Privacy policy

Last updated: November 11, 2026

1. Controller

The controller responsible for the processing of your personal data is:
Kevin Lehrmann, trading as CarVinci Resolve
Rheinauer Ring 81, 76437 Rastatt, Germany
Email: support@carvinci.com

2. Overview

We process your personal data to run this shop and our apps, to process your orders and to answer your requests. This policy explains which data we process, for what purpose, on which legal basis and for how long. The legal bases are set out in Article 6(1) of the General Data Protection Regulation (GDPR).

3. Hosting and shop system

Our shop runs on Shopify. The provider is Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland. When you visit our shop, Shopify processes your IP address, browser and device information, the pages you visit and the time of access, to deliver the website and to keep it secure.

Legal basis: Article 6(1)(f) GDPR. Our legitimate interest is the secure and reliable operation of our shop.

Shopify may transfer data to Shopify Inc. in Canada and to service providers in the United States. Canada has an adequacy decision of the European Commission. Transfers to the United States are based on the EU-U.S. Data Privacy Framework or on the European Commission's Standard Contractual Clauses. We have concluded a data processing agreement with Shopify.

More information: https://www.shopify.com/legal/privacy

4. Orders

When you place an order, we process your name, email address, billing address, order details, payment status and, if you provide it, your phone number. We use this data to process your order, to provide your download, to send you order and update emails, and to provide support.

Legal basis: Article 6(1)(b) GDPR (performance of a contract). We also process this data to meet our tax and commercial retention obligations: Article 6(1)(c) GDPR.

You must provide the data marked as required at checkout. Without it, we cannot conclude the contract.

5. Customer account

You can create a customer account. We then process your email address and your order history, so that you can access your orders and downloads. You can delete your account at any time by contacting us.

Legal basis: Article 6(1)(b) GDPR.

6. Payment

Depending on the payment method you choose, we pass your payment data to the relevant payment service provider. They process the data as independent controllers under their own privacy policies.

Legal basis: Article 6(1)(b) GDPR.

7. Contact

If you contact us by email or through the contact form, we process the data you send us (for example, your name, email address and message) to answer your request.

Requests through the support form in your customer account go to our support service, which stores them in a database at Supabase. The providers are named in section 10.

Legal basis: Article 6(1)(b) GDPR if your request relates to a contract, otherwise Article 6(1)(f) GDPR. Our legitimate interest is answering your request.

The contact form and the login use Google reCAPTCHA (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) to protect against spam and abuse. reCAPTCHA processes your IP address and information about your use of the page. Data may be transferred to Google LLC in the United States, based on the EU-U.S. Data Privacy Framework. Legal basis: Article 6(1)(f) GDPR. Our legitimate interest is protecting our shop against misuse. https://policies.google.com/privacy

8. Marketing emails

At checkout, you can tick a box to receive emails about new updates, releases and offers. We then use your email address to send you these emails. We use Shopify Email (Shopify International Limited, Dublin, Ireland) to send them and to see whether an email was opened or a link was clicked.

Legal basis: Article 6(1)(a) GDPR (consent). You can withdraw your consent at any time using the unsubscribe link in every email or by contacting us. Emails about your order and about updates to products you bought are not marketing emails and are sent based on Article 6(1)(b) GDPR.

If you start a checkout but do not complete it, we send you a reminder email only if you have agreed to receive marketing emails.

9. Product reviews

Inside our products, we ask for your feedback and link to a review form by Judge.me. We use Judge.me to collect and show product reviews. If you write a review, Judge.me processes your name, email address, the review text and, if you add them, photos or videos. Your name, or its initials, and your review are published in the shop.

Legal basis: Article 6(1)(a) GDPR (consent). You can withdraw your consent at any time by asking us to delete your review.

More information: https://judge.me/privacy

10. Speedramp Engine app

Speedramp Engine runs on your computer and does not upload your video files. This section explains which personal data the app sends over the internet and what we do with it.

Device ID. Several functions below use a device ID. The app creates it on your computer from information about the computer, as a pseudonymous code from which this information cannot be read back. This is based on Section 25(2) TDDDG, because the license check cannot work without it.

License and activation. When you buy a product that needs a license, Shopify sends your order to our license service. The service creates your license key in our license system, Keygen, and stores it there with your email address, your order number and the product name. We also save the key with your order in Shopify, so that you can see it in your customer account. When you activate the app, it sends your license key, the device ID, the name of your computer and your operating system to Keygen. Later license checks send the license key and the device ID. Keygen keeps request logs with your IP address for up to 30 days.

Legal basis: Article 6(1)(b) GDPR. We keep this data for as long as your license exists. If an order is deleted, we delete its license.

Free trial. You can start a free trial in the app without a name, email address or account. The app sends the device ID to our license service, which creates a trial license in Keygen and stores the device ID, the start date and the license key with it. To prevent misuse of the trial, the service also stores a pseudonymised value derived from your IP address, not the address itself. Activation and license checks then work as described above. If you get the installer through a free order in our shop, section 4 applies to that order.

Legal basis: Article 6(1)(b) GDPR for providing the trial. Article 6(1)(f) GDPR for preventing misuse, which is our legitimate interest. We keep the trial license with this data for as long as we offer the trial, because it is the only record that a computer has already had its trial.

Updates and downloads. The app asks Keygen for new versions and sends your license key. Installers, updates and the list of our other tools shown in the app come from GitHub, which receives your IP address. To download the AI-Flow extension, the app sends your license key and the device ID to our license service.

Legal basis: Article 6(1)(b) GDPR. For the list of tools, Article 6(1)(f) GDPR. Our legitimate interest is informing you about our other products.

Usage statistics. The app sends usage counts to a database at Supabase, for example when a speed ramp is applied or a preset is saved, and, while the app is open, a regular signal with a random session ID that changes each time the app starts. These messages contain no license key, no email address and no device ID. Supabase receives your IP address with each connection.

Legal basis: Article 6(1)(f) GDPR. Our legitimate interest is improving the app.

Rating and feedback. If you send a rating in the app, our feedback service receives the rating, your text and, if your license has one, its email address. It passes them to Judge.me (see section 9) as a review of Speedramp Engine, together with your first name and the initial of your last name from your latest order in our shop. Before you send a rating, the app tells you that it may be published. We may then publish the rating and your text on carvinci.com, shown with this name or, if we have none, as "Speedramp Engine User".

Legal basis: Article 6(1)(f) GDPR. Our legitimate interest is improving the app and showing what users think of it. You can object at any time (section 14). We then remove your review.

Discount code after 50 timelines. After 50 timelines with a paid license, the app offers you a one-time discount code. To issue and manage it, the app sends your license key and part of your user name on this computer to our discount service. The service checks your license with Keygen and creates the code in our shop on Shopify. The code may contain part of your name. The service stores your license key, the code, its expiry date and whether it was extended in a database at Supabase, so that each license gets only one code. We keep this record for as long as we offer this discount.

Legal basis: Article 6(1)(b) GDPR.

Bug reports and feature requests. If you report a bug or request a feature in the app, it opens our support page in your browser and adds technical details to the web address, for example the app version, clip and settings data, error messages, system information, your license status and a shortened form of your license key. Shopify receives this address when the page loads. If you send the form, our support service stores your name, your email address, your description and these details in a database at Supabase.

Legal basis: as in section 7.

Service providers. Our license, feedback, discount and support services run on Cloudflare.

  • Cloudflare, Inc., USA. Transfers to the United States are based on the EU-U.S. Data Privacy Framework.
  • Keygen LLC, USA. Transfers are based on the European Commission's Standard Contractual Clauses.
  • Supabase Pte. Ltd., Singapore. Our data is stored in the EU (Ireland). Access from outside the EU is based on the European Commission's Standard Contractual Clauses.
  • GitHub B.V., Netherlands, and GitHub, Inc., USA. Transfers to the United States are based on the EU-U.S. Data Privacy Framework or Standard Contractual Clauses.

More information: https://www.cloudflare.com/privacypolicy/, https://keygen.sh/privacy/, https://supabase.com/privacy and https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement

11. Embedded videos

Our pages contain embedded videos from YouTube (Google Ireland Limited, Dublin, Ireland) and Vimeo (Vimeo.com, Inc., 330 West 34th Street, New York, NY 10001, USA). When a video loads, the provider receives your IP address and information about your browser, and may set cookies. YouTube videos are embedded in privacy-enhanced mode. Data may be transferred to the United States, based on the EU-U.S. Data Privacy Framework or Standard Contractual Clauses.

Legal basis: your consent under Article 6(1)(a) GDPR and Section 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG), where cookies are set. Otherwise Article 6(1)(f) GDPR. Our legitimate interest is presenting our products with videos.

More information: https://policies.google.com/privacy and https://vimeo.com/privacy

12. Cookies and consent

Our shop uses cookies and similar technologies. Cookies that are strictly necessary to run the shop (for example, for the cart, the checkout and your login) are set without consent, based on Section 25(2) TDDDG and Article 6(1)(b) or (f) GDPR.

All other cookies, for example for statistics, are set only with your consent, based on Section 25(1) TDDDG and Article 6(1)(a) GDPR. You give or refuse consent in the cookie banner when you first visit the shop. You can change or withdraw your consent at any time using the cookie settings link in the footer.

13. Retention

We delete your personal data as soon as it is no longer needed for the purpose for which we collected it, unless legal retention periods apply. Invoices and accounting records are kept for 8 years, books and annual financial statements for 10 years, and business letters for 6 years (Section 147 German Fiscal Code, Section 257 German Commercial Code). Your customer account data is kept until you delete your account.

14. Your rights

You have the right to:

  • access your personal data (Article 15 GDPR),
  • have incorrect data corrected (Article 16 GDPR),
  • have your data deleted (Article 17 GDPR),
  • restrict the processing of your data (Article 18 GDPR),
  • receive your data in a portable format (Article 20 GDPR),
  • withdraw any consent you have given, with effect for the future (Article 7(3) GDPR).

To exercise your rights, contact us at support@carvinci.com.

Right to object (Article 21 GDPR)

Where we process your data based on Article 6(1)(f) GDPR, you have the right to object to this processing at any time, for reasons arising from your particular situation. We will then stop processing your data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. Where we process your data for direct marketing, you can object at any time, and we will then stop processing your data for this purpose.

15. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:
Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg
Lautenschlagerstraße 20, 70173 Stuttgart, Germany
https://www.baden-wuerttemberg.datenschutz.de

16. Automated decision-making

We do not use automated decision-making, including profiling, under Article 22 GDPR. Credit checks by Klarna are carried out by Klarna as an independent controller.

17. Changes

We update this Privacy Policy when our shop or the law changes. The current version is always available in the shop.