Last updated: 12 October 2026
This policy explains which personal data we process when you visit enzisoft.com, create an account, buy a package, or install packages through our package registry (upm.enzisoft.com) and the Enzisoft Package Manager in Unity, why we do it, and what rights you have.
Who is responsible
Thomas Enzenebner e.U. (Enzisoft), Wiesenstraße 8/4, 4591 Molln, Austria · enzisoft@gmail.com · +43 660 7058510. See also the Imprint.
Hosting and server logs
The website, the store and the registry run on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in its data center in Falkenstein, Germany, under a data processing agreement.
When you open a page, our web server records your IP address, date and time, the requested address, the referring page and your browser's user agent. We use these logs to run the service and to detect attacks (legitimate interest, Art. 6(1)(f) GDPR) and delete them after 14 days.
Cookies
These cookies are needed for the website to work, so they don't require consent (§ 165(3) TKG 2021):
| Cookie | Purpose | Lifetime |
|---|---|---|
nz_consent |
remembers your choice in the cookie banner | 1 year |
nz_session |
keeps you signed in to your account | 30 days after your last visit, or until you sign out |
nz_external, .AspNetCore.Correlation.* |
protect sign-in with Google or GitHub | a few minutes |
.AspNetCore.Antiforgery.* |
protects forms against forgery | until you close the browser |
Google Analytics sets its own cookies only if you accept them (see below).
Google Analytics
If you click "Accept" in the cookie banner, we use Google Analytics 4 by Google Ireland Limited, Gordon House, Barrow
Street, Dublin 4, Ireland, on all pages of enzisoft.com, including the store. It sets the cookies _ga and
_ga_4MRZQFBM9G (up to 2 years) and receives information about your device and browser, the pages you visit and how
you use them. Google Analytics 4 does not store IP addresses. We use the reports to see which pages and packages
interest visitors. Google Analytics deletes event data after 2 months and user data after 14 months.
Basis: your consent (Art. 6(1)(a) GDPR, § 165(3) TKG 2021). If you click "Reject", Google Analytics doesn't load at all. You can change your choice at any time with "Cookie settings" at the bottom of every page; withdrawing deletes the Google Analytics cookies. Google may process the data in the USA; Google LLC is certified under the EU-US Data Privacy Framework.
Your account
You can sign in with Google, with GitHub, or with a link we email you. We store:
- your email address(es) and whether they are verified;
- for Google or GitHub sign-in: that provider's ID for your account and the email address it reports (we don't store your name or profile);
- the date your account was created.
Google (Google Ireland Limited, Ireland) or GitHub (GitHub, Inc., USA) receive the sign-in request when you choose them; their own privacy policies apply. Sign-in emails are sent through Brevo (Sendinblue SAS, 17 rue Salneuve, 75017 Paris, France) under a data processing agreement.
We process this data to provide your account and the packages you bought (contract, Art. 6(1)(b) GDPR) and keep it until you ask us by email to delete your account.
Unity Editor and package downloads
When you sign in from the Enzisoft Package Manager in Unity, we store your computer's name (to label the device in your account), the date the device signed in and when it was last used. You can see and revoke your devices at /account/devices. The access token itself is stored only on your computer; we keep only a hash of it.
When you download a package while signed in, from Unity or from the website, we log the package and version, the time, your account, your IP address and your user agent. We use this log to enforce licenses and to handle abuse, fraud and payment disputes (legitimate interest, Art. 6(1)(f) GDPR). Downloads without an account (free packages) are only counted, without IP address or user agent. Entries are deleted after 2 years.
Purchases
Our online reseller Paddle.com (Paddle.com Market Limited, Judd House, 18-29 Mora Street, London EC1V 8BT, United Kingdom) is the Merchant of Record for all our orders. When you buy, you enter your payment details directly at Paddle, which processes them as a separate controller under its own privacy policy. Product pages of paid packages load Paddle's checkout script, so Paddle receives your IP address when you open them; if you are signed in, we pre-fill your email address in the checkout.
From Paddle we receive your customer ID, email address, whether you agreed to receive product news, and the details of your purchases (package, date, transaction IDs, refunds). We use them to grant your licenses and downloads (contract, Art. 6(1)(b) GDPR) and keep them as long as you have a license, because licensed releases remain yours permanently.
Product news
If you tick the box at checkout, we may email you about new packages and updates, sent through Brevo (see above). Every email has an unsubscribe link; we keep the addresses that unsubscribed so we don't write to them again. Basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time. To count how often the emails are opened and their links clicked, they contain a tracking pixel and tracked links; Brevo records this anonymously, without linking it to you.
Videos on product pages
Product videos come from YouTube (Google Ireland Limited; in YouTube's privacy-enhanced mode) or Vimeo (Vimeo.com, Inc., USA). They load only when you click "Play video"; from then on the provider receives your IP address and may set cookies, under its own privacy policy. Basis: your consent by clicking (Art. 6(1)(a) GDPR).
Blog comments
When you comment on a blog post, we store your name, email address, optional website, the comment and the time. Comments are published only after we approve them; then your name, website and comment are public, your email address isn't. Basis: legitimate interest in offering comments (Art. 6(1)(f) GDPR). We keep comments until they or the post are deleted; ask us by email to delete yours.
Published comments show an avatar from Gravatar (Automattic Inc., USA): your browser loads it from gravatar.com using a hash of the commenter's email address, so Gravatar receives your IP address when you read a post with comments.
Transfers outside the EU
Paddle is in the United Kingdom, which the EU recognises as providing adequate protection. Where a provider is in the USA (Google, GitHub, Vimeo, Gravatar), the transfer relies on the EU-US Data Privacy Framework or the EU Standard Contractual Clauses.
Your rights
You have the right to access your data, to have it corrected or deleted, to restrict or object to its processing, to receive it in a portable format, and to withdraw any consent at any time. Write to enzisoft@gmail.com. You can also complain to the Austrian data protection authority (Datenschutzbehörde, Barichgasse 40-42, 1030 Wien, www.dsb.gv.at) or the authority where you live.
Security
All connections use HTTPS. Sign-in links expire after 30 minutes, and access tokens are stored only as hashes.
Changes
We update this policy when our services change. The date at the top shows the current version.