Last updated: 9th November 2026
1. Who we are
This website, nablast.com (the “Site”), and the CrossFlow desktop application (the “App”) are operated by:
FAVRE-MARINET Nicolas
SIRET: 84045292400037
Contact: contact@nablast.com
For the purposes of the EU General Data Protection Regulation (GDPR), FAVRE-MARINET Nicolas is the data controller responsible for the personal data described in this policy. This applies wherever you are located: the controller is established in France, so the GDPR governs this processing for every user of the Site and of the App.
2. Scope of this policy
This policy explains what personal data the Site and the App collect, why, and what rights you have over it. The Site does not publish a blog or articles with comments, so no comment or account data is collected through that route.
This policy covers:
- Visiting nablast.com and its pages (CrossFlow product pages, docs, pricing, about, contact)
- Submitting the contact form
- Signing up for CrossFlow news by email (Brevo)
- Buying a CrossFlow license, and the optional question on the page shown after the purchase
- Downloading CrossFlow from the Site
- Cookies set while browsing the Site, including by the YouTube videos embedded in its pages
- The CrossFlow Beta signup form (hosted by Google Forms), for the data collected while the Beta program was running
- The network communications of the CrossFlow App: license activation, updates and news, and anonymous usage statistics (Section 5)
3. What data we collect and why
3.1 Contact form
The Contact page uses Kadence Blocks’ built-in form. When you submit it, we collect the information you enter (typically name, email address, and message). This data is:
- Used solely to respond to your enquiry
- Sent to contact@nablast.com and/or stored in the Site’s admin dashboard for a limited time to allow us to follow up
- Not used for marketing unless you separately opt in
- Not shared with third parties, except the hosting and email infrastructure needed to deliver it to us (see Section 6)
Legal basis: your consent, given by submitting the form (Art. 6(1)(a) GDPR), and/or our legitimate interest in responding to enquiries (Art. 6(1)(f) GDPR).
3.2 Beta signup (Google Forms)
Until the official release of CrossFlow 1.0, the CrossFlow Beta signup linked to a form hosted on Google Forms. Any data submitted there was collected and processed by Google under Google’s own Privacy Policy, not this one. We received the responses you chose to submit (typically name, email address and Beta-related questions) in order to run the Beta program. The Beta program has ended and the form no longer accepts responses. We use those responses one last time to send Beta participants the launch offer they were promised (a free license or a personal discount code), and we delete them by 31 December 2026.
Legal basis: your consent, given by submitting the form.
3.3 CrossFlow news by email (Brevo)
If you subscribe with the newsletter form (on the Newsletter and Pricing pages; the email field at the bottom of every page leads to it), we use your email address to send you news about CrossFlow: new versions, major updates and offers. The list is managed with Brevo (Sendinblue SAS, Paris, France), which stores it and sends these emails on our behalf. We ask for your email address and, if you wish, your first and last name, and we do not use them for anything else or share them with anyone else. The form is protected against spam sign-ups by Google reCAPTCHA, which loads with the form (see Section 4.2).
Our emails use open and click tracking: Brevo records whether you opened each email (through a small invisible image loaded when the email is displayed) and which of its links you clicked. We use this only to see which news interests our readers and to keep the list healthy. You can prevent open tracking by not loading images in your email app.
Every email contains an unsubscribe link. Unsubscribing removes you from the list at once and ends the tracking.
Legal basis: your consent, given by submitting the form (Art. 6(1)(a) GDPR).
3.4 Downloading CrossFlow
The download links on the Site (nablast.com/dl/…) redirect your browser to the installer, which is hosted on GitHub (GitHub, Inc., United States). GitHub therefore sees your IP address when you download, under GitHub’s privacy statement. On our side, we only keep the monthly number of downloads per version and operating system: no IP address and no identifier is stored.
3.5 Visits from our ads
We advertise CrossFlow in Google search results (Google Ads). If you reach the Site by clicking one of these ads, Google adds a click identifier to the link. Only if you accept cookies in the banner, this identifier is kept in a cookie so that we can count whether the visit led to a download or a purchase, and therefore which ads are worth paying for. We only see totals per ad (for example “3 purchases this week from this ad”), never who you are. We do not send Google your name, email address or order details, we do not use remarketing (showing you CrossFlow ads on other sites after your visit), and we do not build advertising audiences.
3.6 After your purchase
Your order details. When you buy a CrossFlow license, Creem (our merchant of record, see Section 6) passes us your name, email address, country and order details. We use them to deliver and support your license (for example to answer a question, resend a key or process a refund) and to keep the records the law requires. We may also write to you once, personally, shortly after your purchase, to thank you and ask how you found CrossFlow and whether anything was unclear. You do not have to answer, and you can tell us at any time that you do not want such messages.
CrossFlow update emails. As a customer, your email address is added automatically to our customers list at Brevo (see Section 6), which we use to tell you about new versions and major updates of CrossFlow and occasionally about offers for our own similar products. Only your email address is sent to Brevo: not your name, country or order details. You are told about this on the page shown after your purchase, and you can refuse at any time, free of charge: with the unsubscribe link at the bottom of every email, or by writing to us. If you had already unsubscribed from our emails, buying does not subscribe you again. If your order is refunded, your address is removed from the customers list. Emails sent to this list use the same open and click tracking as the news list (see Section 3.3). This list is separate from the CrossFlow news list of Section 3.3, which you only join by signing up yourself.
The optional question on the thank-you page. The page shown after your purchase asks how you first heard about CrossFlow. Answering is optional. The form asks for no name or email address, and your answer is sent to contact@nablast.com and/or stored in the Site’s admin dashboard, without any link to your order. We use the answers only as totals, to know which channels are worth our time. Please do not type personal information in the “Other” field.
Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and our legal obligations (Art. 6(1)(c) GDPR) for delivering and supporting your license; our legitimate interest in understanding how customers find CrossFlow and improving it (Art. 6(1)(f) GDPR) for the one follow-up message and the optional question; for the update emails, our legitimate interest in keeping customers informed about the product they bought (Art. 6(1)(f) GDPR), within the rules French law sets for emails to existing customers (article L34-5 of the Code des postes et des communications électroniques).
3.7 Automatically collected data (cookies & similar technologies)
See Section 4 below.
4. Cookies
4.1 What cookies are
Cookies are small text files placed on your device when you visit a website. Some are strictly necessary for the Site to function; others help us understand how the Site is used or are set by third-party services embedded in the Site.
4.2 Cookies and services used on this Site
| Category | Purpose | Set by | Requires consent? |
|---|---|---|---|
| Strictly necessary | Core WordPress functionality (e.g. security, load balancing) | nablast.com | No: essential to the Site working |
| Consent record | Remembers your choice in the cookie banner (cookie “cookieyes-consent”), and keeps an anonymous record of that choice as proof of consent, as the law requires. The banner is provided by CookieYes | nablast.com, CookieYes | No: needed to respect your choice |
| Analytics | Google Analytics (GA4) measures visits, page views, and general traffic patterns to help us understand how the Site is used | Yes: blocked until you accept | |
| Advertising measurement | When you arrive from one of our Google ads, Google Ads cookies (such as “_gcl_au” and “_gcl_aw”) record that visit so that we can count whether it led to a download or a purchase. No remarketing, no ad personalisation | Yes: blocked until you accept | |
| Search performance | Google Search Console helps us understand how the Site performs in Google Search results | Handled via cookie banner | |
| Images | The Site’s images are delivered through Jetpack’s image service (i0.wp.com), and some emoji images come from WordPress.org (s.w.org). Loading them transfers your IP address to Automattic, the company behind Jetpack and WordPress.com; no cookie is set | Automattic | Not blocked by the banner: the images are part of the pages |
| Spam protection | The newsletter forms (on the Newsletter and Pricing pages) are protected by Google reCAPTCHA, which loads with the form and checks that sign-ups come from a person. It transfers your IP address and technical data about your browser to Google, under Google’s Privacy Policy | Not blocked by the banner: it protects the form against abuse (our legitimate interest, Art. 6(1)(f) GDPR) | |
| Embedded videos | Some pages show a CrossFlow video embedded from YouTube in privacy-enhanced mode (youtube-nocookie.com). The player loads from Google’s servers as the page loads, which transfers your IP address to Google; YouTube only stores cookies or similar data on your device once you play the video | Google (YouTube) | Not blocked by the banner: the video only plays if you start it |
Apart from measuring the results of our own Google ads (row above, only with your consent), we do not use advertising cookies, remarketing or cross-site tracking.
4.3 Managing your consent
On your first visit, a cookie banner lets you accept or refuse non-essential cookies. Google Analytics and the measurement of our Google ads do not run until you accept. The images, spam protection and embedded videos described above are not controlled by the banner, for the reasons given in the table. You can change your choice at any time with the small round cookie button shown at the bottom left of every page once you have made a choice (“Consent Preferences”). Refusing non-essential cookies does not prevent you from using the Site’s core content.
5. The CrossFlow App
CrossFlow converts Adobe Premiere Pro projects to DaVinci Resolve projects. It does all of that work on your computer. Your project files, your media files, and the names and paths of your projects, sequences, clips and media are never sent to us. The App contacts the network only in the cases described below. Everything the App sends can be seen in the App itself: open Settings & License and click “See exactly what is sent”.
5.1 License activation
When you activate, validate or deactivate a license, or release the computers registered to your license, the App contacts our license server at nablast.com. Each request contains:
- your license key
- an identifier of your computer, derived from your operating system’s installation identifier (not your computer’s name, and not reversible into it)
- the name of your computer as set in your operating system, followed by “Windows” or “macOS”, so that you can recognise it when you manage the computers registered to your license
- the version of CrossFlow, and the major versions of Premiere Pro and DaVinci Resolve in use where the App knows them
When you export a project for another computer with a license active, the App also asks the same server to sign the transfer file. That request contains your license key, the identifier and name of your computer, the version of CrossFlow, the fingerprint (SHA-256) of the file’s content and a random identifier of the transfer. The fingerprint cannot be turned back into your project, and we do not store it: it is sent back signed. The transfer file itself is never sent to us and goes only where you send it. It contains project and media names and paths, the name, studio and message you choose to type, and the signature, which includes the last four characters of your license key and the identifier of your computer.
Our server verifies the key with Creem, our merchant of record and license issuer (see Section 6), and keeps the list of computers registered to each license, since a license is valid on a limited number of computers. The server’s signed answer is cached on your computer so that CrossFlow keeps working for a period without a network connection. A valid license is re-checked about once a week when the App starts.
Legal basis: performance of the contract (Art. 6(1)(b) GDPR): this is what lets us deliver the license you bought to the computers you use it on.
Retention: licenses are perpetual, so the list of computers registered to a license is kept for as long as the license is valid. A computer that has not checked its license for 3 years is removed from the list (activating it again simply registers it anew). A refunded or revoked license is deleted from the list within 30 days.
5.2 Updates and news
When it starts, the App checks whether a newer version of CrossFlow exists and downloads short in-app news messages (for example, the announcement of a new version). Both come from our release repository, hosted on GitHub (GitHub, Inc., United States). When a newer version exists, the App also downloads its installer from there: right away by default, or only when you click the download link if you tick “Disable Auto-Update at opening” in Settings & License. Opening the changelog from the App downloads it from the same place.
As with any download, your IP address and standard technical information about the request are disclosed to GitHub. These requests contain no license key, no identifier of you or of your computer, and nothing about your projects, and we receive nothing from them.
You can stop all of these automatic requests by ticking “Do not check for updates or news at startup” in Settings & License. The App then contacts GitHub only when you click a link yourself.
Legal basis: our legitimate interest in keeping installed copies up to date and secure, and in informing users of important changes (Art. 6(1)(f) GDPR). You can object at any time with the setting above.
5.3 Anonymous usage statistics
To understand how CrossFlow is used and decide what to improve, the App sends us anonymous statistics at the end of each conversion and once per week of use. This is on by default, and you can turn it off at any time in Settings & License. A notice tells you about it the first time you open the App.
What is sent:
- the versions of CrossFlow, Premiere Pro, DaVinci Resolve and your operating system (Windows 10 or 11, or the macOS version), and the language of your system (two letters, no region)
- the size of the project and the numbers of its media, sequences and clips, always as ranges (for example “20 to 99 clips”), never exact values
- the media file formats present in the project (for example “mov”, “mxf”), without counts or file names
- which CrossFlow features and options were used
- whether the conversion succeeded, with stable codes naming the kinds of problems met (for example “unsupported effect”), and the names of the Premiere Pro effects, blend modes or transitions concerned
- whether an interrupted conversion was finished with “Continue Task” (from which step, and the general kind of cause, for example “the App’s window stopped”), or left unfinished
- how long each step took, as a range
- the number of conversions you started in a given week
- the week of the event (never the day or the time)
What is never sent: any identifier of you or of your computer, any project, sequence, clip, bin or file name, any file path, your license key, your email address, your user or computer name, or any free text. Counts are sent as ranges precisely so that no event can be matched back to a particular project.
These statistics are anonymous: they are not personal data, and we have no way to link them to you. Our server does not record the IP address they come from. They are collected under the audience-measurement exemption of French law (article 82 of the loi Informatique et Libertés, as interpreted by the CNIL): they measure the App itself, for our own account only, produce anonymous statistics only, are not combined with any other data and are not shared with anyone.
Retention: 24 months from reception, then deleted automatically.
5.4 Optional installation identifier
Separately, and only if you enable it in Settings & License (“Also include an anonymous install ID”), the App attaches a random identifier to a reduced set of statistics: the week, whether the App was in trial mode, whether a conversion succeeded, the weekly number of conversions, and whether the pricing page was opened or a license activation attempted (never the key, never its result message). This lets us see how the use of one installation evolves over time, and whether a trial leads to a purchase.
The identifier is created on your computer from random numbers. It is not derived from your computer, and it is not linked to your license key, your email address or anything else we hold about you. It is deleted when you disable the option, and replaced by a new one if you enable it again.
Legal basis: your consent (Art. 6(1)(a) GDPR), given by enabling the option. You withdraw it by disabling the option, which stops the collection and deletes the identifier on your computer. To have the data already received deleted from our server, send us the identifier shown in Settings & License > “See exactly what is sent”: it is the only way we can find those records, since nothing else links them to you.
Retention: 24 months from reception, then deleted automatically.
5.5 Hosting logs
Like every page of the Site, the App’s requests reach a server hosted by OVHcloud in France. OVHcloud keeps standard web server access logs (IP address, time, address requested) for the operation and security of the hosting, for 12 months, which is the retention French law requires of hosting providers. Our own application never stores your IP address, and we do not combine the hosting logs with the usage statistics.
6. Who we share data with
- Hosting: the Site, the license server, the usage statistics and the download counter are hosted by OVHcloud (France/EU), which processes data on our behalf to keep them online.
- Creem: CrossFlow licenses are sold through Creem (Armitage Labs OÜ, Tallinn, Estonia, EU), which acts as merchant of record and license issuer. Creem collects and processes your billing and account information when you purchase, under Creem’s own privacy policy. Our license server sends it your license key and the computer identifier above to verify the key, under Creem’s data processing agreement; some of Creem’s own service providers are in the United States, covered by Standard Contractual Clauses.
- Mega: when you choose to send us your CrossFlow logs for support, the upload link in the App stores the archive with Mega Limited (New Zealand, a country recognised by the European Commission as providing adequate data protection), from where we download it. Log archives can contain your computer and user name, file paths and the names of your projects, sequences and clips; we use them only to diagnose your issue and delete them within 3 months of resolving it.
- Brevo: if you sign up for CrossFlow news by email, or buy a CrossFlow license (Section 3.6), your email address, and whether you opened our emails and clicked their links, are stored by Brevo (Sendinblue SAS, France/EU), which sends those emails on our behalf as our processor.
- CookieYes: the cookie banner is provided by CookieYes Limited (United Kingdom, a country recognised by the European Commission as providing adequate data protection), which keeps an anonymous record of each consent choice on our behalf.
- Automattic: the Site’s images are delivered by Jetpack’s image service, run by Automattic Inc. (United States), which sees your IP address when it sends you an image. Transfers to Automattic are covered by the EU-US Data Privacy Framework and/or Standard Contractual Clauses, as applicable.
- GitHub: CrossFlow installers, the App’s update information, in-app news and changelog are hosted on GitHub, Inc. (United States), which sees your IP address when the Site’s download links or the App fetch them, under GitHub’s privacy statement.
- Google: Google Analytics, Google Ads (to measure the results of our ads, with your consent), Google Search Console, Google reCAPTCHA (for the newsletter forms), YouTube (for the videos embedded in the Site), and Google Forms (for the Beta signup, now closed) are provided by Google LLC, based in the United States. Transfers of data to Google are covered by Google’s own compliance mechanisms, including the EU-US Data Privacy Framework and/or Standard Contractual Clauses, as applicable.
- We do not sell personal data, and we do not share it with third parties for their own marketing purposes. The anonymous usage statistics are never shared with anyone.
7. Data retention
- Contact form submissions are kept only as long as needed to handle your enquiry, and are deleted or anonymised afterwards unless a longer retention is legally required.
- Log archives sent for support are deleted within 3 months of the issue being resolved.
- Order details received from Creem are kept as long as your license is valid and for the period required by tax and accounting law; the answers to the thank-you page question are kept as totals only, and the individual answers are deleted within 12 months.
- Cookie consent choices are kept for up to 12 months, after which you will be asked again.
- Beta signup responses collected with Google Forms are deleted by 31 December 2026, once the launch offers promised to Beta participants have been sent.
- Email addresses on the CrossFlow news list, with their open and click records, are kept until you unsubscribe.
- Email addresses on the customers list, with their open and click records, are kept until you unsubscribe or your order is refunded.
- Download counts are monthly totals only and contain no personal data.
- Google Analytics data is retained for 14 months, after which it is automatically deleted.
- Google Ads cookies expire after at most 90 days.
- The computers registered to a CrossFlow license are kept for as long as the license is valid; a computer that has not checked its license for 3 years is removed, and a refunded or revoked license is deleted within 30 days.
- CrossFlow usage statistics, with or without the optional installation identifier, are kept for 24 months from reception, then deleted automatically.
8. Your rights
Under the GDPR, you have the right to:
- Access the personal data we hold about you
- Rectify inaccurate data
- Erase your data (“right to be forgotten”)
- Restrict or object to processing
- Data portability, where applicable
- Withdraw consent at any time (e.g. via the cookie button at the bottom left of the Site, the unsubscribe link in our emails, or the usage statistics options in the App’s Settings & License), without affecting the lawfulness of processing before withdrawal
To exercise any of these rights, contact us at contact@nablast.com. We will respond within one month, as required by law. For the optional installation identifier (Section 5.4), include the identifier shown in the App, since it is the only link between you and those records.
You also have the right to lodge a complaint with the French data protection authority, the CNIL (Commission Nationale de l’Informatique et des Libertés), at cnil.fr, or with the supervisory authority in your own EU country of residence.
9. Security
We take reasonable technical and organisational measures to protect the personal data we handle against unauthorised access, loss, or misuse. License server answers are cryptographically signed, the usage statistics are validated field by field before being stored so that nothing outside the list above can be recorded, and our servers never store IP addresses. No online service can guarantee absolute security, but we work with hosting and service providers that maintain industry-standard protections.
10. Children’s privacy
The Site and the App are not directed at children, and we do not knowingly collect personal data from children.
11. Changes to this policy
We may update this policy from time to time, for example if we add new tools or change how the Site or the App works. The “Last updated” date at the top will reflect the most recent revision. Material changes will be reflected here; we encourage you to review this page periodically.
12. Contact us
For any question about this policy or your personal data, contact:
FAVRE-MARINET Nicolas
contact@nablast.com