Privacy Policy
Last updated: 13th September 2026
1. Who we are
This website, nablast.com (the “Site”), and the CrossFlow desktop application (the “App”) are operated by:
FAVRE-MARINET Nicolas
SIRET: 84045292400037
Contact: contact@nablast.com
For the purposes of the EU General Data Protection Regulation (GDPR), FAVRE-MARINET Nicolas is the data controller responsible for the personal data described in this policy. This applies wherever you are located: the controller is established in France, so the GDPR governs this processing for every user of the Site and of the App.
2. Scope of this policy
This policy explains what personal data the Site and the App collect, why, and what rights you have over it. The Site does not publish a blog or articles with comments, so no comment or account data is collected through that route.
This policy covers:
- Visiting nablast.com and its pages (CrossFlow product pages, docs, pricing, about, contact)
- Submitting the contact form
- Cookies set while browsing the Site
- The external Beta signup form (hosted by Google Forms, linked from the Site)
- The network communications of the CrossFlow App: license activation, update check, and anonymous usage statistics (Section 5)
3. What data we collect and why
3.1 Contact form
The Contact page uses Kadence Blocks’ built-in form. When you submit it, we collect the information you enter (typically name, email address, and message). This data is:
- Used solely to respond to your enquiry
- Sent to contact@nablast.com and/or stored in the Site’s admin dashboard for a limited time to allow us to follow up
- Not used for marketing unless you separately opt in
- Not shared with third parties, except the hosting and email infrastructure needed to deliver it to us (see Section 6)
Legal basis: your consent, given by submitting the form (Art. 6(1)(a) GDPR), and/or our legitimate interest in responding to enquiries (Art. 6(1)(f) GDPR).
3.2 Beta signup (Google Forms)
The CrossFlow Beta signup CTA links out to a form hosted on Google Forms. Any data you submit there is collected and processed by Google under Google’s own Privacy Policy, not this one. We only receive the responses you choose to submit (typically name/email and beta-related questions) in order to manage the Beta program.
Legal basis: your consent, given by submitting the form.
3.3 Automatically collected data (cookies & similar technologies)
See Section 4 below.
4. Cookies
4.1 What cookies are
Cookies are small text files placed on your device when you visit a website. Some are strictly necessary for the Site to function; others help us understand how the Site is used or are set by third-party services embedded in the Site.
4.2 Cookies and services used on this Site
| Category | Purpose | Set by | Requires consent? |
|---|---|---|---|
| Strictly necessary | Core WordPress functionality (e.g. security, load balancing) | nablast.com | No: essential to the Site working |
| Analytics | Google Analytics (GA4) measures visits, page views, and general traffic patterns to help us understand how the Site is used | Yes: blocked until you accept | |
| Search performance | Google Search Console helps us understand how the Site performs in Google Search results | Handled via cookie banner | |
| Fonts | The Site loads typefaces from Google Fonts’ servers. Loading a font transfers your IP address to Google, even though no cookie is necessarily set | Handled via cookie banner |
We do not currently run advertising cookies or cross-site tracking.
4.3 Managing your consent
On your first visit, a cookie banner lets you accept or refuse non-essential cookies (analytics, search performance, and font-loading categories above). Non-essential scripts, including Google Analytics, do not run until you accept. You can change your choice at any time via the “Cookie Settings” link in the Site’s footer. Refusing non-essential cookies does not prevent you from using the Site’s core content.
5. The CrossFlow App
CrossFlow converts Adobe Premiere Pro projects to DaVinci Resolve projects. It does all of that work on your computer. Your project files, your media files, and the names and paths of your projects, sequences, clips and media are never sent to us. The App contacts the network in exactly three cases, described below. Everything the App sends can be seen in the App itself: open Settings & License and click “See exactly what is sent”.
5.1 License activation
When you activate, validate or deactivate a license, or release the computers registered to your license, the App contacts our license server at nablast.com. Each request contains:
- your license key
- an identifier of your computer, derived from your operating system’s installation identifier (not your computer’s name, and not reversible into it)
- the name of your computer as set in your operating system, followed by “Windows” or “macOS”, so that you can recognise it when you manage the computers registered to your license
- the version of CrossFlow, and the major versions of Premiere Pro and DaVinci Resolve in use where the App knows them
Our server verifies the key with Creem, our merchant of record and license issuer (see Section 6), and keeps the list of computers registered to each license, since a license is valid on a limited number of computers. The server’s signed answer is cached on your computer so that CrossFlow keeps working for a period without a network connection. A valid license is re-checked about once a week when the App starts.
Legal basis: performance of the contract (Art. 6(1)(b) GDPR): this is what lets us deliver the license you bought to the computers you use it on.
Retention: licenses are perpetual, so the list of computers registered to a license is kept for as long as the license is valid. A computer that has not checked its license for 3 years is removed from the list (activating it again simply registers it anew). A refunded or revoked license is deleted from the list within 30 days.
5.2 Update check
Unless you disable it in Settings (“Disable Auto-Update at opening”), the App checks at startup whether a newer version exists by downloading a small version list hosted on GitHub (GitHub, Inc., United States). As with any download, your IP address is disclosed to GitHub for that request. Nothing else is sent, and we receive nothing from it.
Legal basis: our legitimate interest in keeping installed copies up to date and secure (Art. 6(1)(f) GDPR). You can object by disabling the check.
5.3 Anonymous usage statistics
To understand how CrossFlow is used and decide what to improve, the App sends us anonymous statistics at the end of each conversion and once per week of use. This is on by default, and you can turn it off at any time in Settings & License. A notice tells you about it the first time you open the App.
What is sent:
- the versions of CrossFlow, Premiere Pro, DaVinci Resolve and your operating system (Windows 10 or 11, or the macOS version), and the language of your system (two letters, no region)
- the size of the project and the numbers of its media, sequences and clips, always as ranges (for example “20 to 99 clips”), never exact values
- the media file formats present in the project (for example “mov”, “mxf”), without counts or file names
- which CrossFlow features and options were used
- whether the conversion succeeded, with stable codes naming the kinds of problems met (for example “unsupported effect”), and the names of the Premiere Pro effects, blend modes or transitions concerned
- how long each step took, as a range
- the number of conversions you started in a given week
- the week of the event (never the day or the time)
What is never sent: any identifier of you or of your computer, any project, sequence, clip, bin or file name, any file path, your license key, your email address, your user or computer name, or any free text. Counts are sent as ranges precisely so that no event can be matched back to a particular project.
These statistics are anonymous: they are not personal data, and we have no way to link them to you. Our server does not record the IP address they come from. They are collected under the audience-measurement exemption of French law (article 82 of the loi Informatique et Libertés, as interpreted by the CNIL): they measure the App itself, for our own account only, produce anonymous statistics only, are not combined with any other data and are not shared with anyone.
Retention: 24 months from reception, then deleted automatically.
5.4 Optional installation identifier
Separately, and only if you enable it in Settings & License (“Also include an anonymous install ID”), the App attaches a random identifier to a reduced set of statistics: the week, whether the App was in trial mode, whether a conversion succeeded, the weekly number of conversions, and whether the pricing page was opened or a license activation attempted (never the key, never its result message). This lets us see how the use of one installation evolves over time, and whether a trial leads to a purchase.
The identifier is created on your computer from random numbers. It is not derived from your computer, and it is not linked to your license key, your email address or anything else we hold about you. It is deleted when you disable the option, and replaced by a new one if you enable it again.
Legal basis: your consent (Art. 6(1)(a) GDPR), given by enabling the option. You withdraw it by disabling the option, which stops the collection and deletes the identifier on your computer. To have the data already received deleted from our server, send us the identifier shown in Settings & License > “See exactly what is sent”: it is the only way we can find those records, since nothing else links them to you.
Retention: 24 months from reception, then deleted automatically.
5.5 Hosting logs
Like every page of the Site, the App’s requests reach a server hosted by OVHcloud in France. OVHcloud keeps standard web server access logs (IP address, time, address requested) for the operation and security of the hosting, for 12 months, which is the retention French law requires of hosting providers. Our own application never stores your IP address, and we do not combine the hosting logs with the usage statistics.
6. Who we share data with
- Hosting: the Site, the license server and the usage statistics are hosted by OVHcloud (France/EU), which processes data on our behalf to keep them online.
- Creem: CrossFlow licenses are sold through Creem (Armitage Labs OÜ, Tallinn, Estonia, EU), which acts as merchant of record and license issuer. Creem collects and processes your billing and account information when you purchase, under Creem’s own privacy policy. Our license server sends it your license key and the computer identifier above to verify the key, under Creem’s data processing agreement; some of Creem’s own service providers are in the United States, covered by Standard Contractual Clauses.
- Mega: when you choose to send us your CrossFlow logs for support, the upload link in the App stores the archive with Mega Limited (New Zealand, a country recognised by the European Commission as providing adequate data protection), from where we download it. Log archives can contain your computer and user name, file paths and the names of your projects, sequences and clips; we use them only to diagnose your issue and delete them within 3 months of resolving it.
- GitHub: the App’s update check downloads a version list from GitHub, Inc. (United States), which sees your IP address for that request, under GitHub’s privacy statement.
- Google: Google Analytics, Google Search Console, Google Fonts, and Google Forms (for the Beta signup) are provided by Google LLC, based in the United States. Transfers of data to Google are covered by Google’s own compliance mechanisms, including the EU-US Data Privacy Framework and/or Standard Contractual Clauses, as applicable.
- We do not sell personal data, and we do not share it with third parties for their own marketing purposes. The anonymous usage statistics are never shared with anyone.
7. Data retention
- Contact form submissions are kept only as long as needed to handle your enquiry, and are deleted or anonymised afterwards unless a longer retention is legally required.
- Log archives sent for support are deleted within 3 months of the issue being resolved.
- Cookie consent choices are kept for up to 12 months, after which you will be asked again.
- Beta signup data submitted via Google Forms is retained per our Beta program needs and Google’s own retention practices for the underlying form data.
- Google Analytics data is retained for 14 months, after which it is automatically deleted.
- The computers registered to a CrossFlow license are kept for as long as the license is valid; a computer that has not checked its license for 3 years is removed, and a refunded or revoked license is deleted within 30 days.
- CrossFlow usage statistics, with or without the optional installation identifier, are kept for 24 months from reception, then deleted automatically.
8. Your rights
Under the GDPR, you have the right to:
- Access the personal data we hold about you
- Rectify inaccurate data
- Erase your data (“right to be forgotten”)
- Restrict or object to processing
- Data portability, where applicable
- Withdraw consent at any time (e.g. via the Cookie Settings link, or the usage statistics options in the App’s Settings & License), without affecting the lawfulness of processing before withdrawal
To exercise any of these rights, contact us at contact@nablast.com. We will respond within one month, as required by law. For the optional installation identifier (Section 5.4), include the identifier shown in the App, since it is the only link between you and those records.
You also have the right to lodge a complaint with the French data protection authority, the CNIL (Commission Nationale de l’Informatique et des Libertés), at cnil.fr, or with the supervisory authority in your own EU country of residence.
9. Security
We take reasonable technical and organisational measures to protect the personal data we handle against unauthorised access, loss, or misuse. License server answers are cryptographically signed, the usage statistics are validated field by field before being stored so that nothing outside the list above can be recorded, and our servers never store IP addresses. No online service can guarantee absolute security, but we work with hosting and service providers that maintain industry-standard protections.
10. Children’s privacy
The Site and the App are not directed at children, and we do not knowingly collect personal data from children.
11. Changes to this policy
We may update this policy from time to time, for example if we add new tools or change how the Site or the App works. The “Last updated” date at the top will reflect the most recent revision. Material changes will be reflected here; we encourage you to review this page periodically.
12. Contact us
For any question about this policy or your personal data, contact:
FAVRE-MARINET Nicolas
contact@nablast.com