Privacy policy

In short

• The Verto app collects nothing: your files are converted on your Mac and never leave it.
• The website keeps only what it needs for your account, your subscription, the emails you chose and the messages you send us.
• No advertising, no tracking cookies: audience measurement is anonymous and cookie-free. Your data is never sold.

Who is responsible

Gabriel Delavaud, sole trader, publisher of vertomac.com and of Verto (see the legal notice). Contact: contact@vertomac.com, or the form on the Help & FAQ page.

The Verto app

Verto converts your files right on your Mac. It sends neither your files nor any information about how you use it. It connects to the internet only to download what a link you paste points to, to update, from its official source, the built-in tool that reads platform links, and, from version 1.1 on, to ask vertomac.com from time to time, including at launch, how many files a month are free and whether a new version of Verto is out, then download it when you click “Update”. It then sends only its version number and the kind of Mac (macOS, Apple silicon), with no identifier. If you pasted a Pro key into it, it has vertomac.com check that key from time to time: it sends the key and a device identifier, used to limit a key to three Macs at a time, and nothing else. That identifier is a fingerprint computed from a number drawn at random at install time and the Mac’s hardware identifier: it reveals neither.

What the website collects

• Your account: your email address, your password (kept only in encrypted form, which no one can read back), the language you chose, and the dates of creation and confirmation. If you sign in with Google: your address and the profile information Google provides (name, photo).
• Your subscription: the plan, its dates, the amounts paid and the invoices, and when you ticked the two boxes of the order (terms of sale, immediate access). Payment is handled by Stripe: your card details never go through our servers.
• Your licence key: the site keeps only a non-reversible fingerprint of it and the date the app last checked it; for each Mac it is used on, a non-reversible fingerprint of the app’s device identifier, with the dates of its first and last check.
• Your email choices: the two boxes (new versions, news) and the history of each consent given or withdrawn, with its date.
• Your messages: what you write in the form on the Help page, its type, the reply address and the language of the page.
• Your country: the host works it out from the connection’s IP address; it serves to show prices in your currency. The IP address itself isn’t kept.
• Audience measurement: how many times each public page is viewed, per day, country and browser language — totals, with no cookie and no identifier. Vercel Web Analytics also counts visits, pages, countries and referring sites, without cookies, and never receives the parameters of an address (a password link, a payment). At sign-up, the site keeps with your account the country of the connection and your browser’s language, then the date of your first download: enough to know in which countries and languages the site is useful.
• Security: to limit abuse, a non-reversible fingerprint of your IP address and of the address you typed goes with each attempt to sign in, sign up, send an email, pay, check a key or download. The host also briefly keeps technical logs (IP address, browser).
• Bot check: on the sign-up and forgotten-password pages, Cloudflare Turnstile examines technical information from your browser to tell a person from a bot.

Why, and on what basis

• Creating and running your account, letting you download Verto, selling and managing your subscription: performing the contract (the terms).
• Issuing and keeping invoices: a legal obligation.
• Sending you the new-version and news emails: your consent, which you can withdraw at any time from the Account page. Emails about your account and subscription (confirmation, invoice, renewal reminder) are part of the contract.
• Answering when you write to us: our legitimate interest in answering the question you ask.
• Protecting the website and the accounts (limits, bot check, logs, fraud prevention): our legitimate interest in the security of the service.
• Measuring the audience, to decide on the site’s languages and improvements: our legitimate interest. It is anonymous and cookie-free, so it doesn’t need your consent; a browser that sends “Do Not Track” or “Global Privacy Control” is left out of the site’s totals.

For how long

• Your account and everything linked to it: until you delete it. An account that is never confirmed is deleted after 7 days.
• Invoices and accounting records: 10 years (article L123-22 of the French Commercial Code), even after the account is deleted.
• Messages from the Help page: 1 year. A copy reaches the publisher’s mailbox.
• The fingerprint of each Mac your key is used on: until 120 days after its last check. A new key, or deleting the account, erases it at once.
• Security fingerprints: 2 days.
• Audience measurement totals: 25 months. The country and language at sign-up: with the account.

Who has access

No one but the publisher, and the technical providers that run the website, each for its own part:

• Supabase (accounts and database, servers in Paris);
• Vercel (website hosting, functions in Paris, cookie-free audience measurement);
• Stripe (subscription payments);
• Resend (sending emails, servers in Ireland);
• Cloudflare (bot check, and storage of the app file you download);
• Google, if you choose to sign in with Google.

These companies are based in the United States or have their parent company there. When data is transferred there, the transfer relies on the safeguards provided by the GDPR: an adequacy decision of the European Commission or standard contractual clauses. The tax authorities may also access invoices, as provided by law.

Cookies

The website uses only cookies it needs to work; they therefore don’t require your consent. At checkout, Stripe sets its own cookies, needed for payment security and fraud prevention.

• Your account session (sb-…-auth-token): until you sign out, at most 400 days.
• The language you chose (NEXT_LOCALE): until you close the browser.
• The currency you chose on the Pricing page (verto_currency), only if you change it: 1 year.
• A sign-up in progress (verto-pending-email, verto-signup-consent): 1 hour and 7 days.
• Choosing a password from a link (verto-link): 15 minutes.

Your rights

You can access your data, have it corrected or erased, receive a copy of it, object to its processing or ask for it to be restricted, and withdraw your consent at any time. The Account page already lets you change your emails, your language and your password, and delete everything (except invoices, kept for the legal period).

For anything else, write to contact@vertomac.com: you will get an answer within a month. You can also lodge a complaint with the French data protection authority, the CNIL (cnil.fr), or the one of your country.

Minors

No minimum age is required to create an account. If you are under 15, ask a parent before ticking the optional emails, and before taking out a subscription.

Security

Encrypted connections (HTTPS) everywhere, passwords never stored in plain text, card details never on our servers, session cookies out of reach of scripts, limits on repeated attempts, and data access reserved for the website’s server.

Changes

This policy may change; the date at the top of the page shows its latest version. A significant change is announced to account holders before it applies.