Skip to content

Flowye Licensing System — Privacy Policy

Last updated: 17 January 2026

This Privacy Policy explains how Flowye collects, uses, stores, and protects personal data in connection with the Flowye Licensing System plugin ("the Plugin"). We take privacy and data protection seriously and aim to be transparent about our practices.

The Plugin is used within the Unity Editor to enforce licensing on VRChat avatars. There are two types of users whose data might be processed through the plugin:

  • Avatar Creators - who integrate the plugin into their avatars (and thus interact with Flowye as customers), and
  • Avatar End Users - who purchase an avatar from a Creator and activate/upload it using the plugin.

This Policy applies to both categories of users and outlines what information we collect from each, what we do with it, and what rights you have regarding that data. This Privacy Policy should be read alongside the Terms of Service at terms-of-service.md.

In summary, we collect only the data needed to verify licenses and protect content, and we handle that data with care, security, and respect for privacy. We do not use your data for marketing or tracking beyond the licensing purpose, and we do not sell your information.

Data Controller

The Flowye Licensing System is provided by Dummics, Dominik Martignago, an individual developer based in Udine, Italy.
Email: business@dummics.com.
Postal address: Udine, Italy

Creators are independent parties and may separately process personal data related to avatar sales and customer support under their own privacy policies and marketplace terms.

Data We Collect

We only collect the data necessary to provide and secure the Flowye Licensing System. We do not collect any unnecessary personal information.

For Avatar Creators:

  • Contact details: Name (or business/brand) and email address. If we coordinate via Discord, your Discord username or ID.
  • Purchase information: We never store your payment card details; payments are handled by secure third-party processors (like PayPal or Gumroad) and Creators. We only store data related to the license itself and its activation.
  • Avatar project details: Name or reference of the avatar project(s) licensed, to track and support your protected avatars.

This information is used only to fulfill the purpose of protecting the products, provide support, and meet legal/accounting obligations. Access is strictly limited to Dummics and any essential helpers. We do not share your contact or billing info with unrelated third parties, except as needed for payment processing or legal compliance.

For Avatar End Users:

When you activate or use an avatar with the Flowye Licensing System, the Plugin processes limited identifiers for license verification and anti-abuse. For End Users, the main data items are:

  • VRChat User ID + Display Name
  • Purpose: license verification; account linkage for the licensed avatar; troubleshooting and support.
  • Retention: while the avatar license is active; see Data Retention for details.
  • IP address (processed/hashed)
  • Purpose: security and anti-abuse (e.g., fraud prevention, rate limiting, suspicious activity detection).
  • Retention: stored in hashed/processed form where applicable; logs may be retained for up to 5 years; see Data Retention.
  • Hardware/device identifiers (processed/hashed)
  • Purpose: security and anti-abuse, including helping detect license sharing and circumvention attempts.
  • Retention: stored in hashed/processed form where applicable; logs may be retained for up to 5 years; see Data Retention.
  • Activation logs (timestamp, avatar/license identifier, result)
  • Purpose: troubleshooting, auditing, and security monitoring.
  • Retention: logs may be retained for up to 5 years; see Data Retention.

No other activity or personal files are monitored or collected. The plugin does not track your system, scan your files, or collect content or analytics unrelated to license checks. All data use is strictly for license verification and anti-piracy.

How We Use Your Information

We use the information we collect only for purposes directly related to licensing and security. Specifically:

  • License Verification:
    To check that only authorized users can activate or use an avatar. For End Users, your VRChat ID is matched to the Creator's sales records, and hashed device/IP data is used to prevent license sharing and piracy.
  • Service and Support:
    For Creators, your contact info is used for communication, plugin integration, support, and important updates. For End Users, data may be used to help troubleshoot activation problems if you contact support.
  • Record-Keeping:
    We keep a secure log of license activations and authorized users, which helps Creators confirm who has access to their avatars and allows us to audit or investigate any issues.
  • Improvement:
    We may analyze anonymous, aggregated technical data (like error rates or activation statistics) to improve the plugin. We do not use personal data for profiling or marketing.
  • Legal Compliance and Protection:
    If someone tries to bypass the licensing or breaks the Terms, we may use or share relevant data (like logs or user IDs) to enforce the rules, protect our system, and comply with legal obligations. Any sharing is minimal and only with the Creator or proper authorities if required.
  • No Marketing or Ads:
    We do not use your data for marketing, advertising, or any unrelated purpose.

In short:
Your information is used only to run, protect, and improve the licensing system. We do not use it for anything else.

Legal Basis for Data Processing

We process your data in accordance with European data protection laws (GDPR) and similar rules in other countries. Here's the legal basis for how and why we use your data:

  • Performance of a Contract (Creators):
    When you request the Flowye Licensing System for your avatar, we collect and use your data (such as contact info and project details) to provide and support the service. This processing is necessary to fulfill our agreement with you.

  • Legitimate Interests (End Users):
    For End Users, we process limited data (like VRChat ID and hashed device info) to prevent piracy and help keep the licensing system secure. We have a legitimate interest in protecting the integrity of the licensing system and preventing unauthorized distribution of avatar packages. This data processing is necessary for those purposes, is minimized, and only includes identifiers needed for license verification and anti-abuse measures.

    Balancing test: We have carefully balanced our legitimate interests against your privacy rights. The data we process from End Users is limited to technical identifiers, does not include personal content or sensitive information, and is only used for licensing verification and security. This processing does not enable us to track your activity in VRChat or beyond the licensing context.

    Your right to object: You have a right to object to this processing under Article 21 GDPR if you have legitimate grounds relating to your particular situation. If you object and we cannot demonstrate compelling legitimate grounds for processing, we will stop processing your data (though this may affect your ability to use licensed avatars). - Legal Obligations:
    Sometimes we must retain or provide certain data to meet legal requirements, such as accounting rules or valid law enforcement requests. - Consent (if ever needed):
    We do not rely on consent for core licensing and security processing. If, in the future, an optional feature required consent, we would ask for it clearly and you could opt out at any time.

In summary:
We process Creator data to provide our service, and End User data to protect against piracy and support license enforcement. We respect your privacy and only process data as allowed by law. If you have questions about the legal basis for any data, you can always contact us.

Data Sharing and Disclosure

We keep your data confidential. We never sell or share your information for marketing purposes. We only share data in these limited situations:

International Data Transfers

Our servers are currently hosted in the United States (Ashburn, Virginia), so personal data may be processed outside the EEA. We use appropriate safeguards as required by applicable law, including encryption in transit (TLS/HTTPS) and hashing/pseudonymization where applicable. We require service providers to process data only on our behalf and to protect it under contractual and security obligations.

  • With Avatar Creators:
    If you are an End User, your VRChat user ID and display name may be visible to the Creator of the avatar, so they can confirm who has activated their product. No private data (like IP addresses, hardware info, or emails) is shared with Creators-only your public VRChat identity.
  • With Service Providers:
    We use trusted third-party providers (such as hosting providers, including SparkedHost, and other infrastructure vendors) to help run the licensing system. These providers only process data as needed to deliver the service, under appropriate contractual terms, and cannot use it for their own purposes.
  • For Legal Compliance and Protection:
    If required by law (such as a valid court order), or to protect our rights, prevent fraud, or respond to security threats, we may disclose relevant data to authorities, lawyers, or cybersecurity experts. In such cases, we limit what is shared to the minimum necessary and, where possible, use only hashed or anonymized information.
  • Business Transfers:
    If the Flowye Licensing System is ever sold, merged, or transferred to a new owner, your data may be transferred as part of the business, but the same level of privacy protection will be maintained. You will be notified of any such change.
  • No Third-Party Marketing:
    Your data is never shared with advertisers or used for marketing by anyone.

In summary:
We share only what is necessary to provide the licensing service, support Creators, and comply with legal requirements. All other sharing is minimal, controlled, and strictly limited.

Data Security

We take data security seriously and use several methods designed to protect your information:

  • Encrypted Communication:
    Data sent between the Plugin and our servers is protected using HTTPS (TLS).
  • Hashing of Sensitive Data:
    Any private identifiers (such as IP addresses, hardware IDs, or emails) are hashed before being stored. This means we never keep these values in plain text, making it extremely difficult for anyone to recover the original information.
  • Secure Storage & Access:
    Our database is secured and not directly exposed to the public internet. Only Dummics (and, if ever needed, a trusted technical assistant) can access your data for necessary support or legal reasons. Access is strictly limited.
  • Tamper-Resistant Plugin:
    The Flowye Licensing System plugin code is obfuscated to prevent tampering or unauthorized modification. This helps protect both the system and your data from outside threats.
  • Breach Notification:
    If, despite our efforts, a data breach affecting your personal information were to occur, we will promptly notify affected users and authorities as required by law (such as GDPR), and take all necessary steps to address the issue.

In summary: We use encryption in transit (TLS), processing/hashing of certain identifiers, strict access controls, and additional safeguards designed to protect personal data.

Data Retention

We keep your data only as long as necessary for licensing, support, or legal reasons.

  • Creators:
    Your contact info, license, and transaction records are kept while you're an active customer, and as needed for legal or accounting purposes (for example, invoices are stored for up to 10 years as required by law). If you stop using the service, you can request deletion of your personal contact data, but some information (like invoices) must be kept to comply with legal obligations.
  • End Users:
    License records (like VRChat ID, display name, and hashed info) are kept while your avatar license is active. Logs may be retained for up to 5 years for security and support. If an avatar is retired or you request deletion of your data, we will delete or anonymize it, unless we need to keep it for legal or technical reasons. Please note: deleting your data means you will lose access to the licensed avatar.
  • Backups:
    We keep encrypted system backups for a limited time (usually a few weeks), which are automatically deleted or overwritten.

We do not keep your data longer than needed, and all personal information is deleted or anonymized as soon as it's no longer required.

Your Rights

As a user of the Flowye Licensing System, you have the following rights under GDPR and similar data protection laws:

  • Access: You can ask if we hold your personal data and request a copy.
  • Correction: You can ask us to fix or update any inaccurate information.
  • Deletion: You can request deletion of your personal data when it's no longer needed or if you no longer use the system. Note: if you request deletion, you'll lose access to licensed avatars. We may still need to keep some records for legal or security reasons.
  • Restriction: You can ask us to temporarily limit how we use your data (for example, if you dispute its accuracy).
  • Objection: You can object to our use of your data based on legitimate interest (in which case, if we can't justify continued use, we'll remove you from the system).
  • Portability: You can request your data in a portable format (like CSV).
  • Withdraw Consent: If we ever process data based on your consent, you can withdraw it at any time (currently, we do not rely on consent for any required processing).

You can exercise these rights by contacting us (see Contact Information). We usually reply within one month.

If you believe your privacy rights have been violated, you can also complain to the Italian data protection authority (Garante Privacy) or your local authority. We encourage you to contact us first, and we'll do our best to resolve any issues quickly and fairly.

Practical Note on Data Deletion and Bans

  • If you request deletion, and your data is no longer needed for legal or security reasons, we will remove or anonymize it.
  • If your license is revoked due to a rule violation (ban), we may keep a record of the relevant data permanently to protect the system and prevent abuse, even if you ask for deletion.
  • Currently, there is no automatic expiration of user data. Old records are archived or deleted manually when possible and when no longer needed for system integrity.

Children's Privacy

The Flowye Licensing System is not intended for children under 13, and we do not knowingly collect personal data from children under 13. If we learn that we have collected such data, we will take reasonable steps to verify and delete it. If you are between 13 and 18, you should have permission from a parent or guardian consistent with VRChat's terms.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements.
If we make any significant changes, we will notify Creators directly (for example, by email or Discord), and post a notice in our documentation or on Discord. The "Last Updated" date at the top of this policy will always show the most recent revision.

For End Users, if a change directly affects your rights (such as new data collected or a change in data retention), we will ask Creators to notify their users, or we may display a notice in the plugin activation interface.

By continuing to use the Flowye Licensing System after changes take effect, you agree to the updated policy. If ever required by law, we will seek renewed consent for any changes that need it.

We encourage you to review this policy periodically for any updates.

Contact Information

If you have any questions or requests about this Privacy Policy or your data rights, please contact us:

We are here to help and support you — whether you are a Creator or an End User.

Thank you for reading and respecting the Flowye Licensing System - Terms & Privacy.
By understanding these policies, you help create a fair and secure environment for all VRChat creators and users.