PRIVACY & YOUR DATA

Privacy notice

This notice covers the website, support and private beta. Public downloads and sales are not open.

Privacy notice — effective October 9, 2026.

Operator: Luma Harbor Software LLC, a North Carolina limited liability company. Effective date: October 9, 2026. Privacy requests: help@culltivar.com.

Scope and website browsing

This notice covers this website, support correspondence and the private beta. Public downloads and purchases are not open. Purchase-related processing below applies only when you use those functions; browsing this website does not create a trial, activation or subscription.

The website and browser demo use locally hosted sample photographs. The demo has no photo-upload feature. Its picks, stars, colors and framing choices stay in the current page session. We do not set analytics or advertising cookies, load tracking pixels, or collect newsletter signups on this site. AWS receives normal connection information to deliver the pages. If you email support, we receive your email address, message and any attachments you choose to send.

Your photos stay with you

Culltivar reads photos and metadata from the locations you choose and creates previews, caches, imports, exports and metadata changes on your computer or chosen storage. Photos, folder paths, face crops, ratings and XMP contents are not uploaded to Culltivar's licensing service. Mac face detection runs locally using Apple Vision to locate faces. It does not identify people or create a cloud face-recognition database. Export for Instagram produces JPEG files; it does not publish them to Instagram.

If you send a screenshot, photo or diagnostic file to support, that material is separate from ordinary app operation. Share only what you want support to see.

Trial, activation and device recovery

For these functions, the app sends a device public key, proof that it holds the matching private key, and the requested license operation. Activation and recovery also use your purchase key, platform and a computer display name. The default name is generic, such as “Mac.” You can choose a name during recovery; avoid including personal information you do not want stored.

The service stores a fingerprint of the device key, a hash of the purchase key, activation and trial dates, device names/platforms, recent validation times, removed-device records and device-security activity. It also stores payment provider IDs and subscription/payment status to enforce the two-computer limit, validate paid access, process refunds and prevent unauthorised recovery. It does not request a hardware serial number.

For lost-device recovery, Culltivar obtains the purchase owner's email from Lemon Squeezy and sends a verification code to that address. The licensing database stores keyed hashes for code, session and email checks, rather than plaintext email, codes or recovery sessions. Email providers necessarily process the recipient and message for delivery. The recovery code expires after ten minutes.

Purchases, hosting and updates

Lemon Squeezy handles checkout, payment details, billing addresses, tax and receipts as merchant of record, under its own privacy notice. Culltivar sends your purchase key to Lemon Squeezy when needed to verify a newly entered license, then checks its purchase/subscription status. The key is used transiently for verification; Culltivar's licensing database stores its hash. Full card numbers are not sent to Culltivar's licensing service or stored in its database.

AWS hosts the licensing service in the United States and handles website and update delivery, encrypted licensing backups and recovery email. Network connections expose ordinary connection information, including IP addresses, to the relevant service provider. The licensing application uses IP information for short-term rate limiting and does not write raw request bodies or raw IPs into its licensing database. Support email is handled by the operator's email provider, currently Google Workspace.

Mac update checks contact the update host. Automatic checks, automatic downloads and Sparkle system-profile reporting are disabled in the current app. A check or download still exposes normal HTTP connection information to its host. The current marketing website does not include analytics or advertising scripts in its authored pages. Payment pages and providers have their own practices.

We use this information to provide trials and paid access, maintain security, respond to support and meet applicable legal obligations. We do not sell photos or licensing records or use your photos to train an AI model. Information is shared with the providers above as needed to operate these functions, or when required by law. Provider processing may occur outside your country.

Where GDPR applies, requested trial, activation and paid-access processing is needed to provide the service under our agreement. We rely on legitimate interests for proportionate security, preventing repeat trials and unauthorized activations, and responding to ordinary support requests; legal obligations apply to records that must be retained by law. Local face detection is requested by you and stays on your storage. Licensing automatically checks eligibility, expiry and the two-computer limit; contact support to challenge an incorrect decision. We do not use photo/face data for identity or behavioral profiling.

International processing

We operate in the United States. AWS and Google may process information in the United States and other countries where they or their subprocessors operate. AWS's Data Processing Addendum includes standard contractual clauses for covered international transfers. Google's Cloud Data Processing Addendum sets out its processing, security and transfer arrangements, including the conditions under which standard contractual clauses or an alternative lawful transfer mechanism apply. Lemon Squeezy explains its own safeguards in its privacy notice.

Contact help@culltivar.com for information about the safeguards applicable to your data or a copy where available, with confidential information redacted where necessary. A provider's terms do not remove your rights under applicable privacy law.

Retention and your choices

You control photos and exports on your storage. Cached previews are local; you can manage them through Culltivar's cache settings.

Service cleanup is scheduled every 15 minutes. Expired challenges are removed; recovery requests are removed one day after their code and session expire, and recovery rate records after one day. Device-security activity and payment notification audit entries are retained for up to 90 days; count limits may shorten that history. Device names/platforms are cleared after 90 days of inactivity on an inactive activation, or 30 days after trial/paid access expires. Active valid computers keep their labels for computer management.

We retain minimum license, trial, payment and removed-device identifiers and decisions while needed to recognize existing keys, preserve entitlement and prevent repeat trials or unauthorized reactivation. These records remain pseudonymous personal data. We review that necessity at least annually and when handling your request. We do not keep unnecessary names or full activity history for the lifetime of a license. Cancelling renewal does not automatically delete minimum records or cancel a separate privacy request.

We review closed support correspondence and request audit notes two years after closure and delete material that no longer has a justified purpose. We remove temporary response extracts and working diagnostic files within 30 days after delivery/closure. Specific disputes or legal obligations may require limited records to remain longer; we record and review those exceptions. An earlier valid deletion request is assessed without waiting for these periods.

Customer-host system journals have a 14-day cap. Old private deployment-state copies are removed after 30 days unless an identified hold applies. Older versions of encrypted licensing backups expire after 30 days from being superseded; cloud expiration is asynchronous and the current backup persists. Backups may contain records removed from the active database until expiration. Privacy changes are recorded separately and reapplied before a backup is restored to service. Only the minimum identifiers needed to prevent a change being undone remain in that record, with annual necessity review.

Contact help@culltivar.com to request access, correction, deletion or other rights available under applicable law. We will verify ownership before disclosing or changing licensing records, explain any required retention and explain how deletion affects activation or recovery. Cancelling payment renewal is a separate action in Lemon Squeezy's billing portal. Payment-provider records are also governed by that provider's notice and legal obligations.

Where applicable, your rights include access, correction, erasure, restriction, portability and objection to processing based on legitimate interests. If we rely on consent, you can withdraw it without affecting earlier lawful processing. You may complain to the relevant data-protection authority. We respond within applicable deadlines; where GDPR applies this is normally one calendar month. We explain any lawful exception rather than treating every licensing record as automatically exempt from deletion. Providing licensing information is needed for trial/paid activation; without it we may be unable to offer those functions.

Changes to this notice

We will update the date above when this notice changes and provide additional notice of material changes where required. Questions and privacy requests can be sent to help@culltivar.com.