Privacy Policy

Version of September 23, 2026

This policy explains in plain language what information OOO «SOFTMUS» ("we") receives about you when you use https://the-done.app and https://licenses.the-done.app and buy or activate Done licenses, and how we use and protect it. The formal details required by Russian Federal Law No. 152-FZ on Personal Data — legal grounds, retention periods, how requests are handled — are set out in the Personal Data Processing Policy. In case of discrepancy between the Russian and English versions, the Russian version prevails.

The short version

The data you keep in Done stays with you. Information about employees, projects, working time and finances is stored in your own Nextcloud installation. We have no access to it and never receive it.
We need very little: your e-mail address, your purchases and technical activation data — to sell you a license and provide keys and updates.
We never see your card details: payments are processed on the secure pages of the Robokassa payment service.
We do not sell data, show ads or use third-party trackers.

What we receive

When you buy a license:

your e-mail address — we send the key, the receipt and the sign-in details to it;
order details: plan, term, amount, currency, promo code used, payment date and status, the transaction number in the payment service;
a record that you accepted the offer and consented to personal data processing, with the versions of the documents.

When you use the Customer Portal:

your login and a hash of your password — if sign-in with a login and password is enabled (we never store the password itself);
your interface language and sign-in dates;
the labels you give to activations.

When you activate Done in Nextcloud:

the license key, the installation identifier (an anonymized fingerprint), the server host name, and the versions of Nextcloud, Done and PHP;
during the daily license check — the versions of Nextcloud and Done.

When you contact support — your e-mail address and whatever you tell us.

When you simply visit the website — your IP address, browser details, and the date and time of the request. These go into the server's technical logs and help protect against abuse.

How we use the information

to process your purchase, issue license keys and send receipts;
to give you access to the Customer Portal, distributions and updates;
to bind a key to a server and check that the license is used according to its terms;
to answer your requests and handle claims and refund requests;
to send service e-mails about your license and account security;
to keep accounting and tax records as required by law;
to keep the websites running and secure.

We do not send marketing e-mails. If we ever start, it will only be with your separate consent and with an unsubscribe link in every e-mail.

Who we share information with

Only those we cannot do without, and only as much as they need:

the Robokassa payment service — the amount, the payment description and your e-mail address for the receipt; it processes payer data as an independent operator;
our hosting provider — the server running the website and storing the data is located in the Russian Federation;
our e-mail delivery service — the recipient's address and the text of a message, to deliver service e-mails;
government authorities — only in the cases and in the manner prescribed by law.

We never sell your data or share it for marketing.

Where and how the information is stored

Data is stored on servers in the Russian Federation. The database is encrypted: each record is encrypted separately, and the encryption key is kept apart from the data, so a copy of the database is unreadable without the key. Connections to the websites are protected by HTTPS. Passwords, one-time links and session tokens are stored only as hashes. Staff access to data is restricted by role, and actions in the administration panel are logged.

The copies of Done you download under a license may carry a hidden marking — an identifier that links the copy to your purchase. The marking contains no personal data and protects against unlawful distribution.

How long we keep the information

purchase and license records — for as long as the license agreement is in effect and 3 years after it ends;
payment records — at least 5 years, as required by accounting and tax law;
support correspondence — 3 years after the request is closed;
server technical logs — up to 12 months.

Cookies and browser storage

The websites do not use advertising cookies or third-party analytics. Your browser stores only the Customer Portal session token and interface settings (language, theme). They are needed for the website to work and are not used for tracking. If you clear them, you will need to sign in again.

Your rights

You can find out what information we process about you, ask us to correct or delete it, withdraw your consent to processing, and appeal our actions to Roskomnadzor (the Russian data protection authority) or in court. Some information (for example, payment records) must be kept by law even after consent is withdrawn. How to send a request is described in Section 7 of the Personal Data Processing Policy.

Children

The websites and Done are intended for organizations and professionals. We do not knowingly collect information about persons under 18.

Changes to this policy

We update this policy when our services or the law change. The current version is always available at https://licenses.the-done.app/legal/en/privacy, with its date shown at the top of the page. We will notify customers of material changes by e-mail.

Contact

OOO «SOFTMUS», INN 3900002327, OGRN 1223900010784
ul. Minusinskaya, 22, 263, Kaliningrad, Kaliningrad Region, 236005, Russia

Privacy and personal data questions: hello@the-done.app