Privacy Policy¶

Last updated: May 27, 2026 Effective date: May 27, 2026

This Privacy Policy describes how MOKA Studio Ltda processes personal data related to the Octo Tools ("Octo Tools") software and its documentation website, in compliance with the Brazilian General Data Protection Law (Law 13.709/2018 — "LGPD") and, where applicable, the EU General Data Protection Regulation (GDPR).

1. Who we are¶


Company name	MOKA Studio Ltda
CNPJ (Brazilian tax ID)	27.735.107/0001-34
Address	Divinópolis, MG, Brazil
Data Protection Officer (DPO)	Erich Vilela Carvalho
Contact	[email protected]

MOKA Studio Ltda is the data controller for personal data processed under this Policy.

2. Data we collect¶

2.1 Data collected directly by Octo Tools¶

When you activate an Octo Tools license on your machine, we collect:

Hardware identifier ("Machine ID"): a 16-character string derived from technical characteristics of your computer, used exclusively to bind your license to the authorized device;
License key: the code you received upon purchase;
Local execution logs: the orc.log file stays on your computer and is never transmitted to our servers — used only for local diagnostics by the user.

Octo Tools does not collect, transmit or store on our servers:

Toon Boom Harmony scene content;
Your project files;
Usage statistics (telemetry);
Browsing data or in-app cookies.

2.2 Data collected during purchase (Creem)¶

Octo Tools sales are processed by Creem (Armitage Labs OÜ, Estonia), which acts as Merchant of Record and, legally, as data processor for your payment information under Art. 5(VII) of the LGPD (and the equivalent Art. 4(8) of the GDPR).

Creem collects:

Name;
Email address;
Billing address;
Payment data (credit card, PayPal, etc.).

MOKA Studio receives from Creem only:

Your name;
Your email;
Confirmation that the purchase occurred (to issue the license key and provide support).

Full financial data never transits our systems. For details on this processing, see the Creem Privacy Policy.

2.3 Data collected on the documentation website¶

The documentation site does not use tracking cookies, analytics tools, advertising pixels, or cross-site identifiers. Server logs may temporarily record visitors' IP addresses for security purposes for no more than 7 (seven) days.

Should this policy change (for example, if analytics is added in the future), this document will be updated at least 30 days in advance.

3. Purpose of processing¶

Data	Purpose	Legal basis (LGPD / GDPR)
Machine ID	Bind your license to the authorized device	Contract performance (LGPD Art. 7(V) / GDPR Art. 6(1)(b))
License key	Identify and validate your license	Contract performance
Name and email	Deliver the license and provide support	Contract performance
Email (support)	Respond to requests	Contract performance + Legitimate interest
Web server IP	Security and abuse prevention	Legitimate interest

We share personal data only with:

Creem: as payment processor (item 2.2);
Public authorities: only when required by court order or legal obligation;
Website hosting providers: who store the site but do not access identifiable personal data.

We do not sell, rent or trade your personal data.

5. International data transfers¶

Creem (Armitage Labs OÜ) is an Estonian (EU) company and stores data in the European Union. By making a purchase, you consent to the international transfer of your payment data under LGPD Art. 33.

6. Retention¶

Data	Retention period
Machine ID + license key	While the license is active + 5 years (statutory limitation period)
Name and email	While the license is active + 5 years
Web server logs	Up to 7 days
Support tickets	2 years after last contact

After the applicable period, data is deleted or anonymized.

7. Your rights (LGPD Art. 18 / GDPR Arts. 15–22)¶

You have the right to:

Confirm the existence of processing;
Access your data;
Correct incomplete or outdated data;
Anonymize, block or delete unnecessary data or data processed in noncompliance;
Portability of your data;
Delete data processed under consent;
Information about data sharing;
Withdraw consent;
Object to processing.

To exercise any of these rights, send an email to [email protected] with the subject "LGPD — [your right]" (or "GDPR — …" if you reside in the EU). We will respond within 15 (fifteen) business days.

8. Security¶

We adopt reasonable technical and administrative measures to protect your data:

HTTPS transmission on the site;
Restricted access to internal systems;
Passwords and keys stored as cryptographic hashes;
Backups in a secure location.

No system is completely secure. In the event of an incident that may cause relevant risk or harm to data subjects, we will notify you and the ANPD under LGPD Art. 48 (and the EU supervisory authority, where applicable, under GDPR Art. 33).

9. Children¶

Octo Tools is a professional tool and is not directed at individuals under 18. We do not knowingly collect data from minors. If we become aware that we have received data from a minor without guardian consent, we will delete such data immediately.

10. Changes to this Policy¶

This Policy may be updated to reflect changes in the software, applicable law, or our practices. Material changes will be communicated at least 30 (thirty) days in advance via email to licensees and on the site footer.

The date of the last update appears at the top of this document.

11. Contact¶

Data Protection Officer (DPO): Erich Vilela Carvalho Email: [email protected]

12. Governing law and jurisdiction¶

This Policy is governed by Brazilian law, in particular Law 13.709/2018 (LGPD) and Law 12.965/2014 (Brazilian Internet Civil Framework).

The courts of Divinópolis, Minas Gerais, Brazil are designated as the exclusive forum for any disputes regarding this Policy, the parties waiving any other forum however privileged.

Language¶

This document is provided in multiple languages for convenience. The English version is the authoritative, source-of-truth version; in the event of any conflict or discrepancy between the English version and any translation, the English version prevails.