Privacy Policy

1. Introduction and Scope

This Privacy Policy describes how Loheden AI Solutions AB, a company registered in Sweden ("Company", "we", "us", or "our"), collects, uses, processes, and protects information in connection with the RespectASO desktop application, this website (respectaso.com), and related services (collectively, the "Service").

By accessing or using the Service, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree with any part of this policy, you must not use the Service.

We reserve the right to modify this Privacy Policy at any time. Material changes will be communicated through the Service or via email. Your continued use of the Service after such modifications constitutes acceptance of the updated policy.

This Privacy Policy is provided for informational purposes and does not constitute legal advice. Privacy regulations vary by jurisdiction and change over time. We recommend consulting with your legal team to determine the specific requirements that apply to your situation.

2. Data Controller Information

The data controller responsible for your personal data is Loheden AI Solutions AB. Our contact information is provided at the end of this document.

Our website's servers and database run in the European Union. The service providers named in section 10 may process some data elsewhere; section 11 explains the safeguards.

3. Categories of Data We Collect

3.1 Desktop Application: No Data Collected by Us

RespectASO is a native macOS desktop application that runs entirely on your computer. We designed it with privacy as a core principle. The desktop application does not transmit any data to us. Specifically:

• No telemetry: the app sends zero usage data, crash reports, or analytics to us or any third party
• No accounts: no registration, login, or account creation is required
• Local storage: all keyword data, app rankings, search history, settings, and database files are stored exclusively on your device in ~/Library/Application Support/RespectASO/
• API keys: Pro users' LLM API keys are stored locally on your device with restrictive file permissions (600). They are never transmitted to us.
• License key: if you purchase a Pro license, the license key (a JWT containing your email and expiry date) is stored locally on your device

3.2 Network Requests Made by the Desktop Application

Although we do not collect data from the desktop application, the app makes network requests to third-party services that are not operated by us:

• Apple (App Store): App Store search results, app details and app icons from Apple's iTunes Search API and image servers. If that API fails, the app reads the same search from Apple's public App Store search page (apps.apple.com) and takes only the list of apps. With Pro, the Rival Tracker reads rivals' newest reviews from Apple's public review feed. These requests are governed by Apple's privacy policy.
• Apple Ads Platform API (optional): only if you connect Apple Ads, the app downloads Apple's search popularity data with your own Apple Ads API credentials. Your private key never leaves your device.
• LLM providers (Pro only): if you use Pro AI features, the app sends prompts to your configured LLM provider (OpenAI, Anthropic, Google, OpenRouter, or any OpenAI-compatible service you connect as a custom endpoint) using your own API key. If you use OpenRouter, your request is routed onward to the host of the model you select. If you use a custom endpoint, your request goes to the service whose address you entered. These requests are governed by the respective provider's privacy policy and terms.
• GitHub API: the app checks for new release versions via GitHub's public API. This request does not transmit any personal information or device identifiers.
• License verification: at startup, the app may contact respectaso.com to verify license status (e.g., to detect refunds). Only a license identifier is transmitted; no personal usage data is sent. If the server is unreachable, the app falls back to local verification.

3.3 Purchase Data

When you purchase a Pro license through respectaso.com, we collect and store the following:

• Email address: used to deliver your license key, send renewal reminders, and for license management
• Stripe customer and payment identifiers: reference IDs used to link your purchase to your Stripe payment profile
• License key and status: the issued JWT license key, purchase date, expiry date, and current status
• Purchase details: whether you bought as a business or as a private person, the country you bought from and the billing country you gave Stripe, the IP address and browser of the purchase click, the version of the Terms you accepted, the currency and amount charged and, where Stripe showed you a converted amount, that amount. We keep these to prove the contract and to defend against payment disputes. If you arrived from another website in the visit you bought in, the purchase also keeps that website's name and the first page of ours you opened (section 3.5).

We do not store credit card numbers, bank account details, or other sensitive payment information. All payment data is processed and stored by Stripe in accordance with their privacy policy and PCI-DSS compliance requirements.

3.4 Website Analytics

We use two analytics services. Neither sets a cookie or follows you across websites.

• Simple Analytics: counts page views without collecting personal data. Its script comes from Simple Analytics' own server (scripts.simpleanalyticscdn.com), because the service keeps it up to date. See their privacy policy.
• Cloudflare Web Analytics: part of the Cloudflare service in front of this website (section 10), it measures how pages load with a small script Cloudflare adds to each page. It stores nothing in your browser.

Apart from these two scripts, every file a page of this website loads, including its styles, fonts, scripts and images, comes from respectaso.com itself.

3.5 Download and Visit Statistics

To know how many people download the app and which websites send them, the website keeps its own count. Nothing is stored in your browser for it.

• When you arrive from another website: we note that website's name (for example Google or Reddit, or the source named in a link we posted) and the first page of ours you open. The note is filed under a code computed with a secret key from your IP address, your browser's user agent and the date, so it changes every day, and it is deleted after 24 hours.
• When you download the app: we record the moment, your country as Cloudflare reports it, your browser's user agent, the page the download link was on, a one-way hash of your IP address and, if you arrived from another website in that visit, that website's name and the first page you opened.

3.6 Security and Operational Logging

Our web servers maintain standard access and error logs that may include IP addresses for the following purposes:

• Detecting and preventing unauthorized access attempts
• Identifying and blocking malicious actors and automated attacks
• Rate limiting and abuse prevention
• Investigating security incidents
• Maintaining service integrity and availability

Security logs are retained on a rotating basis and automatically deleted within 30 days. This logging is based on our legitimate interest in protecting the Service and our users from security threats.

An address that requests pages only attack tools look for, or tries to sign in to our administration with a name such as admin, is blocked for 12 months, renewed if it tries again. An address that requests many pages that do not exist within a few minutes is blocked for 24 hours, and for longer if it does so again. Our own record of a block keeps only a code computed from the address with a secret key, never the address itself, and is deleted 30 days after the block ends. To stop a blocked address before it reaches our server, Cloudflare keeps the address itself on a block list for at most 30 days at a time while the block lasts. The list also protects our other websites, so an address blocked on one may be refused by the others for that time. Blocking rests on the same legitimate interest.

4. Data We Do Not Collect

The following categories of data are never collected, processed, or stored by us:

• Your keyword research data, search history, or ASO strategies
• Your LLM API keys or prompts sent to AI providers
• Usage patterns, feature telemetry, or crash reports from the desktop application
• Device identifiers, advertising identifiers, or hardware serial numbers
• Precise geolocation data or GPS coordinates
• Health, biometric, financial, or other sensitive personal data categories
• Third-party tracking data or advertising identifiers

5. Purposes of Processing

We process the data described above for the following purposes:

• License management: issuing, delivering, verifying, and renewing Pro license keys
• Service communications: sending transactional emails including license key delivery, renewal reminders, and critical service notifications
• Payment processing: processing purchases and managing billing records through Stripe
• Website improvement: analyzing aggregate, anonymous website traffic patterns via Simple Analytics and Cloudflare Web Analytics to improve the website
• Download and visit statistics: counting downloads and learning which websites bring the people who download the app or buy Pro (section 3.5), based on our legitimate interest in knowing where to spend our effort
• Security: detecting and preventing fraud, abuse, and unauthorized access
• Legal compliance: fulfilling our legal obligations and responding to lawful requests from authorities

6. Email Communications

We send emails to customers in the following categories:

Transactional Emails (Always Sent)

These emails are essential for license delivery and are sent regardless of preferences:

• License key delivery upon purchase
• Renewal reminders (30 days before license expiry)
• A link to your licence page when you ask for it, and a confirmation if you withdraw from a purchase
• Payment confirmations and billing issues
• Security alerts and critical service notifications
• Legal notices and Terms of Service updates

We do not send marketing emails. Emails are delivered through Cloudflare (section 10).

7. Legal Basis for Processing

We process personal data based on the following legal grounds, which are recognized by privacy regulations in many jurisdictions:

• Performance of a contract: processing necessary to deliver the Pro license you have purchased and to fulfill our contractual obligations to you
• Legitimate interests: processing necessary for our legitimate business interests, including security, fraud prevention, and service improvement, provided these interests are not overridden by your fundamental rights
• Legal obligation: processing necessary to comply with applicable laws, regulations, or legal proceedings
• Consent: where you have provided explicit consent for specific processing activities, which you may withdraw at any time

Where we rely on legitimate interests as a legal basis, we have assessed that our interests do not override your fundamental rights and freedoms, particularly given our privacy-by-design architecture that minimizes data collection and keeps all user workflow data local to the user's device.

8. Data Retention

We retain data for the following periods:

• Purchase and license data: retained for the duration of your license validity plus the period required by tax, accounting, and legal compliance obligations
• Email address: retained until you request deletion or until no longer needed for license management, subject to legal retention requirements
• Payment references: retained as required for tax, accounting, and legal compliance purposes
• Purchase records: kept for seven years from the end of the financial year in which the purchase was made (the Swedish Bookkeeping Act), and longer while a payment dispute is open
• Server logs: automatically deleted within 30 days
• Blocks of addresses that attacked the website: kept as a code computed from the address while the block lasts (up to 12 months, renewed if the address tries again), and deleted 30 days after it ends; the address itself stays on Cloudflare's block list for at most 30 days at a time while the block lasts (section 3.6)
• Notes of where a visitor arrived from: deleted after 24 hours
• Download records: kept for as long as we keep the website's download statistics

Upon receiving a valid deletion request, we delete or anonymize your data within 30 days, unless retention is required for legal compliance, dispute resolution, or enforcement of our agreements.

9. Data Sharing and Disclosure

We do not sell, rent, or trade your personal data to third parties. We may share data only in the following circumstances:

• Service providers: we engage third-party service providers who process data on our behalf to operate the Service. These providers are contractually bound to process data only as instructed by us and to maintain appropriate security measures.
• Legal requirements: we may disclose data when required by law, regulation, legal process, or governmental request, or when we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.
• Business transfers: in the event of a merger, acquisition, reorganization, or sale of assets, your data may be transferred as part of that transaction. We will notify you of any such transfer and any choices you may have regarding your data.
• With your consent: we may share data with third parties when you have given us explicit permission to do so.

10. Third-Party Services

The Service integrates with or relies upon the following third-party services:

• Hetzner Online GmbH: the hosting provider, based in Germany. The website's server and its database run in Hetzner's data centre in Helsinki, Finland, in the EU. See Hetzner's privacy policy.
• Cloudflare, Inc.: every request to respectaso.com passes through Cloudflare, which protects the website against attacks and abuse, delivers its files and provides the cookieless analytics described in section 3.4. Cloudflare also keeps the backup copies of the website's database, in its R2 storage in the EU, and delivers the emails the website sends, for which we share your email address and the message. Cloudflare therefore processes your IP address and the details your browser sends with each request, keeps the address of a visitor we have blocked on our block list (section 3.6), may receive a report from your browser when a page fails to load, and sets one security cookie (section 13). See Cloudflare's privacy policy.
• Stripe, Inc.: payment processing and subscription management. Stripe processes payment data in accordance with their privacy policy and PCI-DSS standards. We share only your email address and purchase details with Stripe as necessary to process payments. For Pro licences Stripe acts through Link as the seller of record for the payment and sends the receipt.
• Simple Analytics: website analytics for respectaso.com. This service operates without cookies and without collecting personal data. See their privacy policy.

The desktop application connects directly to Apple (the App Store, and Apple Ads if you connect it), GitHub's API, respectaso.com for Pro license checks, and optionally to LLM providers (OpenAI, Anthropic, Google, OpenRouter, or any OpenAI-compatible service you connect as a custom endpoint). With OpenRouter, the request is routed onward to the host of the model you select; with a custom endpoint, the request goes to the service whose address you entered. These connections are made from your device directly to those services, and your research data does not pass through our servers.

11. International Data Transfers

Our website infrastructure and database are located exclusively in EU member states.

Some third-party service providers we engage may process data outside the European Economic Area. Where such transfers occur, we use appropriate safeguards recognized under applicable privacy regulations, which may include adequacy decisions by relevant authorities, standard contractual clauses, binding corporate rules, or other legally recognized transfer mechanisms.

12. Data Security

We implement technical and organizational security measures designed to protect your data, including:

• Encryption of data in transit using TLS/HTTPS
• License keys signed with Ed25519 cryptographic signatures to prevent tampering
• Access controls and authentication requirements for system access
• Rate limiting and abuse prevention mechanisms
• Restrictive file permissions (600) for local API key storage in the desktop application
• Regular security reviews and updates

While we implement these measures, no method of transmission over the Internet or electronic storage is completely secure. We cannot guarantee absolute security of your data and you acknowledge this inherent limitation of data transmission and storage.

13. Cookies and Similar Technologies

This website sets at most two cookies, and both are strictly necessary:

• csrftoken: set by the pages that carry a form (the pricing page and the licence pages) to protect those forms against cross-site request forgery. It holds a random value and expires after one year.
• __cf_bm: set by Cloudflare (section 10) to tell people from automated traffic. It expires after 30 minutes.

We set no session cookie for visitors, and we use no tracking, advertising or analytics cookies.

Similar technologies: the free Interactive ASO Launch Checklist and ASO Localization Checker remember what you tick in your browser's local storage, so it is there when you come back. That data never leaves your browser, and clearing your browser data removes it. No other page stores anything in your browser.

14. Your Data Protection Rights

Depending on your location and applicable privacy regulations, you may have the following rights regarding your personal data:

• Right of access: you may request a copy of the personal data we hold about you
• Right to rectification: you may request correction of inaccurate or incomplete personal data
• Right to erasure: you may request deletion of your personal data, subject to legal retention requirements
• Right to restriction of processing: you may request that we limit our processing of your personal data in certain circumstances
• Right to data portability: you may request to receive your personal data in a structured, commonly used, machine-readable format
• Right to object: you may object to processing based on legitimate interests
• Right to withdraw consent: where processing is based on consent, you may withdraw that consent at any time
• Right to lodge a complaint: you have the right to lodge a complaint with a supervisory authority in your member state

To exercise these rights, please contact us using the information provided at the end of this document. We will respond to your request within the timeframes required by applicable law.

15. California Privacy Rights

For California residents whose personal information is subject to the California Consumer Privacy Act (CCPA), you have rights to know, delete, and opt-out of sales of your personal information. We do not sell personal information as defined by CCPA. To exercise CCPA rights if applicable, you can contact us by sending an email.

16. Children's Privacy

The Service is not directed to children under the age of sixteen, or under the age of digital consent in your jurisdiction, whichever applies. We do not knowingly collect personal data from children under these age thresholds. If you are a parent or guardian and believe that your child has provided us with personal data, please contact us immediately. If we become aware that we have collected personal data from a child without appropriate parental consent where required, we will take steps to delete that information.

17. Do Not Track Signals

Our website does not track individual users and therefore Do Not Track (DNT) signals have no practical effect on our data collection. We use Simple Analytics which is cookieless and does not track visitors across websites. Our privacy-by-design approach means we do not engage in the tracking behaviors that DNT signals are intended to prevent.

18. Automated Decision-Making

The Service does not engage in automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you.

19. Data Protection Officer

Given the nature and scale of our data processing activities, we have not appointed a formal Data Protection Officer. For all data protection inquiries, please contact us using the information provided below.

20. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When changes are made, we will update the "Last updated" date at the top of this page. We recommend that you review this page periodically to stay informed of any updates.

Your continued use of the Service after the updated date constitutes your acceptance of the revised Privacy Policy.

21. Contact Information

For questions about this Privacy Policy, to exercise your data protection rights, or for any other privacy-related inquiries, please contact us:

Loheden AI Solutions AB
Vretavägen 26
71993 Vintrosa
Sweden

Email: [email protected]