. The buyer gave us your email address so that we could send you your gift. We use it only to email your licence key and instructions, and for service messages about the licence, such as a resend or a problem with it. We do not use it for marketing unless you separately opt in, and we share it only with the providers in section 5. We keep it as set out in section 7. The buyer's personal message, if there is one, appears only in your gift email. You have the rights in section 10: email privacy@visaria.dev.
3. What the Visaria app does with data
Visaria runs entirely on your computer. Your simulations, scenario files, images and videos are created and stored locally and are not sent to us.
Computer ID. To tie a licence to one computer, the Software collects characteristics of your machine and creates a computer ID by applying a salt and a one-way hash to them. The computer ID is sent to our own licensing service on a FastStep Labs secure server in the UK, via Cloudflare. There it is matched with your email address and licence key, which we receive from our merchant of record, Paddle (or, for a free trial, from our own trial service), so that we can check the licence is used on one computer. Because the computer ID is a salted one-way hash, the original hardware characteristics cannot be recovered from it. It is used only for licensing and is not used for advertising or tracking.
Licence checks. The Software contacts our licensing service when you activate or deactivate a licence. The Software activates online once and then works fully offline for the next 30 days. It then rechecks the licence every 30 days automatically. If it is not connected to the internet at that point, you will have 5 days to connect for the licence to refresh. If that is still not achieved, the solvers will be suspended until the next internet connection. Only the licence key, computer ID, operating system and app version are sent. A licence file is stored on your computer so the Software can run offline for 30 days. These checks are strictly necessary to provide the software you have licensed within these terms.
The Software does not collect usage analytics or crash reports.
4. Our payment provider
We sell Visaria through our primary payment processor and online reseller, Paddle.com Market Limited ("Paddle"). Paddle is the Merchant of Record for all our orders and acts as an independent data controller for the personal data it processes to take payment, calculate and collect tax, issue invoices, detect fraud, fulfil orders, handle customer service enquiries, refunds and returns, and deliver licence keys.
When you start a purchase, the order information needed to complete it is sent to Paddle: your name, email address, IP address, billing address and country. Your card and other payment details are entered into Paddle's secure checkout (its SDK/checkout modal) and submitted directly to Paddle. They are not stored on our servers, and we never see or store your full card details.
Paddle sends us the order and licence details listed in section 2, such as your order number, plan, price paid and renewal date, so that we can provide your licence and support you.
Legal basis. Sharing order information with Paddle is necessary to perform the contract to supply your licence, and it serves our legitimate interests in fulfilling and administering orders. Our tax and accounting records are kept to meet our legal obligations. Paddle's privacy policy, Paddle.com Market Limited's privacy policy, explains how Paddle handles your buyer data.
5. Who else sees your data
We do not sell your personal data or share it for other companies' marketing. We share it only with:
- Service providers who process it on our instructions: our website host Cloudflare (which also provides the Turnstile check that confirms trial requests come from a person), and our email providers Brevo (which sends our licence and trial emails and holds our optional mailing list) and Google. We also use FormSubmit (formsubmit.co), which receives the name, email address and message you enter in the website's "Get in Touch" form and forwards them to our inbox. They are bound by contracts or terms that require them to keep it secure and use it only to provide their service to us.
- GitHub (a Microsoft company), which delivers the Visaria installer. When you click Download, our website passes you on to GitHub, which receives your request, including your IP address and browser details, and handles it under its own privacy terms.
- Paddle.com Market Limited, our reseller and Merchant of Record, as described in section 4.
- Our professional advisers, such as our accountant, where needed.
- Authorities such as HMRC, the police or a court, where the law requires it.
- A buyer of our business, if Visaria is sold, who would have to respect this policy.
6. International transfers
Some of our providers, including our payment provider, process data in the United States, as well as in the United Kingdom. Where that happens, we make sure appropriate safeguards are in place, such as UK adequacy regulations or the UK International Data Transfer Agreement or Addendum. You can ask us for details.
7. How long we keep it
| Data | How long |
|---|---|
| Order, renewal and refund records | 6 years after the end of the financial year they relate to, as required for tax and accounting |
| Licence and activation records | While your licence is active, plus 12 months after it ends |
| Gift details | The recipient's email address and the delivery date, time and time zone are kept with the order record and the licence record, for the periods shown above for those records. The buyer's personal message is deleted within 30 days after the gift is delivered. |
| Trial records | The email address is removed once your trial key has been sent, and in any case within 30 days. A coded (hashed) version is kept for 12 months after you request the trial, to prevent repeat trials. |
| Student eligibility evidence | Deleted within 30 days of our check; we keep only the result for the life of the licence |
| Support emails and attachments | 2 years after the conversation ends |
| Newsletter subscribers | Until you unsubscribe; we then keep your email on a suppression list so we do not contact you again |
| Marketing consent record | 6 years from when you gave consent, as evidence that you agreed. It holds a coded version of your address, not the address itself. |
| Download records | Up to 13 months, then deleted automatically. The scrambled one-way code used to avoid counting a download twice is deleted after 24 hours. |
| Website server logs | 30 days |
8. Cookies and similar technologies
Our website uses only strictly necessary (functional) cookies. We do not use analytics, advertising or other tracking cookies, so no cookie consent is required. Our payment provider's checkout, which opens when you buy, sets its own strictly necessary cookies to process your order securely. The trial request form uses Cloudflare Turnstile, a security check provided by Cloudflare under its own privacy terms, to confirm that the request comes from a person. Our website also loads its typeface from Google Fonts, so when a page loads your browser requests the font from Google's servers, which receive your IP address and browser details under Google's own privacy terms. We do not use this to identify you or to track you.
9. Security
We protect your data using encrypted connections, access controls and reputable providers. Access is limited to those who need it. No system is perfectly secure, but if a breach affects your data and is likely to put you at risk, we will tell you and the ICO as the law requires.
10. Your rights
You have the right to:
- Get a copy of the personal data we hold about you
- Have inaccurate data corrected
- Have your data deleted, where we no longer have a good reason to keep it
- Restrict or object to how we use your data, including objecting to anything we do on the basis of legitimate interests
- Receive data you gave us in a portable format
- Withdraw consent at any time, where we rely on consent
We do not make decisions about you using solely automated processing that have legal or similarly significant effects.
To use any of these rights, email privacy@visaria.dev. There is no charge. We may ask you to confirm your identity, for example by replying from the email address linked to your licence. We will respond within one month, or tell you within that month if we need more time because your request is complex.
11. Complaints
If you are unhappy with how we have handled your personal data, you have the right to complain to us. Email privacy@visaria.dev. We will acknowledge your complaint within 30 days, look into it, and tell you the outcome without undue delay.
You can also complain to the Information Commissioner's Office, the UK data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113. We would appreciate the chance to put things right first.
12. Children
Minimum age. Our services, software downloads and free trials are intended solely for individuals aged 13 and older, in line with the UK GDPR age of digital consent. You must be at least 13 years old to provide personal data to apply for a free trial, download a trial, or use our website. If you are under 13, you must not use our services or submit personal data to us.
Children under 13. We do not knowingly collect, solicit or process personal data from children under 13. If we discover, or are notified, that personal data of a child under 13 has been collected without verified parental authorisation, we will delete that data immediately. If you believe this has happened, please contact privacy@visaria.dev.
Users aged 13 to 17. If you are between 13 and 17 years old, you may create an account and download free trials. Any account or transactional data we collect from you is processed in accordance with UK data protection law, including the principles of the ICO's Children's Code, in particular data minimisation.
You may only buy a paid licence if your parent or legal guardian has reviewed and agreed to our terms on your behalf and authorised the purchase. By buying a licence or providing a payment method through our payment provider, you confirm that you are at least 18, or that you are aged 13 to 17 and have your parent's or legal guardian's permission to make the purchase with an authorised payment method. A parent or guardian who permits a minor to use the software or buy a licence agrees to be bound by our terms and accepts responsibility for all purchases and account activity by the minor.
Gifts. A gift can be sent to a recipient aged 13 or over, including someone aged 13 to 17, and we use their email address only as described in section 2. If you are under 18, ask a parent or guardian to buy the gift. We do not knowingly send a gift to anyone under 13: buyers must not enter the address of a child under 13, and if we learn that one was entered we will delete it.
13. Changes to this policy
We will update this policy if what we do with personal data changes. The date at the top shows the latest version. If we make significant changes that affect you, we will email you before they take effect.