InGestX Pro

InGestX Pro / Privacy notice

InGestX Pro — Privacy Notice

Publisher: Galaxy D2C · Legal Entity: 13th Bunker Studios Inc. · Developer: Sylvester A. Sessoms Jr. · Last updated: October 17, 2026

1. Our commitment to privacy

InGestX Pro is published by Galaxy D2C (legal entity: 13th Bunker Studios Inc., located in Philadelphia, Pennsylvania, USA). Galaxy D2C respects the privacy of its customers and recognizes the importance of protecting business documents, personal information, intellectual property, and confidential data.

This notice explains how information is handled when you visit the InGestX Pro website (https://www.ingestxpro.com), create an account, purchase or activate software, request customer support, or use the InGestX Pro Windows desktop application.

2. Information we process

Depending on how you interact with our services, information may include:

  • Account information: Name, email address, optional organization name, account role, cryptographically salted password hash (scrypt), and account identifiers.
  • Purchase information: Product and edition purchased, order identifiers, transaction amount and currency, promotional or partner referral code used, transaction status, and billing records.
  • License and device activation information: License identifiers, masked license keys, activation records, workstation hostname and platform (for example, Desktop (win32-x64)), and a privacy-conscious, one-way saltedSHA-256 hardware fingerprint (dev_<hash>) derived locally from your operating system's machine GUID, CPU model, OS major release, and processor architecture to manage your 2-machine license entitlement.
  • Support information: Messages, diagnostic information, and attachments you voluntarily provide when requesting support.
  • Website and API technical logs: Technical request logs, IP addresses (or one-way cryptographic IP hashes in application audit logs), browser/user-agent headers, and security-related events.
  • Customer documents (Local Only): Files, folders, code repositories, media, and URLs you explicitly select for processing within the desktop application on your computer.

Not every category is collected in every interaction. Customers who purchase and install InGestX Pro solely through the Microsoft Store are not required to create a separate Galaxy D2C website account unless they choose to use direct Galaxy D2C portal services.

3. Local document processing

InGestX Pro is engineered to perform document ingestion, bundled OCR, media transcription and conversion, parsing, and structured export (JSONL, Parquet, CSV,SQLite) locally on your Windows computer.

  • No Cloud Document Upload: Local document processing does not upload your files, extracted text, or exported datasets to Galaxy D2C servers.
  • No Automatic Crash Uploads: The desktop application's crash reporter is configured offline (uploadToServer: false) and does not automatically transmit crash dumps over the internet.
  • Customer Control & Responsibility: Files you select may contain personal, confidential, commercial, or proprietary information. The application requires local read/write access to the selected content to perform the operations you request. You are responsible for selecting appropriate files, controlling local storage permissions, and protecting access to your computer and processed outputs.

4. Website URL ingestion, optional AI, and third-party integrations

  • Website URL Ingestion: When you use InGestX Pro's Web URL ingestion feature, your computer makes direct HTTP/HTTPS requests to the target websites you specify. Those requests expose your network IP address and standard request headers directly to the destination website under that website's terms and privacy practices.
  • Local vs. External AI Integrations: By default, InGestX Pro's optional AI features are configured for local loopback execution on your own workstation (including the bundled offline intelligence runtime, Qwen Local (Ollama) at127.0.0.1:11434, or local OpenAI-compatible servers at127.0.0.1:1234). If you manually configure and invoke an external cloud AI model, remote API, or third-party automation service, information submitted to that service is processed under the third party's own privacy and security terms. Users should review the destination, provider, and data involved before transmitting confidential or personal information.

5. Purchases, payment processing, and referral attribution

  • Website Purchases (Stripe): Direct purchases through the InGestX Pro website are processed through Stripe, Inc.During checkout, Galaxy D2C transmits your account email address, user identifier, selected product SKU/edition, and any applied promotional code to Stripe. Payment card numbers and credentials are processed directly by Stripe according to its own terms and PCI-DSS security obligations and are never stored on Galaxy D2C servers.
  • Microsoft Store Purchases: Purchases made through the Microsoft Store (Microsoft Store ID 9N53G9NB44XH) are processed by Microsoft Corporation and are subject to Microsoft's applicable commerce and privacy practices (Microsoft Privacy Statement).
  • Promotional & Partner Referral Codes: Galaxy D2C receives transaction and customer information necessary to fulfill purchases, issue licenses, provide support, maintain records, and investigate payment issues. If you voluntarily apply a partner referral or promotional code (such as an authorized sales partner discount code) at checkout, non-card transaction attribution records (order identifier, SKU, transaction amount, currency, referral code, status, and order date) may be shared with the associated authorized sales partner (such as StarBrite Entertainment Inc.) for commission verification.

6. How information is used

Information may be used to:

  • Provide software purchases, downloads, and license activation.
  • Maintain customer accounts and 2-machine seat entitlements.
  • Deliver customer support and respond to technical problems.
  • Protect services against fraud, piracy, and unauthorized access.
  • Maintain financial, tax, commission, and business records.
  • Meet legal and regulatory obligations.
  • Improve services using information collected for legitimate operational purposes.

Personal information is not required for unrelated purposes merely because a customer uses the desktop application.

7. Service providers and disclosures

Information may be disclosed to sub-processors and service providers performing necessary operational services on our behalf, including:

  • Payment processing & digital commerce: Stripe, Inc. (for direct website purchases) and Microsoft Corporation (for Microsoft Store purchases).
  • Website & API hosting infrastructure: Vercel Inc. (application delivery and edge request handling).
  • Database & authentication storage: Managed PostgreSQL / Supabase infrastructure (storing account, order, license, device fingerprint hash, and audit records).
  • Authorized support & partner operations: Email service providers for customer support communications, and authorized sales partners solely for orders where a partner referral code was used.

Disclosures may also occur when legally required, to protect legitimate rights and safety, or as part of an authorized corporate merger, acquisition, or asset transaction. Customer-selected integrations within the desktop application may transmit information to providers chosen or configured by the customer.

8. Data storage and retention

  • Local Workstation Storage (%APPDATA%\InGestX Pro):Documents processed locally remain under the control of the computer user. Application settings, workspace metadata, job queues, local audit logs (application.log), signed activation tokens (license-token.json, which support a 30-day offline verification window), AI Continuity Vault records, and exported files (defaulting to Documents\InGestX Exports) are stored on your local disk.Clearing completed rows from the in-app job queue does not delete underlying job history logs or exported files on disk, and uninstalling InGestX Pro does not automatically delete customer workspaces or exported files.You can delete these local directories at any time using Windows File Explorer.
  • Cloud Account, License & Order Retention: Galaxy D2C retains account, purchase, support, and licensing records according to operational necessity and legal obligations:
    • Account & License Activation Records: Retained while your account or perpetual software license remains active so you can manage device activations and downloads, unless you request account deletion.
    • Order, Tax & Financial Records: Retained for at leastseven (7) years (or the applicable statutory period) to comply with tax, accounting, and audit obligations.
    • Session Tokens & Security Audit Logs: Authenticated web sessions expire after seven (7) days; single-issue download tokens expire after their designated time window or download limit (maximum 5 downloads per token); and security audit logs store hashed IP identifiers (ip_hash) for fraud and abuse prevention.

9. Data security

Galaxy D2C uses administrative, cryptographic, and technical safeguards to protect information under its control, including TLS/HTTPS encryption in transit, scrypt password hashing, HMAC-SHA256 session signing, Ed25519 cryptographic license tokens, and Electron context isolation and sandboxing in the desktop client.

However, no electronic storage system, internet transmission, or software environment can be guaranteed completely secure. Customers should maintain current operating-system updates, appropriate workstation access controls, secure backups, and careful handling of sensitive files.

10. Website cookies, session storage, and technical logs

  • Strictly Necessary Session Storage & Cookies: The InGestX Pro website and backend use strictly necessary browsersessionStorage (glx_token) and/or a signed HTTP-only session cookie (glx_session_token, valid for up to 7 days) to support account sign-in, license management, and checkout security. When you proceed to payment checkout, Stripe uses strictly necessary cookies for transaction processing and fraud prevention.
  • No Third-Party Advertising or Cross-Site Tracking Cookies:The InGestX Pro website does not load third-party advertising cookies, behavioral profiling pixels, or cross-site marketing trackers. Where optional analytics technologies are ever introduced in the future, additional disclosures and prior consent choices will be provided as required by applicable law.
  • Browser Controls: Browser settings allow you to restrict or clear cookies and session storage, although doing so may affect account sign-in and checkout functions.

11. Your privacy choices and global data-protection rights

Depending on your jurisdiction (including the European Economic Area (EEA), the United Kingdom, Switzerland, Canada, Brazil, Australia, New Zealand, Japan, South Korea, and applicable U.S. states), you may have rights to:

  • Request access to, or a portable copyof, personal information held by Galaxy D2C;
  • Request correction of inaccurate personal information or deletion of personal information (subject to mandatory legal and tax retention obligations);
  • Request restriction of processing,object to certain processing, orwithdraw consent where processing is based on consent;
  • Deactivate a licensed workstation seat at any time through the desktop application or online customer portal.

U.S. State Privacy Disclosures (CCPA/CPRA & State Laws):Galaxy D2C does not "sell" personal information or "share" personal information for cross-context behavioral advertising, and does not discriminate against customers for exercising their privacy rights.

Requests can be submitted tosupport@galaxyd2c.com. We may need to verify your identity (such as confirming control of the email address associated with your account or order) before fulfilling certain requests. For documents stored solely on your own computer, local file-management and deletion controls remain your primary means of managing that information.

12. International customers, legal bases (GDPR/UK GDPR), and cross-border transfers

InGestX Pro is made available to customers worldwide, including across Microsoft Store global markets:

  • United States Processing: Galaxy D2C is established in the United States. Website, payment, licensing, support, and cloud database providers process account, order, and license information in the United States and other jurisdictions where our service providers operate.
  • Lawful Bases for Processing (EEA, UK & Switzerland):Under the EU General Data Protection Regulation (GDPR), UK GDPR, and Swiss Federal Act on Data Protection (FADP), Galaxy D2C acts as the data controller for customer account, direct order, and licensing data and processes personal data on the following legal bases:
    • Performance of a Contract (Art. 6(1)(b) GDPR): To process purchases, issue and verify software licenses, manage 2-machine activations, provide downloads, and deliver customer support;
    • Legal Obligation (Art. 6(1)(c) GDPR): To satisfy tax, accounting, financial recordkeeping, and regulatory compliance requirements;
    • Legitimate Interests (Art. 6(1)(f) GDPR): To maintain website and API security, prevent fraud and unauthorized license sharing using hashed device identifiers, and ensure service reliability;
    • Consent (Art. 6(1)(a) GDPR): Where you voluntarily submit optional diagnostic logs or opt in to specific communications.
  • International Transfer Safeguards: When personal information is transferred outside your home jurisdiction (including from the EEA, UK, Switzerland, Brazil, Canada, Australia, or Japan to the United States), we rely on recognized legal transfer mechanisms, including our service providers' certifications under theEU-U.S. Data Privacy Framework (and the UK Extension and Swiss-U.S. Data Privacy Framework), Standard Contractual Clauses (SCCs)approved by the European Commission and UK authorities, or necessity for the performance of your software purchase and license contract (Art. 49(1)(b) GDPR).
  • Supervisory Authority Rights: If you reside in the EEA, UK, Switzerland, Brazil, Canada, or another jurisdiction with a data-protection authority, you have the right to lodge a complaint with your local supervisory authority (such as an EU Member State Data Protection Authority, the UK Information Commissioner's Office (ICO), the Swiss FDPIC, or the Brazilian ANPD).

13. Children's privacy

InGestX Pro is intended for professional, business, and general productivity use, and is not designed for or directed to children under the age of 13 (or under 16 in the EEA, UK, or jurisdictions with a higher age of digital consent). Galaxy D2C does not knowingly collect personal information from children.

14. Updates to this notice

This notice may be updated to reflect changes in application functionality, integrations, operational practices, or legal requirements. The latest version will be published at:https://www.ingestxpro.com/privacy/

15. Contact and data controller information

For privacy questions, data-protection rights requests, or concerns, contact:

Publisher: Galaxy D2C
Legal Entity: 13th Bunker Studios Inc.
Developer: Sylvester A. Sessoms Jr.
Location: Philadelphia, Pennsylvania, USA
Privacy Contact: support@galaxyd2c.com
Website: https://www.ingestxpro.com
Support Page: https://www.ingestxpro.com/support/