Privacy Policy

Last updated: 28 April 2026

This policy explains what data Invarix collects, why, and who we share it with.

We are based in Denmark and process personal data under the EU General Data Protection Regulation (GDPR).

The short version: we run no analytics on visitors. The only cookie we set is an affiliate-attribution cookie, and only when you arrive via a partner referral link.

We collect the minimum from paying customers (your email and billing details, via Stripe) so we can deliver a license and comply with tax law.

Who we are

“Invarix” (also “we”, “us”) is a sole proprietorship operated by Alex Batten in Denmark.

The data controller for the purposes of this policy is Alex Batten, reachable at sales@invarix.dk.

There is no parent company, no analytics vendor in the loop, and no employees other than the founder.

Visitors to this website

We do not run any analytics on invarix.dk.

No Google Analytics, Plausible, Fathom, Hotjar, Mixpanel, Segment, or anything equivalent.

We set one cookie on our own domain, and only when you arrive with an affiliate referral parameter. See “Cookies” below for the full description.

We do not fingerprint browsers.

The site is served by Cloudflare Pages. As part of operating any website, Cloudflare records standard request metadata in its edge logs (your IP address, the URL you requested, your user agent, timestamp).

This is for security and abuse prevention and is governed by Cloudflare’s privacy policy.

What we collect when you buy a license

The Professional tier is sold through Stripe Checkout.

When you complete a purchase, Stripe collects the data it needs to take payment and produce a tax compliant invoice (your email, name, billing address, payment details, optional tax ID).

Stripe is the data controller for the payment transaction itself, and their handling is governed by Stripe’s privacy policy.

After your payment succeeds, Stripe forwards a webhook event to our endpoint. From that event we read and process:

• Your email address. Used as the customer identifier in the license token (in the sub claim) and as the recipient address for the license delivery email.
• Your name (if Stripe captured it). Used only in the greeting line of the license email.
• Your Stripe customer ID. Stored in the license token so we can correlate the license back to the original purchase if we ever need to (e.g. for refund or revocation).

We do not receive your card details, your billing address, or your tax ID. Stripe holds those.

How the license is delivered

The license token is sent to your email address through Resend, a transactional email provider.

Resend stores the recipient address and the email body for as long as their retention policy dictates (typically 30 days for delivery logs).

The license token itself is a signed file. It contains the email address and Stripe customer ID listed above plus the SKU, issue timestamp, and a digital signature.

The library you install on your servers verifies the signature offline. Nothing about your license validation phones home.

Server logs

Our webhook handler runs on Cloudflare Pages.

When it processes a successful purchase, it writes a log line to Cloudflare’s function log that includes your email address, your Stripe customer ID, and the SKU.

This is used to debug failures and to prove a license was issued if a customer reports they never received the email.

Cloudflare retains these logs per their standard policy (currently up to seven days for runtime logs).

What the product itself collects

Nothing.

The Invarix.Guard NuGet package runs entirely inside your application process.

It does not phone home, does not transmit telemetry, does not check for license revocation against a remote server, and does not report scan results anywhere.

The license validates offline against a public key baked into the package.

The version you bought keeps running regardless of whether Invarix exists.

Third parties and data transfers

The data we hold about paying customers is processed by:

• Stripe.Payment processing, billing, and tax compliance. Data is processed in the United States and the European Union under Stripe’s standard contractual clauses.
• Resend. Transactional email delivery. Resend processes the recipient email address and message body in the United States.
• Cloudflare.Site hosting, webhook runtime, and the D1 database that stores affiliate sales rows. Processed in Cloudflare’s global network with EU data residency available for our region.

We do not sell your data.

We do not share it with advertisers or transfer it to any other party.

How long we keep your data

• Email + Stripe customer ID: kept for the lifetime of your license, since the license is lifetime by design. You can ask for erasure (see below). We will mark the license revoked in our records when we erase them, and the installed token keeps validating offline.
• Stripe records:retained per Stripe’s policy and EU tax law (typically 7 to 10 years for invoice records).
• Resend delivery logs:retained per Resend’s policy (typically 30 days).
• Cloudflare runtime logs:retained per Cloudflare’s policy (typically up to 7 days).

Your rights under GDPR

If you are in the EU/EEA or the UK, you have the right to:

• Access the personal data we hold about you.
• Request that we correct inaccurate data.
• Request that we erase your data. Note that erasing the email tied to a license means we can no longer verify the license as yours or connect it to its purchase record. The license token itself remains technically valid but will be added to our internal revocation list.
• Restrict or object to processing.
• Receive a copy of your data in a portable format.
• Lodge a complaint with the Danish Data Protection Agency (Datatilsynet) at datatilsynet.dk.

To exercise any of these rights, email sales@invarix.dk.

We will reply within 30 days.

Cookies

We set one cookie on invarix.dk, and only if you arrive with an affiliate referral parameter in the URL (for example, ?ref=partner-name).

• Name: invarix_ref
• Value: the affiliate code from the URL (a short identifier like partner-name). It does not contain your email, IP, or any data we collected from you.
• Lifetime: 30 days.
• Purpose: if you complete a purchase within that window, the cookie tells us which partner to credit with the referral so we can pay them their commission.
• Flags: HttpOnly, Secure, SameSite=Lax.

You can clear it any time by deleting cookies for invarix.dk in your browser. We do not set this cookie if you arrive at the site without an ?ref= parameter.

When you click “Buy Professional” you are redirected to checkout.stripe.com.

Stripe sets its own cookies on its own domain to run the checkout, and those are governed by Stripe’s policy linked above.

Affiliate sales log

When a purchase completes and an affiliate cookie was present at checkout, we record one row in a Cloudflare D1 database we control. The row contains:

• The Stripe checkout session ID.
• The affiliate code (e.g. partner-name).
• Your email address (so we can reconcile the row against the license issued).
• Your Stripe customer ID, if any.
• The amount paid and currency.
• Whether the sale was in test or live mode.
• The timestamp of the sale.

The legal basis for this processing is our legitimate interest in operating an affiliate program (GDPR Art. 6(1)(f)). The affiliate themselves only sees aggregate counts on payout day. They never see your email, your address, or your Stripe ID.

We retain affiliate sales rows for as long as we retain the license itself (see “How long we keep your data”). You can request erasure from this table by emailing sales@invarix.dk.

Children

Invarix.Guard is sold to companies and developers.

The product is not directed at children, and we do not knowingly collect data from anyone under 16.

Security

The license signing key is held as an encrypted secret in Cloudflare Pages.

Webhook payloads are signature verified against Stripe’s key before any processing happens.

Outbound email goes over TLS via Resend.

We run a single small database we control: a Cloudflare D1 instance that stores affiliate sales rows (see “Affiliate sales log” above). All other customer-related data lives in Stripe’s and Resend’s systems.

Vulnerability reports go to security@invarix.dk and are acknowledged within 48 hours.

Changes to this policy

If this policy changes materially, we will update the “Last updated” date at the top.

Where the change affects existing customers, we will email the address on file before the change takes effect.

Contact

Questions about this policy or about your data: sales@invarix.dk.