Privacy policy — CPH HVAC Studio Engineering Tools
Last updated: 2026-11-10
This policy covers this website (tools.cphhvacstudio.dk), your account (account.cphhvacstudio.dk), our licence and update service (api.cphhvacstudio.dk) and the programs of CPH HVAC Studio Engineering Tools. The company website cphhvacstudio.dk has its own privacy policy.
1. Data controller
CPH HVAC Studio ApS, CVR no. 46603796, Gyngemose Parkvej 56A, 2. th, 2860 Søborg, Denmark. Questions about data protection: office@cphhvacstudio.dk.
2. This website
This website sets no cookies, uses no analytics and loads no third-party scripts, except on the Buy step, where Paddle's checkout runs (see section 6). Our hosting provider records ordinary server logs (IP address, time, page, browser) for operation and security; they are deleted after three weeks.
3. Your account
To sign in we use your e-mail address and send a sign-in code to it; the code is deleted after 24 hours, together with the program and the device label that asked for it. We store your e-mail, the language of our e-mails to you and the date of your last sign-in. The account uses three cookies: __Host-cph — your session in the account, until you sign out, at most 14 days; __Host-cph-pre — protection of the forms before you sign in, until you close the browser; __Host-cph-lang — the language you choose before signing in, one year, set when you choose a language. These cookies are necessary for the account or store your own choice; they need no consent. In the account we keep your licences and their "valid until" dates, purchases (without amounts) and the edition of the Terms of Service of each purchase (date, language and fingerprint, Terms of Service, section 5), the company name from the order and the seats your company has assigned — including the e-mail of the person a seat is assigned to. When a company assigns a seat to you, our e-mail tells you which company did it and links to this policy.
We send only service e-mails: sign-in codes, e-mails about your licence and its renewal, security notices and replies to you. We send no marketing e-mails without your separate consent.
Cancelling without signing in. In the cancellation form, you enter the e-mail address of your account. If an account has that address, we cancel its subscriptions that renew, send the confirmation there and keep the request — which subscriptions, their state and the dates — for 24 months. For an address without an account, we keep nothing and send nothing. If you end a licence early in your account, we keep the dates, the months and the amounts refunded with your account.
Education applications. You apply in your account with your first and last name, your educational institution and its country, your role there, your study programme and the expected end of your studies (if you are a student), the programs and your confirmation that you will use the licence only for teaching, learning or non-commercial research. We check the application by the address you sign in with, if it is your institution's, or by a document such as a student card, which you send to office@cphhvacstudio.dk. We keep the application until we have decided and for 24 months after; the document is deleted from our mailbox once it is checked.
4. The programs
- Without Pro or a trial, a program contacts our server only to check for updates — the request names only the program — and when you act yourself: signing in, opening Account & license, starting a trial, downloading Pro or reporting a problem. The weekly update check can be switched off.
- With Pro or a trial, the program contacts the server at the start and about once an hour while you work. It sends a hash of the computer's identifier, the device label you have chosen, the program, its version and whether the Pro version is installed. It never sends the Windows name of your computer. Your account shows the device label, and for a seat activated offline the company that owns the seat sees it too. We keep only the current session with the device label, the time of the last check and the number of moves per day.
- Trials: a hash of the computer's identifier, the program, the dates and the account — so that each computer and each account gets one trial per program. No device label and no computer name.
- Your projects never leave your computer, except in a problem report that you choose to send.
5. Problem reports
A report is sent only when you send it, with your consent for each report: in a program, Help → Report a problem… opens it. It contains technical data — version, Windows, language, interface scale, Free, Pro or trial, where the error happened, the end of the error log and the program's messages with names removed, and the names of the latest commands without any values — and, if you choose, a description, your e-mail, a screenshot of the program window and the project file without names or in full. You see everything before it is sent. We do not store your IP address with the report. Automatic crash reports are off unless you switch them on; then they are sent without asking each time, contain technical data only and can be switched off at any time. You can delete a report yourself at any time, without signing in, at account.cphhvacstudio.dk/report with its number and the deletion key the program shows you.
6. Purchases through Paddle
Paddle.com is the Merchant of Record for our sales and an independent controller for the purchase; it processes payment and tax data under its own privacy notice. From Paddle we receive the customer, subscription and transaction identifiers, your e-mail, name and company name. Payment-card details are not stored by us: Paddle's notifications are redacted on receipt, and we never receive the full card number. Paddle.com Market Limited is in the United Kingdom, which the EU has recognised as providing adequate data protection.
7. Purposes and legal bases
- Account, licences, purchases with the edition of the Terms of Service, delivery of Pro and e-mails about your licence — contract, GDPR Article 6(1)(b).
- Cancellation requests, early termination and education applications — contract and steps taken at your request before a contract, Article 6(1)(b).
- Seats assigned by your company — our contract with your company and legitimate interest, Article 6(1)(f).
- Security, prevention of misuse (one trial per computer, limits on sign-in attempts), server logs and backups — legitimate interest, Article 6(1)(f).
- Problem reports and automatic crash reports — consent, Article 6(1)(a). You can withdraw it at any time.
Our assessments of the legitimate interests are documented and available on request.
8. Recipients and processors
- Simply.com A/S, also trading as team.blue Denmark A/S, CVR no. 29412006, Højvangen 4, 8660 Skanderborg, Denmark — hosting of the website, the account and the licence service, sending of e-mails and Simply's daily backup; servers in Denmark; sub-processors B4Restore (backup, Denmark) and Webnode (Czech Republic).
- Google Cloud EMEA Limited, Velasco, Clanwilliam Place, Dublin 2, Ireland — our e-mail (Google Workspace); e-mails about licences, problem reports and the documents of education applications reach us there.
- Paddle — see section 6.
We do not sell personal data and use none for advertising.
9. Transfers outside the EU/EEA
Google may process data in the USA on the basis of the EU-US Data Privacy Framework and, alternatively, the European Commission's standard contractual clauses. Paddle.com Market Limited is in the United Kingdom, under the EU's adequacy decision (section 6).
10. How long we keep data
| Data | Kept |
|---|---|
| Account | while it exists; an account with no seat or trial still running is deleted when 24 months have passed both since the last sign-in and since the end of its last licence — with its purchases and early terminations; the account of a company's administrator stays while the company exists; an invited account without a seat, after 30 days |
| Company (its name, administrators and seats, and who holds them) | while it exists; a company whose licences have all ended is deleted when 24 months have passed both since the last sign-in of its administrators and since the end of its last licence — with its purchases, its seats and the accounts of its administrators that hold nothing else |
| Purchases with the edition of the Terms of Service (date, language, fingerprint) | while the account or company that made them exists |
| Sign-in codes, with the program and device label that asked | 24 hours |
| Sessions in the account (web) | 2 days without activity, at most 14 days |
| Signed-in devices | 180 days without use |
| Device label and hashed identifier of the computer where Pro runs now | until the seat ends, at most 180 days without a check |
| Trials (a hash of the computer's identifier) | 24 months after the end of the trial; for a trial requested but never started, 24 months after the request; the hashed identifier only |
| Problem reports | up to 12 months; a report closed without a confirmed bug, 3 months from that decision; your e-mail until we have told you about the fix; you can delete your report yourself at any time |
| Counters against misuse (keyed hashes of IP address or e-mail) | 24 hours |
| Sent e-mails | the text is erased when sent; address and subject 7 days after sending |
| Order events from Paddle | content 30 days after redaction of the payment details (longer while not yet processed); the record of the event (identifiers, type, dates) 13 months |
| Cancellation requests made with the form | 24 months; nothing for an address without an account |
| Early termination of a licence (dates, months and amounts refunded) | while the account exists |
| Education applications | until we have decided and 24 months after; a document sent by e-mail until it is checked |
| Server logs | three weeks |
| Backups | Simply's daily backup 30 days |
| Records of our support actions on an account | 24 months |
11. Your rights
You have the right of access, rectification, erasure, restriction and data portability, and the right to object to processing based on legitimate interest. In your account you can download your data ("Download my data (JSON)") and delete the account ("Delete account"; the purchase itself remains with Paddle). If your company assigned you a seat, you received this policy with the invitation e-mail. Write to office@cphhvacstudio.dk for anything else. We answer within one month. You can complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, dt@datatilsynet.dk, www.datatilsynet.dk.
12. Changes
We may update this policy. The current version is on this page with the date of the latest update.