ACE Privacy Policy
Last Updated: 09/21/2026
1. Introduction
This Privacy Policy explains how Veltace ("we", "us", "our") processes personal data through the ACE website (https://ace-software.net), customer portal, hosted license service, and support channels (collectively, the "Online Services"). In this policy, Online Services means only those Veltace-operated online functions; it does not mean the self-hosted ACE automation Server running on a customer's infrastructure.
ACE is operated from the Slovak Republic (European Union). This policy is intended to provide the information required by the General Data Protection Regulation (GDPR) (EU) 2016/679, applicable Slovak data-protection law, and other privacy or electronic-communications rules that apply to a particular person or processing activity, in each case as amended or replaced.
Self-hosted product boundary: The ACE automation Server and its operational data run on the Licensee's own machine or infrastructure. That local data is not automatically sent to Veltace, and ACE does not give Veltace built-in remote access to it. This policy covers the separate Online Services. If you choose to send diagnostics, configuration, or other local data to support, we process that submitted copy as support-request data; doing so does not give us continuing access to the self-hosted environment.
Processor terms: Standard self-hosted ACE does not ordinarily require a data processing agreement with Veltace because Veltace does not process the data inside the customer Server. If a separately contracted service requires Veltace to process personal data on a customer's documented instructions, appropriate service-specific processing terms will be agreed before that processing begins.
2. Data Controller
The data controller for the personal data described in this policy is:
Veltace s. r. o.
Registered office: Karpatské námestie 7770/10A, 831 06 Bratislava, Slovak Republic
Company ID (IČO): 57 828 725
Commercial register: Registered in the Commercial Register of Mestský súd Bratislava III, Section: Sro, File No.: 203257/B
Privacy contact: [email protected]
Support: https://support.ace-software.net
3. Data We Collect
We collect and process a minimal amount of personal data, limited to what is necessary to provide the Services:
3.1. Data You Provide Directly
| Data | Purpose |
|---|---|
| Name | License management and account identification. |
| Email address | Obtained directly or through Stripe in connection with a purchase and used for account, license, billing, and transactional communications. |
| Username and password | Authentication for the ACE customer portal. Passwords will be stored only as salted, one-way hashes. Plaintext passwords will not be stored. |
| Purchase classification and business billing identity | Before checkout, you choose personal or business use. For a business purchase we process the business country; for a business in Slovakia we also require the 10-digit DIČ. We use this information to correlate billing records and, where applicable, validate and route electronic invoices. |
| Business voicemail | If you leave a voicemail, we process the audio recording and the information you provide, such as your name, ACE Customer ID, email address, and message, to identify you, handle administrative, contractual, or legal matters, and respond where appropriate. |
3.2. Data Generated Automatically
| Data | Purpose |
|---|---|
| Session cookie | Essential cookie used to maintain your authenticated session on the ACE website. No tracking or profiling purpose. |
| License metadata | License activation status, license edition, license expiration date, and environment name(s). Used solely for license management and enforcement. |
| Online-service technical records | The website and hosted license infrastructure may record IP address, request date and time, requested URL, response status, user agent, and security events for delivery, troubleshooting, abuse prevention, and security. These are not logs from the customer's self-hosted ACE Server. |
| Support-request data | Messages, attachments, diagnostics, and contact details you choose to provide when requesting support. |
| Analytics data | With consent, Google Analytics and Metricool may process online identifiers and website usage information such as pages visited, visit duration, browser and device type, and approximate location derived from network information. See Section 9. |
3.3. Data We Do NOT Collect
- We do not store payment card numbers, bank account details, or any financial instrument data. All payment processing is handled exclusively by Stripe.
- We do not automatically collect operational data or logs from a Licensee's self-hosted ACE Server. We process a copy only if a user deliberately submits it to support or another Online Service.
- We do not build personal profiles, sell personal data, or use personal data for advertising.
4. Purposes of Processing
We process personal data for the following purposes:
- Service delivery — authenticating your account, managing your license, delivering the Software.
- Billing and e-invoicing — processing subscription payments, managing upgrades, downgrades, and renewals via Stripe, correlating business billing identity, and validating or routing structured electronic invoices where applicable.
- Transactional communications — sending license keys, renewal reminders, and order confirmations by email.
- Business communications — receiving and handling administrative, contractual, or legal inquiries, including voicemail messages, identifying the relevant customer or matter, and responding where appropriate.
- Analytics — understanding website usage patterns to improve the Services (only with consent).
- Security and fraud prevention — detecting unauthorized access, preventing abuse, and protecting the integrity of the Services.
- Legal compliance — fulfilling obligations under applicable tax, accounting, and regulatory requirements.
5. Legal Basis for Processing (GDPR)
| Legal Basis | Data & Purpose |
|---|---|
| Performance of a contract (Art. 6(1)(b)) | Account credentials, license metadata, email address, and business correspondence where necessary to enter into or perform a contract, deliver the Services, or administer the customer relationship. |
| Legitimate interest (Art. 6(1)(f)) | Security, fraud prevention, Online Service reliability, necessary website/license-service logging, and business correspondence including voicemail where applicable — our legitimate interests in protecting and operating the Online Services, handling business matters, and establishing, exercising, or defending legal claims, balanced against your rights and freedoms. |
| Consent (Art. 6(1)(a)) | Google Analytics and Metricool analytics technologies — enabled only after you make an affirmative choice through our cookie banner. You may withdraw consent at any time. |
| Legal obligation (Art. 6(1)(c)) | Billing, accounting, and business correspondence where processing or retention is required to comply with applicable law. |
6. Recipients and Service Providers
We disclose personal data only as necessary to operate the Services, comply with law, or protect legal rights. Categories of recipients include:
- Google Analytics (Google Ireland Limited and relevant Google affiliates) and Metricool (Metricool Software, S.L., Spain) for consent-based website analytics.
- Hostinger International Ltd., Cyprus, for VPS hosting, VPS disk storage, and provider-managed backups. See Hostinger's Privacy Policy.
- Cloudflare, Inc., United States, for DNS, reverse proxy, network protection, and delivery. See Cloudflare's Privacy Policy.
- Namecheap, Inc., United States, as domain registrar. See Namecheap's Privacy Policy.
- Zoho Corporation B.V., Netherlands, using Zoho's EU service region for business email and customer support, with limited group or support access where permitted under Zoho's safeguards. See Zoho's Privacy Policy.
- Stripe's applicable EEA entities, principally Stripe Payments Europe, Limited and Stripe Technology Company, Limited in Ireland, and relevant regulated Stripe entities where required, for payment processing, subscription billing, fraud prevention, and the billing portal. See Stripe's Privacy Center.
- Kaja Solutions s.r.o. (ePošťák), Slovakia, for structured electronic-invoice validation, Peppol routing and delivery, inbound receipt, and related delivery evidence where applicable. Only the business and invoice data needed for that integration is sent. See ePošťák's privacy information.
- Amazon Web Services EMEA SARL, Luxembourg, for transactional email delivery through Amazon SES and the resulting delivery identifiers, covering order confirmations, licence delivery, withdrawal acknowledgements and decisions, and refund confirmations. Messages are processed in the AWS Europe (Stockholm) region,
eu-north-1. See the AWS Privacy Notice. - Telephony and voicemail service providers used to receive, transmit, and store business voicemail messages and related call-service data.
- Professional advisers and authorities where disclosure is necessary for legal compliance or the establishment, exercise, or defense of legal claims.
We do not sell personal data. Providers process data under their own applicable terms and, where they act as our processors, under contractual data-protection obligations.
These providers are processors or recipients for Veltace's Online Service activities where applicable. They are not automatically a Licensee's sub-processors, because Veltace is not processing the Licensee's self-hosted ACE data merely by operating the website, portal, licensing, analytics, payments, or support channels.
7. International Transfers
Some providers may process personal data outside the European Economic Area. We use EEA-based service regions where reasonably available, including Zoho's EU region, EEA-based Stripe entities, and the AWS Europe (Stockholm) region for transactional email. Hostinger may process data in Cyprus, Lithuania, the Netherlands, the United Kingdom, or other locations needed to provide its services. Cloudflare, Namecheap, Google, Stripe, Zoho, and their approved affiliates or sub-processors may process limited data in other countries. Where Chapter V of the GDPR applies, transfers rely on an applicable adequacy decision, an eligible recipient's participation in the EU-U.S. Data Privacy Framework, the European Commission's Standard Contractual Clauses, or another lawful safeguard, together with supplementary measures where appropriate. Copies or information about applicable safeguards may be requested through the privacy contact above.
8. Retention
| Data Category | Retention |
|---|---|
| Account data | For the life of the account and up to 30 days after closure to complete deletion, export, fraud-prevention, and dispute-handling steps. Residual copies may remain in restricted backups for up to an additional 90 days, except where a documented legal hold or legal obligation applies. |
| License metadata | For the active license and generally up to 12 months afterward for reactivation, support, and dispute handling. |
| Consent, withdrawal, refund, invoice, and credit-note records | A checkout consent receipt records the exact accepted statement versions and their wording, the language you selected, and the time of acceptance. Unattached consent receipts — those never tied to a completed order — are deleted automatically 30 days after they are created. Once attached to an order, the receipt and the related withdrawal, refund, and email-delivery records are kept with the billing and accounting records below. Records of which Stripe events have already been processed are kept for 400 days so that a replayed event cannot be applied twice. |
| Billing and accounting records | For the period required by applicable tax and accounting law, generally 10 years where Slovak law applies. |
| Business billing identity and e-invoice evidence | For the period needed to administer the transaction and satisfy applicable accounting, tax, e-invoicing, audit, dispute, or legal requirements. Data is minimized or removed when those purposes and any required retention period end. |
| Website and hosted license-service technical records | Routine access and application records are generally retained for up to 30 days; security, abuse-prevention, and incident records may be retained for up to 12 months; relevant records may be preserved longer for a documented incident, legal obligation, or legal claim. This does not include logs on a customer's ACE Server. |
| Support-request data | For the support relationship and up to 24 months after the support request is closed, with longer retention only where requested or needed for security, a legal obligation, or a legal claim. |
| Business voicemail recordings | For as long as reasonably necessary to identify and handle the administrative, contractual, or legal matter for which the message was left. The recording is then deleted unless longer retention is required by law or reasonably necessary for an unresolved dispute or the establishment, exercise, or defense of legal claims. |
| Analytics data | Google Analytics user-level and event-level data is configured for 14 months. Metricool's website tracker provides aggregated visit statistics and does not store visitor IP addresses; Veltace retains the resulting aggregated reports for up to 24 months. You may withdraw consent at any time. |
Retention may be extended where required by law, a legal hold, or an unresolved dispute. Data is deleted or anonymized when no longer required.
10. Your Data-Protection Rights
Subject to the conditions and exceptions in applicable law, you may request access, rectification, erasure, restriction, or portability of your personal data, and may object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it at any time.
Submit a request to [email protected]. We may request information reasonably necessary to verify identity and authority. We normally respond within one month under the GDPR, subject to any lawful extension.
You may lodge a complaint with the supervisory authority where you live, work, or where an alleged infringement occurred. In Slovakia, the supervisory authority is the Office for Personal Data Protection of the Slovak Republic.
11. Security
We implement appropriate technical and organizational measures to protect your personal data:
- Encryption in transit — All communications between your browser and our servers are encrypted using SSL/TLS.
- Protection at rest — Online Service data is kept in access-controlled hosting. Administrative access is limited to authorized accounts, credentials and secrets are kept out of public source code, provider-managed backup and storage safeguards are used where configured, and Veltace does not store payment card numbers.
- Access controls — Access to personal data is restricted to authorized personnel only, on a need-to-know basis.
12. Required Data and Automated Decisions
Account, contact, license, and billing information marked as required is necessary to create or administer an account, deliver a license, or complete a transaction. For a business purchase, business country is required; a Slovak business purchase also requires one IČO, DIČ, or IČ DPH for billing or e-invoice identity. If required information is not provided, the relevant Service may be unavailable. If you leave a business voicemail, the requested name, customer ID, and email address help us identify the customer or matter and respond; without sufficient identifying or contact information, we may be unable to process or answer the message. Optional analytics consent is not required.
We do not make decisions based solely on automated processing that produce legal or similarly significant effects on individuals. Automated security or license checks may restrict a session or feature; you may contact support to request review.
13. Children and Policy Changes
The Services are not directed to children under 16, and we do not knowingly collect their personal data. Contact us if you believe a child has provided personal data.
We may update this policy to reflect changes in law, providers, or processing. We will post the revised policy with a new date and provide additional notice where required. An update does not retroactively change the lawful basis for earlier processing.
14. Contact
For any questions or concerns regarding this Privacy Policy or your personal data, please contact us:
Veltace s. r. o.
Registered office: Karpatské námestie 7770/10A, 831 06 Bratislava, Slovak Republic
Company ID (IČO): 57 828 725
Email: [email protected]
Website: https://ace-software.net
Support: https://support.ace-software.net
Company Website: https://veltace.com