// LEGAL

Privacy Policy

Last updated: April 25, 2026

Octopus is a local-first desktop application. The films, books, and vocabulary You import stay on Your computer. We collect only what We need to sell You a Lifetime License, deliver it, support it, and comply with the law. This Policy explains, in plain terms, what that means.

1. Who We Are

The data controller responsible for Your personal information under this Policy is YLF TECH LTDA, a limited liability company duly incorporated under the laws of the Federative Republic of Brazil, registered with the Brazilian Internal Revenue Service (Receita Federal) under CNPJ No. 53.120.498/0001-92, with its registered office at Avenida Paulista, 777, 15º andar, conjunto 15, sala 811, Bela Vista, São Paulo/SP, ZIP 01.311-914, trading as "Octopus Lang" (referred to as "We", "Us", "Our", or "the Company").

You can contact Us at any time at support@octopuslang.com.

2. Definitions

• Application means the Octopus desktop software.
• Service means the Application and the Website together.
• Website means octopuslang.com and any subdomains.
• Personal Data means any information that relates to an identified or identifiable natural person.
• You means the individual using the Service.

3. What We Collect and Why

3.1 Information You Provide Directly

• Support correspondence. If You email Us at support@, We receive Your email address, name (if signed), and the contents of Your message.
• Refund requests. The same as above, plus the order number if You include it.

3.2 Information Collected by Our Payment Processor

All purchases of the Lifetime License are processed by Paddle.com Market Ltd, who acts as the merchant of record. When You buy, Paddle collects on Our behalf:

• Your full name;
• Your email address;
• Your billing address, country, and ZIP/postal code (used to calculate the correct sales tax / VAT);
• Payment instrument details (credit card, PayPal, etc.) — these are held by Paddle and never reach Our servers.

Paddle then provides Us with Your name, email address, and country so We can deliver Your license key, send the receipt, honour refunds, and comply with Our tax obligations. Paddle's own handling of Your data is governed by their Privacy Notice.

3.3 Information Collected by the Application

The Application runs locally on Your Device. It does not upload, scan, copy, or transmit Your films, books, transcripts, vocabulary lists, notes, or any other content You bring into the Application to Our servers or any third party — with one narrow exception described in §3.4.

The Application may store the following on Your Device only: Your license key (to verify Your Lifetime License status), Your application preferences, and an anonymised crash log used solely to diagnose stability issues, which You can disable in the Application's settings.

3.4 Translation Requests

When You explicitly ask Octopus to translate a sentence, that single sentence is sent to the translation API endpoint configured by You (e.g., the API key You provided). Octopus does not relay translation requests through Our own servers; the request goes directly from Your Device to Your chosen provider, governed by their privacy policy.

3.5 Information Collected by the Website

The Website is hosted on Cloudflare. Cloudflare automatically logs standard request metadata (IP address, user agent, requested URL, timestamp) for a short period for the purposes of security, abuse prevention, and aggregate traffic statistics. This logging is described in Cloudflare's Privacy Policy.

We do not use Google Analytics or any third-party analytics, advertising, remarketing, social-media pixels, or behaviour-tracking tools on the Website. We do not place any cookies other than those strictly necessary for the Website to function.

4. How We Use Your Information

• To deliver the Application and the Lifetime License You purchased;
• To process refunds in accordance with Our Refund Policy;
• To respond to support requests and other communications You send Us;
• To send transactional emails (license delivery, refund confirmation, security or material policy updates) — We do not send marketing emails;
• To detect, prevent, and respond to fraud, abuse, or unlawful use of the Service;
• To comply with legal obligations, including tax reporting and responding to lawful requests from public authorities.

5. Legal Bases for Processing (EU/UK Users)

If You are in the European Union, the United Kingdom, or another jurisdiction with similar laws, We rely on the following legal bases:

• Performance of a contract (Art. 6(1)(b) GDPR) — to deliver the Lifetime License and provide support;
• Compliance with a legal obligation (Art. 6(1)(c) GDPR) — to keep tax and accounting records;
• Legitimate interests (Art. 6(1)(f) GDPR) — to secure the Service, prevent fraud, and improve the Application's stability through anonymised crash logs;
• Consent (Art. 6(1)(a) GDPR) — where We expressly ask for it, which You can withdraw at any time.

6. Sharing Your Information

We do not sell Your personal information. We share it only with the following categories of recipients, and only as needed:

• Payment processor — Paddle.com Market Ltd, for billing, tax, and refunds.
• Email and infrastructure providers — providers that host Our email and the Website (currently Cloudflare and Our domain email provider).
• Professional advisors — accountants and lawyers, where strictly necessary, under confidentiality.
• Public authorities — where required by law, court order, or to protect Our rights or the safety of others.

We do not share Your personal information with advertisers, data brokers, or social-media platforms.

7. International Data Transfers

Because Paddle is established in the United Kingdom and Cloudflare's infrastructure is global, Your personal information may be transferred to, processed in, and stored in countries outside Brazil and the European Economic Area, including the United Kingdom, the European Union, and the United States. Where required, We rely on adequacy decisions or Standard Contractual Clauses to safeguard such transfers.

8. Data Retention

• Customer records (name, email, country, order history) — kept for as long as Your Lifetime License is active and for up to 10 years after the last transaction, to comply with Brazilian tax and accounting law.
• Support correspondence — kept for up to 3 years after the last interaction, then deleted or anonymised.
• Cloudflare request logs — retained for the period set in Cloudflare's policy (typically days, not months).
• Anonymised crash logs from the Application — kept for up to 12 months.

9. Security

We use reasonable technical and organisational measures to protect Your personal information, including HTTPS for the Website, encrypted transport for all email, access controls on Our administrative tools, and Paddle's PCI-DSS-compliant infrastructure for payment data. No method of transmission or storage is perfectly secure, however, and We cannot guarantee absolute security.

10. Your Rights

10.1 General Rights (Including EU/UK Users)

You have the right to:

• access the personal information We hold about You;
• request correction of inaccurate information;
• request deletion of Your information, subject to legal retention obligations;
• restrict or object to certain processing;
• request data portability (a machine-readable copy of Your information);
• withdraw consent at any time, where processing is based on consent;
• lodge a complaint with Your local data-protection authority — for EU/UK Users, the relevant supervisory authority in Your country of residence.

To exercise any of these rights, email support@octopuslang.com. We will respond within 30 days, or as required by applicable law.

10.2 Notice for California Residents (CCPA / CPRA)

This section applies if You are a resident of the State of California and supplements the rights described above.

Categories of personal information collected. In the past 12 months, We have collected the following categories of personal information, as defined by the California Consumer Privacy Act ("CCPA"), as amended by the California Privacy Rights Act ("CPRA"):

• Identifiers — name, email address, IP address, license key.
• Commercial information — record of the Lifetime License purchased, refunds, and support history.
• Internet or other electronic network activity — Cloudflare server logs (IP, user agent, requested URL).
• Geolocation data — only the country and approximate region inferred from billing address and IP, used for tax and security purposes.

Sources. Directly from You (when You purchase or contact Us), from Our payment processor Paddle, and automatically from Your Device when You visit the Website.

Business and commercial purposes. Delivering the Lifetime License, processing refunds, providing support, complying with tax law, and securing the Service against fraud and abuse.

No sale or sharing of personal information. We do not sell Your personal information, and We do not share it for cross-context behavioural advertising, as those terms are defined under the CCPA/CPRA. We have not done so in the past 12 months and have no plans to do so.

No use of sensitive personal information for inference. We do not process sensitive personal information (as defined by the CPRA) for the purpose of inferring characteristics about You.

Your California rights. You have the right to:

• know what personal information We have collected, used, disclosed, and (if applicable) sold or shared about You;
• request deletion of Your personal information, subject to legal exceptions;
• request correction of inaccurate personal information;
• opt out of the sale or sharing of Your personal information (not applicable to Us — see above);
• limit the use and disclosure of sensitive personal information (not applicable to Us — see above);
• be free from retaliation or discrimination for exercising any of these rights.

To exercise any California right, email support@octopuslang.com with the subject line "California Privacy Request". We may need to verify Your identity (typically by confirming Your email address against a prior purchase or support ticket) before fulfilling the request. You may also designate an authorised agent to act on Your behalf, in which case We will require written proof of authorisation.

10.3 Notice for Brazilian Residents (LGPD)

If You are located in Brazil, You have, in addition to the rights above, the rights guaranteed under the Lei Geral de Proteção de Dados (Law No. 13.709/2018), including the right to confirm processing, request access, correct, anonymise, block, delete, port, and obtain information about public and private entities with which We have shared Your data. You may also lodge a complaint with the Autoridade Nacional de Proteção de Dados (ANPD).

11. Children

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from anyone under 18. If You believe We may have inadvertently collected such information, please contact Us and We will delete it promptly.

12. Changes to This Policy

We may update this Policy from time to time. If a change is material, We will give reasonable notice — for example, by updating the "Last updated" date above and, where appropriate, sending a notification by email. Your continued use of the Service after a change takes effect constitutes acceptance of the revised Policy.

13. Contact Us

If You have any questions, concerns, or requests regarding this Privacy Policy or Your personal information, please contact Us:

• By email: support@octopuslang.com
• By post: YLF TECH LTDA, Avenida Paulista, 777, 15º andar, conjunto 15, sala 811, Bela Vista, São Paulo/SP, ZIP 01.311-914, Brazil