Personal data protection
Regulation (EU) 2016/679 (GDPR) and the Luxembourg law of 1 August 2018. Last updated: 14 September 2026.
1. The principle
DriveMirror works between your computer and your storage provider. Your files' content goes straight from one to the other: it is never sent to AMS Studio or to anyone else, and your S3 keys stay encrypted on your PC. The software contains no analytics, no advertising identifier, no account to create. We process personal data only to sell you a licence, deliver it, offer you updates — and, on the Business plan, to run locking between PCs and fleet administration.
2. Data controller
AMS STUDIO S.à.r.l., 87, Route d'Esch, L-4450 Belvaux, Luxembourg — contact@ams-studio.lu. The company is not required to appoint a data protection officer; the manager acts as the point of contact.
3. What we process, why, and on what basis
| Processing | Data | Legal basis (art. 6 GDPR) | Retention |
|---|---|---|---|
| Purchase of a licence (Stripe) | Name, e-mail address, billing address, country, VAT number where applicable, last four digits and type of the card (the full number is known only to Stripe) | Performance of the contract (b); accounting and tax obligations (c) | 10 years from the close of the financial year (art. 16 of the Luxembourg Commercial Code) |
| Issuing and delivering the licence key | E-mail address, signed licence key, issue date, order reference | Performance of the contract (b) | Term of the licence, then 10 years with the accounts |
| Licence check (Pro, Business) | Licence key, installation identifier (irreversible fingerprint of the machine, with no name or address) | Performance of the contract (b); legitimate interest: preventing a licence from being used on more machines than intended (f) | Duration of the licence |
| Lock service (Business plan) | Name of the locked file, PC identifier and name, licence identifier, lock set and expiry dates — never a file's content, never your S3 keys | Performance of the contract (b) | For the life of the lock, then technical logs for 30 days at most |
| Fleet administration (Business plan) | Name and e-mail address of each enrolled employee, provided by the administrator, assigned profile, issue and revocation dates, PC name | Performance of the contract (b) and the employer's legitimate interest in administering its seats (f) | Term of the Business licence, then 12 months |
| Folder watching (Business plan) | PC name attached to uploaded files (S3 metadata at your provider), paths of changed files notified to the other PCs | Performance of the contract (b) | As long as the file exists at your provider |
| Update check | Software and Windows version, IP address (processed by Cloudflare for the duration of the request, not retained by us) | Legitimate interest: security and maintenance (f) | Technical logs, 30 days at most |
| Service e-mails | E-mail address, content of the e-mail (licence key, enrolment token) | Performance of the contract (b) | Sending logs, 30 days |
| Support requests | What you write to us, and your contact details | Legitimate interest: replying (f) | 3 years after the last exchange |
| Promotional offers inside the software | No personal data: the software reads a public offers file and sends nothing | — | — |
4. What we do not do
We do not sell or rent any data. We do no profiling. We send no marketing without your consent: news about new versions lives in the software, not in your inbox. We do not knowingly collect any data from minors.
5. Your S3 credentials and your provider
Your S3 access keys are encrypted on your PC by Windows (DPAPI), bound to your user account, and never leave your computer: we do not receive them and therefore cannot access your storage. On the Business plan, enrolled employees mount their drives without ever seeing those keys. Your files' content is exchanged directly between your PC and the provider you chose; that processing is governed by that provider's terms, with whom you have contracted.
6. Processors and transfers outside the European Union
Stripe Payments Europe (Ireland) for payment; Cloudflare (European servers, a US company) for the licence service, the lock service, the fleet and hosting. These providers are bound by the GDPR by contract (art. 28). Where data may transit to the United States, the transfer relies on the adequacy decision for the EU–US Data Privacy Framework for providers certified under it, and on the European Commission's standard contractual clauses for the others.
7. Your rights
You may request access to your data, its rectification or erasure, restriction of processing, portability, and object to processing based on legitimate interest — by e-mail to contact@ams-studio.lu. We reply within a month. You may also lodge a complaint with the National Commission for Data Protection (CNPD), 15 boulevard du Jazz, L-4370 Belvaux, cnpd.public.lu, or with the authority of your country of residence.
8. Security
Licence keys are signed (ECDSA P-256) and verified offline; the private key is never on a PC. S3 keys are encrypted by Windows on the PC. The lock service only accepts PCs holding a valid licence. Exchanges with our services are encrypted (TLS). The software and its installer are signed in the name of AMS STUDIO S.à.r.l. and timestamped.
9. Changes
This policy may evolve with the software. The date at the top is authoritative; a substantial change is announced in the release notes.