Privacy Policy.

The Experiential Company, LLC ("TEC," "we," "our," or "us") is a California LLC. This policy covers everything you do with us: our marketing site (tec.design), our account system (TEC ID, at id.tec.design), and our desktop products — Moonshine, Starlight, Owlette, and anything we ship next.

If you only read one paragraph: we collect your email, your name (if you give it), the billing address our payment processor needs for sales tax, which products you own, and — for the apps that need it — a per-machine hardware fingerprint so seat limits work. That's it. We don't sell or rent your data, and we don't track you across the web.

Account information (TEC ID)

• Email address.
• Name and company (optional; ask us and we'll skip them).
• Billing address — required by our payment processor for sales tax, not used for anything else.
• Which TEC products you own, the license keys we issued you, and when each license was activated.

Device fingerprint (license-bound apps)

When you activate a license on a machine, the app sends us a one-way hash derived from a handful of hardware identifiers (e.g., the system UUID, OS-managed machine GUID, primary disk serial). The raw identifiers never leave your device — we receive only the salted, hashed result. We use that hash to enforce seat counts and to recognize the same machine on re-activation.

Payment information

Payments are processed by Lemon Squeezy as our Merchant of Record. We never see your card number. Lemon Squeezy gives us the order ID, the amount, the country (for tax), the last 4 of the card (for receipts), and your billing address.

Owlette telemetry (Owlette only)

Owlette is a Windows fleet monitor. By design, the agent reports machine state to your dashboard — hostname, OS version, system metrics, process status, online/offline. This data is yours, scoped to your team. We process it on your behalf so the service can do its job.

Logs and basic analytics

• Web server logs: IP address, request path, status code, user-agent, timestamp — kept short for security and debugging.
• Aggregate counts of which pages get visited. No third-party trackers. No advertising IDs.

We use what we collect to:

• Deliver the products you paid for — activate licenses, run Owlette, send your software updates.
• Bill correctly — Lemon Squeezy needs the address; we need the email to send receipts and license keys.
• Email you about your account — license deliveries, payment problems, security notices, important product changes. Transactional only.
• Keep things working and safe — diagnose bugs, prevent abuse, enforce seat caps.

We send marketing email only if you've explicitly opted in. You can opt out from any marketing email with one click.

We share only what's needed to run the service, and only with vendors who handle data on our behalf under appropriate agreements:

• Cloudflare — hosting (Workers, D1, Pages, KV). Your data lives in their network. They process it under their Data Processing Addendum.
• Lemon Squeezy — Merchant of Record. They process the payment, handle global sales tax, and store card details on their side.
• Resend — transactional email (license keys, magic-link sign-in, receipts).
• GitHub (admins only) — our internal admin tools use Cloudflare Access + GitHub as the identity provider. This affects TEC employees, not customers.

We don't sell your data. Not now, not in the future. If TEC is ever sold or merged, your data transfers under this same policy and we'll tell you before that happens.

We will disclose data when required by valid legal process. We push back on overreach and will tell you about a request unless legally prohibited.

Account data and license records live on Cloudflare infrastructure (primarily in the United States, with edge replication globally). TLS in transit. License-activation tokens are signed with PASETO v4 (Ed25519). Tokens stored on your machine are protected by the OS keystore — DPAPI on Windows, Keychain on macOS, libsecret on Linux.

Owlette telemetry is encrypted in transit and isolated per team. We design Owlette so we cannot read into your private process names or arbitrary files — the agent only reports the fields it's built to report.

• Active accounts — as long as you have a TEC ID with us.
• License records — kept for the life of the license plus 7 years (tax / accounting requirement for our records of sale).
• Closed accounts — we delete personally identifiable data 30 days after you close your account, except where we need to keep order/tax records as above.
• Logs — short-lived (≤30 days) unless flagged for an active security investigation.
• Owlette telemetry — controlled by your team's retention settings inside Owlette.

No matter where you are, you can:

• Access — ask for a copy of the data we have about you.
• Correct — fix anything wrong via your TEC ID dashboard, or email us.
• Delete — close your account; we'll delete personal data within 30 days (see retention).
• Export — get a machine-readable export of your account and licenses.
• Object — opt out of marketing email at any time.

If you're in the EU/UK, you have rights under the GDPR — including the right to lodge a complaint with your local supervisory authority. If you're in California, you have rights under the CCPA/CPRA; we treat all our customers as if those rights apply because they should. Reach us at privacy@tec.design.

TEC is in the United States. If you're outside the US, using our services means your data will be transferred to and processed in the US. Where required (EU/UK), this happens under Standard Contractual Clauses with our processors.

We use a small number of strictly-necessary cookies to keep you signed in to TEC ID and your customer portal. We do not use advertising cookies or cross-site trackers. We do not run Google Analytics, Facebook Pixel, or similar.

Our products are for professionals and we do not knowingly collect personal data from anyone under 16. If you believe a child has provided us information, contact us and we'll delete it.

When we make material changes, we'll update the "Last updated" date and email account holders. Day-to-day wording fixes don't trigger a notice.

Privacy questions: privacy@tec.design

General support: hello@tec.design

Company: The Experiential Company, LLC — California, USA