Privacy Notice

At MacPaw, We care about the privacy of Your data and are committed to protecting it.

This Privacy Notice (“Notice” or “Privacy Notice”) will help you understand who we are, how we operate, what personal data we collect, how we use it, on what legal grounds we rely when processing your Personal Data, how we keep your Personal Data secure, as well as your privacy rights and our commitments to comply with them, according to applicable Data Protection Laws.

Setapp is a platform for macOS, iPadOS and/or iOS* devices that operates in two formats: Setapp Membership and Setapp Single App. To learn more, please refer to the Terms of Use of Setapp that constitutes the integral part of this Notice. To understand your role and how this Notice applies to you, refer to section “Applicability” below.

*Please note that Setapp’s functionality and apps availability may differ depending on Your region. For example, only users in the EU can download apps directly on iOS devices.

The data controller of Your Personal Data is:

MacPaw Way Ltd. (hereinafter “We/we”, “Us/us”, “Our/our” or “MacPaw”)

registration number 428214

registered address: 25 Serifou, Allure Center 11, Office No. 11-12, 2nd Floor, 3046 Zakaki, Limassol, Cyprus.

We ensure secure and confidential data transmission through our robust practices, which we are happy to demonstrate to you. Please visit the Trust Center by following this link.

As our Services are constantly evolving, we reserve the right to change this Privacy Notice at any time subject to the applicable regulations. Any changes will be published promptly on this page and communicated to you by email (to your most recently provided email address) or popup notification. You should, nevertheless, check this page regularly for any updates.

This Setapp Privacy Notice applies to You as a 1) Setapp Membership end user; 2) Setapp Single App end user (together referred to as “Services”), and 3) our website Setapp.com (Website or Site) visitor. Setapp includes the associated Setapp macOs, iPadOS and/or iOS applications.

You are choosing your role on your own.

This Setapp Privacy Notice applies to you as a Developer if you are a party to the SETAPP DEVELOPER AGREEMENT on the basis of which we process your Personal Data. For the purpose of this Notice, we refer to Developer as “Developer” or “Vendor”.

Please note: when you use the Website, we also collect and use cookies and other tracking technologies; the relevant Cookie Notice can be found by following this link.

This Privacy Notice does not apply to:

• Third-party services. Where third-party services are used, and the third party is not a Data Processor, no Personal Data (as defined below) is shared with them;
• Personal Data that we process about you when you interact as a user with other products/services or our branded social media pages under the brand name “MacPaw”. In such cases, the relevant privacy notice of each product/service you interact with will apply accordingly;
• Anonymized data.

Please note: when you purchase and use a Developer App on the Setapp platform, you should carefully review and understand the privacy Notice or privacy statement provided by the Developer. Setapp is not responsible for the collection, processing, or handling of your personal data by the Developer App. Any data shared with or collected by the Developer App is subject to the Developer’s own privacy practices.

If you are a California resident, please see our “CALIFORNIA ADDENDUM - FOR RESIDENTS OF CALIFORNIA” section below regarding the rights you have under California law and how to exercise them.

If you are a United Kingdom of Great Britain and Northern Ireland citizen, please see our “UK GDPR” ADDENDUM section below regarding the rights you have under UK GDPR law and how to exercise them.

Data Processor means a natural or legal person, public authority, agency, or other body that processes Personal Data on behalf of MacPaw.

Data Protection Laws means any applicable data protection or privacy laws or regulations as may be amended or superseded from time to time, including but not limited to: i) the EU General Data Protection Regulation (“GDPR”) as implemented by countries within the EEA; ii) the UK General Data Protection Regulation and Data Protection Act 2018, as amended by Brexit legislation (“UK GDPR”); iii) the California Consumer Privacy Act (“CCPA”) and California’s Shine the Light law; and iv) any other applicable Data Protection Legislation and/or other laws or regulations that are similar, equivalent to, successors to, or that are intended to implement the laws or regulations applicable to you in relation to the transmission and processing of your Personal Data under this Privacy Notice

Location data means the geographic area where you use your devices when interacting with Our Service(s). This information might be necessary to determine your general geographic location, applicable legislation and provide You with customised, localised and personalised content. We will not track specific geographic location.

Log data refers to information that our systems automatically collect and record when you use our Service(s). This data is stored in log files and may include information such as device type, operating system version, application version, session start and end times, browser type and settings (if applicable), language preferences, and user interactions. We also collect diagnostic data, such as crash reports, error logs, and other performance metrics. This information is essential for ensuring the security of our systems, detecting and preventing unauthorized or illegal activities (e.g., fraud), and enforcing our Terms of Use. Additionally, diagnostic and log data helps identify and fix defects in our Service(s), analyze application malfunctions, and resolve issues experienced during use. Log data is mandatory and is frequently the main functionality, which helps to understand and resolve Service(s) issues.

Personal Data means any information relating to an identified or identifiable natural person.

Special Categories of Data means Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, and data concerning health or a person’s sex life or sexual orientation. By default, the Special Categories of Data are not processed in any way by the Services or Site. If you believe that we may have unknowingly received your Special Categories of Data, please contact us. We will promptly investigate and, if confirmed, take immediate action to irreversibly delete it.

Setapp Membership means that You, as an end user, can purchase a subscription to the Setapp platform, which grants You access to a curated catalog of Developer App available on the platform.

Setapp Single App means that You, as an end user, can purchase a specific Developer App independently, without subscribing to the Setapp platform.

Service(s) Usage and Device Data refers to information collected about how you interact with our Services and use applications. This data includes Device Data, which comprises Device ID, and device and usage data (such as device name and licenses). We collect this data to analyze usage patterns, optimize features, identify technical issues, and enhance the overall user experience. It also helps us understand user behavior and improve the UX and performance of our Services.

We rely on your consent when processing this data for behavioral advertising or measuring the effectiveness of advertising campaigns. For purposes such as fraud prevention, error correction, bug fixing, technical improvements, and service analytics, we process this data based on our legitimate interests.

Standard Contractual Clauses means i) where the EU GDPR applies, the contractual clauses annexed to the European Commission's Implementing Decision 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council, incorporating Module 1 (Controller to Controller transfers) (EU SCCs); and ii) where the UK GDPR applies, the template Addendum B.1.0 issued by the UK's Information Commissioner's Office and approved by Parliament in accordance with s119A of the Data Protection Act 2018 (UK Approved Addendum) and the accompanying Mandatory Clauses of the UK Approved Addendum, as updated from time to time and/or replaced by any further version published by the Information Commissioner's Office (UK Mandatory Clauses).

All capitalized terms used in this Privacy Notice and not otherwise defined shall have the meanings assigned to such terms in the Terms of Service.

We collect information that, alone or in combination with other data, could be used to identify you (Personal Data). Some of the information we collect is stored using anonymization instruments that cannot be linked back to you (Non-Personal Data).

Detailed information about the disclosure of your Personal Data and the collection of Personal Data by third parties is governed by their privacy practices and data transfer contractual commitments. To learn more, please refer to the section “Third-Party Information and Personal Data Disclosure” of this Notice.

Vendor Data means that we will collect and process vendor-related data to facilitate Setapp distribution, payment settlements, and ensure compliance with marketplace policies. Vendor Data comprises the following:

• contact (email,name and legal representative, country of representative);
• account data (beneficiary details) and preferences;
• application metadata (descriptions, branding elements, pricing, version history);
• license and distribution settings (membership inclusion, single distribution eligibility, prices);
• payment metadata and billing (payment methods, transaction history);

MacPaw uses cookies and similar technologies on our Website that help us provide, analyze, understand, and enhance the use of our Services, enforce our Terms of Use, prevent fraud, improve Website performance, monitor visitor traffic and actions, deliver and tailor our marketing or advertising, and understand interactions with our emails, marketing, and online ads on third-party sites. The Website may also include cookies and similar tracking technologies from third parties, which may collect information about you via the Website and Services and across other websites and online services.

We preserve your privacy when we collect your Personal Data for our internal analytical purposes through the Website. We have developed our own analytics data module that removes any Personal Data and Personally Identifiable Information when you do not provide your consent (including Google clientid, Google gclid) and replaces it with random identifiers that cannot be directly linked to you, so that we gather only aggregated information. For more details about how we use this technology, as well as processing your Personal Data when you consent to it, please see our Cookie Notice. To find more about how we conduct customer surveys, and other marketing and analytics campaigns when we rely on your consent, go to the section “Customer Surveys and Conducting Analytics Campaigns” below.

Where Setapp and Vendor are parties to Setapp Developer Agreement and Setapp processes Personal Data in connection with end users’ uses of Setapp under the Terms of Use and present Privacy Notice, and Vendor will collect and process end-user Personal Data for its independent purposes in the course of distributing its applications to end-users according to such Vendor’s terms of use and privacy commitments (i.e. sales, marketing, analytics and data about app functionality), each Party will be “Controller”, not joint controllers (as such terms are defined by Data Protection Laws).

Where Setapp processes Vendor’s Data (i.e. to facilitate app distribution and payment settlements) as defined in Section Vendor Data in Setapp Single App above and pursuant to the terms of the Setapp Developer Agreement, Setapp will be the Processor of Vendor’s Personal Data.

This Vendor Data Processing Agreement (“Agreement”) forms part of the agreement(s) between Vendor and Setapp covering customer’s (end users) use of the Services, processing Vendor’s Data by Setapp, and the related processing of customers’ Personal Data, by Vendor.

Our activities are not aimed at children under 13 years. We do not knowingly collect information from children under the age of 13. If you have not reached the age limit, do not use the functionality of Setapp, Services, Site and do not provide us with your personal information.

If you are a parent of a child below the age limit and you learn that your child has provided MacPaw with personal information, please contact us at [email protected] and insist on exercising your rights of access, correction, cancellation and / or opposition.

We use information processed from Setapp to respond to your requests. We do not sell, rent, lease, trade or share your Personal Data other than as outlined in this Privacy Notice. When you provide us with your Personal Data or otherwise choose to sign up to receive email communications from us, we will use that information to send those communications to you. We will rely on your consent or legitimate interest. You may “opt out” of receiving email communications through links available on emails received, or via your account preference settings or by contacting us.

We receive information from third-party business partners, such as marketing data and Service(s) Usage and Device Data.

Some third-party applications and services that work with us may ask for permission to access Your information. Those applications will provide You with notice and request Your consent. Please consider Your selection of such applications and services, and Your permissions, carefully. Data collected by third parties through these apps and plugins is subject to each parties’ own policies. We encourage You to read those policies and understand how other companies use Your data.

In most cases, your data is processed within the territory of the European Economic Area (EEA). When we transmit your personal data beyond EU/EEA regions, we rely on Standard Contractual Clauses as approved by the European Commission (EU-US DPF) and confidentiality obligations, ensuring your data is handled with care and responsibility.

We are committed to maintaining the highest security standards to protect Your Personal Data both in transit and at rest. To learn more about Our security commitments, go to section “Security and Confidentiality” below.

In the table below we provide You with information about whom we share Your Personal Data, the purposes, as well as transfer mechanisms we rely on when disclosing Your Personal Data to ensure its secure transmission.

For more information about our other marketing activities and analytics, follow the section “Conducting Customer Surveys and other Interactions” below.

For more information about Third Parties whom we engage for marketing and analytics via Site, follow Our Cookie Notice.

We may disclose or allow government and law enforcement officials access to your Personal Data, in response to a subpoena, search warrant or court order (or similar requirement), or in compliance with applicable laws and regulations. Such disclosure or access may occur if we believe in good faith that:

We also receive Personal Data when you participate in a focus group, contest, activity, or event, request support, interact with our social media accounts, or otherwise communicate with MacPaw. We interact with you upon your consent.

All MacPaw account holders will continue to receive transactional messages related to our Service(s), even if you unsubscribe from promotional emails. Transactional messages mean important communication with you that, for example, may concern software setup, payment confirmation, or any updates to our services and licenses. The legal basis for sending you transactional messages is the performance of the Terms of Use with you.

When you use Services, we can also use your Contact data to send you customer and satisfaction surveys. We will use the results of the surveys to improve our Services and deliver You the customized content. By doing so, we rely on your consent.

We have developed and implemented an internal Data Retention and Destruction Notice that governs processing activities and scenarios we have carefully developed for each specific activity, specific terms for keeping your Personal Data, the legal basis we rely on, and justifications, as well as data destruction methods when retention periods expire.

We store your Personal Data:

• For the fulfillment of our contractual obligations and providing services under the Terms of Use, we keep your data during the term of the Terms of Use. To find out more, please refer to the Terms of Use.
• For the purpose of sending you newsletters, we keep your data for as long as we retain your consent. You may revoke your consent at any time by clicking “unsubscribe” in the email footer.
• For the fulfillment of tax and accounting obligations in accordance with our legal obligations, we will retain your personal data usually for 10 years (depending on the applicable law).
• Cookies data and other log files will be stored until the relevant cookies expire. You can always check the duration of cookie storage in our Consent Management Tool. We have set the duration in the cookie banner.
• Metrics and log data will be stored for the duration not exceeding 12 months;
• For our internal analytics for the purposes of improving Our Service(s), we will retain your data for 3 years.
• When we process your data for the purposes of exercising your rights as the data subject and respond to your access requests, we will retain your data for 5 years.
• When we process your data for the purpose of establishing, exercising, or defending against legal claims, we will keep the data for as long as it is necessary to defend our specific rights and interests, and, in the case of a dispute, until the final execution of the binding decision of the competent supervisory authority.

Upon expiration of data storage, we will securely destroy your data in accordance with our Data Retention and Destruction Notice and applicable laws and regulations.

If we seek to retain your personal data on file on the basis that a further opportunity may arise in the future, we will inform you with notice, seeking your explicit consent to retain your personal data for a fixed period on that basis.

If you believe that we are keeping your data illegally, please send the respective notice request to [email protected]. We will review your request at our earliest convenience and delete your data unless we are required by law to keep it for a longer period, or unless we can demonstrate legitimate grounds for processing that override your interests, rights, and freedoms. If deletion is impossible, we will securely store your personal data and isolate it from any further processing until deletion is permitted.

We are committed to protecting the privacy and security of Your Personal Data. We have recently achieved ISO 27001 certification for Setapp, demonstrating our dedication to maintaining a high standard of information security management. This internationally recognized standard sets requirements for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS).

Here’s how we ensure the security and confidentiality of Your Personal Data:

• Information Security Policies: We have established a comprehensive set of information security policies that guide our data protection practices, which are regularly reviewed and updated to remain effective;
• Access Control: Access to personal data is strictly controlled. We employ user authentication, role-based access controls, and encryption to prevent unauthorized access to your data;
• Data Encryption: Your personal data is encrypted both in transit and at rest using industry-standard encryption methods to prevent unauthorized access or disclosure;
• Risk Management: We conduct regular risk assessments to identify potential security threats and vulnerabilities. This proactive approach helps us to implement effective measures to mitigate identified risks.
• Security Awareness and Training: Our employees receive regular training on information security and data protection best practices to ensure they understand the importance of maintaining data privacy.
• Incident Management: We have established a comprehensive incident response plan to quickly and effectively address any security incidents or breaches. This includes processes for detection, containment, investigation, and communication.
• Data Integrity and Accuracy: We implement measures to ensure the accuracy and completeness of personal data and prevent unauthorized alterations.
• Physical and Environmental Security: Our data centers and office locations are protected by physical security controls such as access restrictions, surveillance, and environmental controls to safeguard against physical threats.
• Supplier Security and Vendor Check: We assess and monitor our suppliers and vendors to ensure they meet our high standards of data protection and information security
• Regular Audits and Continuous Improvement: As part of our ISO 27001 certification, we conduct regular internal and external audits of our ISMS to identify areas for improvement and ensure ongoing compliance with security standards.

Find our ISO 27001 certification by following this link or visit our Trust Center.

You have the following rights in respect to Your Personal Data, including the right to access, correct, or delete Personal Data. You can:

• Have Your Personal Data corrected or deleted. You may ask Us to correct information You think is inaccurate or completely delete all information that We hold about You by emailing: [email protected]
• Access Your Personal Data report by submitting a request at [email protected]. This report will include the Personal Data We have about You, provided to You in a structured, commonly used, and portable format.
• Object to processing Your Personal Data. It is Your right to lodge an objection to the processing of Your Personal Data by emailing: [email protected] if You feel the “ground relating to Your particular situation” applies. The only reasons We will be able to deny Your request is if We can show compelling legitimate grounds for the processing, which override Your interest, rights and freedoms, or the processing is for the establishment, exercise or defence of a legal claim.
• Withdraw consent on marketing emails, including when We use Your Personal Data to send You marketing emails. We only send marketing communications to You with Your prior consent, and You may withdraw Your consent at any time by clicking the “unsubscribe” link found within MacPaw emails and changing Your contact preferences. Please note You will continue to receive transactional messages related to Our Service(s), even if You unsubscribe from marketing emails.
• Withdraw consent. This right only exists where We are relying on consent as a legal basis to process Personal Data about You (“Consent Withdrawal”).
• Without prejudice to any other administrative or judicial remedy, You have the right to appeal to a supervisory authority if You consider that the processing of Personal Data relating to You is in breach of the applicable laws and regulations. If You’re based in the European Economic Area (EEA) and think that We haven’t complied with data protection laws, You have a right to lodge a complaint with Your local supervisory authority. You can find the list of supervisory authorities via this link.
• Request to know more details about the categories or specific pieces of Personal Data We collect (including how We use and disclose this Personal Data), to delete their Personal Data, to opt out of any “sales” that may be occurring, and to not be discriminated against for exercising these rights.

You may have other rights as may be provided by Data Protection Laws.

You will not have to pay a fee to access Personal Data about You (or to exercise any of the other rights outlined above). However, except in relation to Consent Withdrawal, We may charge a reasonable fee if Your request is clearly unfounded, repetitive, or excessive, or, We may refuse to comply with Your request in these circumstances.

We may need to request specific information from You to help Us confirm Your identity and ensure Your right to access Personal Data about You (or to exercise any of Your other rights). This is a security measure to ensure that Personal Data is not disclosed to any person who has no right to receive it. We may also contact You to ask You for further information in relation to Your request to speed up Our response.

We try to respond to all legitimate requests within one (1) month (i.e. 30 calendar days). Occasionally it may take Us longer than a month if Your request is particularly complex or You have made a number of requests. In this case, We will notify You and keep You updated.

Data Protection Officer
To communicate with Our Data Protection Officer, please use our dedicated email channel [email protected].

We may need to update this Privacy Notice to keep pace with changes in our Service(s), our business, and the laws applicable to us and you. We will, however, always maintain our commitment to respect your privacy. We will notify you of any material changes that impact your rights under this Privacy Notice by email or popup notification (to your most recently provided email address) or post any other revisions to this Privacy Notice, along with their effective date, in an easy-to-find area of our Setapp Website. Therefore, we recommend that you periodically check back here to stay informed of any changes. Please note that your continued use of MacPaw after any change means that you agree with and consent to be bound by the new Notice. If you disagree with any changes in this Privacy Notice and do not wish your information to be subject to it, you will need to stop using the Service(s).

You may contact Us with any questions relating to this Privacy Notice by e-mailing to our customer support: [email protected], or to communicate with Our Data Protection Officer, please use our dedicated email channel [email protected].