Effective date: September 27, 2026
DMX Pro Sales, LLC ("DMX Core", "we", "us", or "our") makes the DMX Core 100 and related products. This policy explains what data we collect, store, and transmit, why, who processes it on our behalf, how long we keep it, how we protect it, and the controls you have.
It covers the dmxcore.com website, the DMX Core portal at portal.dmxcore.com, and the DMX Core 100 software, whether it runs on a DMX Core 100 appliance or as the desktop application on Windows, macOS, or Linux. Our online store at dmxprosales.com has its own privacy policy.
When you visit our website we automatically collect your IP address, browser type and version, the pages you visit, the referring page, and the date and time of your visit. We use Google Tag Manager and Google Analytics for this, which set cookies. If you use the chat widget, LiveChat processes the conversation and any name or email address you provide. If you contact us by email or through a form, we keep your name, email address, and message so we can respond.
Hardware and software licenses are sold through our store at dmxprosales.com and through authorized resellers, under their own policies. Remote-access and automatic-update subscriptions purchased in the DMX Core portal are processed by Stripe. Card numbers go directly to Stripe and never reach our servers. We store Stripe customer, checkout, and subscription identifiers together with your order history so we can manage your entitlements and provide invoices.
To use the portal you create an account. We store your email address, name, a hashed password (or, if you sign in with Microsoft or Google, the email address and name those services share with us), your multi-factor authentication settings including trusted devices, the time you accepted our terms, and your membership and role in each account you belong to.
The portal keeps an account audit log of actions taken in your account: who did what and when, including opening a remote tunnel, running a remote operation, changing team members, and any support access by our staff. Support access is recorded and visible to you in that log.
We send transactional email from the portal: sign-in and security messages, team invitations, device alerts you configure, and order confirmations. These are delivered through Microsoft Azure Communication Services. Our newsletter is a separate opt-in list at newsletter.dmxcore.com.
The DMX Core 100 keeps its data on the device or computer where it runs: cues, presets, timelines, effects, audio files, fixture configuration, schedules, input triggers, custom menus, settings, device user accounts (names, roles, sign-in credentials, and API keys), the audit log of actions taken on the device, and application log files.
On the desktop application this data lives in %LocalAppData%\DMXCore100 on Windows and ~/dmxcore100-data on macOS and Linux. Uninstalling the application does not remove this folder; delete it yourself if you want the data gone. On an appliance, Factory Reset under Utilities > System wipes the content.
None of this data leaves the device except as described in sections 5 and 6.
The following happens whenever the device has internet access. You can prevent all of it by running the device on a network without internet access; the software works fully offline.
License validation and device registration. The software contacts api.dmxcore.com at startup and periodically to validate its license and fetch its entitlements. It sends a device identifier computed from hardware characteristics (on Windows the machine GUID, processor ID, motherboard serial number, and system drive serial number; on Linux the machine ID, CPU information, and motherboard serial number; on macOS the platform serial number), the computer name, operating system version, application version, deployment type, release channel, and, on appliances, the balena device ID and name. This is the identifier a purchased license is tied to. We use it to issue and validate licenses, to associate the device with your portal account, and to decide which software releases to offer.
Diagnostic logs. The software sends its application log to a log service we use for support and troubleshooting. Log events include errors and warnings, startup and shutdown steps, performance figures such as CPU and memory usage, output and network status, and usage events that describe which features were used. Events carry the first characters of the device identifier, the computer name, and the application version, and they may include the names of device user accounts, the local IP addresses and names of lighting devices on your network, and file names of content. They do not include your show content, audio, PINs, passwords, API keys, or tokens; these are excluded before logging. Logs are kept for 100 days and then deleted. Access is limited to our staff, and to the help assistant described in section 6 when you enable it for a device.
Update checks. The desktop application checks downloads.dmxcore.com for new releases. Appliances receive operating-system and application updates through balena. In both cases the server records the requesting IP address in its access logs.
Audit log sync. Once a device is registered to a portal account, its audit log (timestamp, action, device user name, details, and the address on your local network the action came from) is copied to the portal so you and your team can review it there. Until the device is registered, nothing is uploaded.
Device status. Devices registered to a portal account report their online state, last-seen time, model, local and public IP address, MAC address, operating system and software versions, uptime, and the status of peripherals you monitor (for example the temperature, supply voltage, and output current of an Advatek controller).
Appliance fleet management. DMX Core 100 appliances are managed through balena, which receives the device UUID, online state, operating-system and supervisor versions, and public IP address, and delivers updates. Balena's privacy policy applies to that processing.
These features send data only when you turn them on or use them.
Cloud backup. When you create a cloud backup, a full backup of the device (everything listed in section 4, including device user accounts, settings, cue files, and audio) is uploaded to api.dmxcore.com and stored in Microsoft Azure Blob Storage in the United States, encrypted at rest. Backups are kept until you delete them or close your account. A cloud backup can be restored to the same device or to another DMX Core 100 unit.
Remote access. With Enable Remote Access turned on under Device > System, the device keeps an outbound, encrypted connection to api.dmxcore.com. The portal uses it to show device status, to trigger remote operations you request (reboot, restart, backup, configuration snapshot), and, with a remote-access subscription, to relay the device's Web UI, the Remote Screen view of the touchscreen, and the web UI of any monitored device you choose to expose. We relay this traffic; we do not store the pages or screens. Each tunnel session is recorded in your account audit log with the user, device, and time. Remote access is on by default when the device has internet access and can be turned off at any time.
Health monitoring and alerts. Peripheral status reported under section 5 is shown in the portal. If you configure alert emails for a device, we send them to the recipients you enter.
Help assistant. The portal includes a help assistant that answers how-to questions about your device. When you press Capture snapshot, the device uploads a configuration snapshot (settings, fixtures, outputs, schedules, triggers, and similar configuration; credentials, media, and show content are excluded). To answer a question, the assistant may send your question, that snapshot, recent diagnostic log events from the device, and our public documentation to an AI model provided by OpenAI. OpenAI processes this data under its API terms, which do not permit it to use the data to train its models. Snapshot and log sharing can each be turned off per device in the portal, and a snapshot is only captured when you press the button.
Admin PIN recovery. The device and the portal share a recovery key so you can reset a lost admin PIN. The reset exchanges short challenge and response codes and is recorded in both the device audit log and your account audit log.
Demo data. Creating demo data downloads sample content from our cloud. Nothing is uploaded.
Integrations you configure. MQTT brokers, Home Assistant, OSC, Q-SYS, smart bulbs, and similar integrations exchange data directly between the device and the systems you configure, not through our servers. Plugins are downloaded from nuget.org, which records the requesting IP address. Plugins published by others are governed by their own policies.
We use these providers to process data on our behalf. Each is bound by its own terms and privacy policy.
We use the data described above to provide and maintain the product and portal, issue and validate licenses, deliver updates, respond to support requests and diagnose problems, keep the service secure, process orders and subscriptions, send the notifications you ask for, improve the product, and comply with legal obligations. Where the law requires a legal basis, we rely on performance of our contract with you, our legitimate interest in running and securing the product, your consent for optional features and marketing, and compliance with law.
We do not sell personal data and do not share it for advertising. We share data with the service providers in section 7; with installers or integrators you add to your portal account, who then see the devices in that account; with authorities when required by law or to protect our rights; and, in the event of a merger, acquisition, or sale of assets, with the successor as part of that transaction.
You can delete cloud backups and remove devices from your account in the portal, and you can ask us to delete your account and associated data by contacting us.
All connections between the device, the portal, and our cloud use TLS. Devices only make outbound connections; nothing needs to be opened on your firewall. Data stored in our cloud is encrypted at rest. Credentials, tokens, and API keys are excluded from diagnostic logs and configuration snapshots. Portal accounts support multi-factor authentication and role-based access, and every privileged action, including support access by our staff, is recorded in the account audit log. Our Windows and macOS installers are code-signed. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.
Depending on where you live, you may have the right to access, correct, export, or delete your personal data, to object to or restrict its processing, and to withdraw consent. To exercise these rights, contact us using the details below. We will not treat you differently for exercising them. If you are in the European Economic Area or the United Kingdom, you may also lodge a complaint with your local data protection authority.
We are based in the United States and our services are hosted there. If you use our products from another country, your data is transferred to and processed in the United States.
Our services are not directed to anyone under the age of 13. We do not knowingly collect personal data from children under 13. If we become aware that we have collected such data, we will take steps to remove it.
We may update this privacy policy from time to time. We will post the new policy on this page and update the effective date. For significant changes affecting the product, we will also note the change in the product release notes.
If you have questions about this privacy policy or want to exercise your rights, please contact us.
DMX Pro Sales, LLC
7301 Ranch Rd 620 N, Ste 155-328
Austin, TX 78726