Who is responsible
The party responsible for the data described here — the responsable, in the language of Mexican data protection law — is the independent project behind fcp2aaf, operated from Mexico.
The contact for anything on this page, including a request to exercise the rights below, is support@cesareho.com. The registered particulars the law asks for — full legal name, tax identification and postal address — are not published on this page, and are given in full, by return, to anyone who asks for them, whether that is a customer, a data protection authority or a client's compliance department.
The application
The conversion is a process running on your own Mac, reading your own disk. The .fcpxml, your media, the names of your projects and the AAF that comes out are never transmitted anywhere. There is no analytics, no crash reporting, no telemetry and no account.
One thing uses the network: checking a licence. What travels is the licence key, the identifier of that activation, and a name for the Mac — so that you can tell your machines apart when you release one from another. Nothing about a project, a timeline or a file is part of it.
On the free plan, nothing is sent at all: it has no licence to check.
This website
The site is a set of static files served by Cloudflare. It sets no cookies of its own. The only thing it stores on your device is fcp2aaf.theme, a browser storage entry remembering whether you chose light or dark, which is never sent anywhere and can be cleared with the rest of your browsing data.
As host and network, Cloudflare processes what any web server processes to answer a request: your IP address, the page you asked for, and your browser's own description of itself. Those logs are kept for a short rolling period and are used to serve the site, to keep it up, and to rate-limit abuse.
Visits are counted with Cloudflare Web Analytics, which is aggregate and cookieless: no identifier is stored on your device and there is no tracking across other sites.
The waiting-list form is protected by Cloudflare Turnstile, which examines the browser rather than the person and may store a short-lived token strictly to carry out that check. Without it, the form is a mailbox for scripts.
There is no advertising, no social network widget, no third-party font, no session recording and no A/B testing on this site.
The waiting list
If you ask to be told when the application is released, what is stored is:
- your email address
- the language of the page you signed up on, and which page it was
- the two-letter country code Cloudflare derives from your IP address — the address itself is not stored
That is held by Plunk, the service that keeps the list and sends the message, and it is used for one email on the day the application is released. There is no newsletter, no sequence and no second message.
Every email carries an unsubscribe link, and writing to us has the same effect the same day — the record is deleted, not marked inactive.
The beta programme
Applying is an ordinary email. There is no form, no database and nothing automatic: what exists is the correspondence, in a mailbox, kept for as long as it is useful and deleted when you ask.
Some faults cannot be found from a description. When that happens you may be asked for the .fcpxml, and occasionally for a piece of the media it points at. It is always a request and never something the application does on its own; it is used to reproduce that one fault and nothing else; it is never published or shared; and it is deleted once the fault is fixed, or sooner if you ask.
If your material is under NDA, say no. It costs you nothing and it does not affect your place in the programme.
Buying a licence
Checkout is operated by Dodo Payments as merchant of record. It happens on their systems and they collect what a sale needs: your name, your email address, billing and tax details, and your payment method. Their privacy policy governs that part, and card details never pass through anything of ours.
What reaches us is the order, your email address, and the licence record it created — the key, its plan, and the Macs it is currently activated on. That is used to deliver the licence, to answer your email about it, to process a refund, and to keep the accounting records Mexican tax law requires.
What it is used for
- running the licence you bought, and letting you move it between your Macs
- answering the emails you send
- issuing and accounting for a sale, as tax law requires
- keeping the site available and rate-limiting abuse of it
- the single launch announcement, if you asked to be told
It is not used for advertising, it is not sold or rented to anybody, nobody is profiled, and no decision with a legal effect on you is taken automatically.
Where the data is
Those providers operate outside Mexico, mainly in the United States and the European Union, so data handled by them is processed there.
Handing data to a provider so it can carry out the service you asked for is a remisión under Mexican law and needs no separate consent from you. Where European rules apply, those transfers rest on the safeguards each provider publishes for them.
How long any of it is kept
- Orders and licence records — while the licence is alive, and afterwards for as long as tax and accounting law requires them to be kept.
- Support and beta correspondence — as long as it is useful as context for the next question, and deleted on request.
- The waiting list — until the launch email is sent, or until you unsubscribe, whichever comes first.
- Server logs — a short rolling period, set by Cloudflare rather than by us.
- Anything sent to reproduce a fault — deleted when the fault is fixed.
Your rights
Under Mexican data protection law you have the ARCO rights: to access the data held about you, to have it rectified when it is wrong, to have it cancelled, and to oppose its use. You may also limit its use or disclosure, and withdraw a consent you gave.
If you are in the European Economic Area or the United Kingdom, the equivalent rights apply: access, rectification, erasure, restriction, objection and portability.
Exercising any of them is an email to support@cesareho.com from the address concerned. There is no form and no fee, and the answer comes within the period the law sets — 20 working days in Mexico, a month under European rules.
If the answer does not satisfy you, you may complain to the authority that oversees data protection in Mexico, or to the supervisory authority where you live if that is in the EEA or the UK.
Security
The strongest protection here is that most of the data never exists: your work stays on your own disk, so there is no copy of it to lose.
What does travel goes over HTTPS. Keys and credentials are held as encrypted platform secrets and are not in the source repository. No arrangement is perfect, and this one is not claimed to be.
Children
This is a professional tool for post-production and it is not directed at children. Personal data is not knowingly collected from anybody under the age at which they could agree to this on their own.
Changes to this policy
Changes are made on this page, with a new date at the top of it. A material change to what the application sends over the network is stated in the release notes as well.
Contact
Any question about this page, and any request to exercise a right in it: support@cesareho.com.