Join the beta
Legal

Privacy Policy

What we collect, why, who processes it and how to make us delete it. Short version: as little as possible, no raw IPs, no data sales.

Last updated: 26 July 2026

Controller

Controller
Phaseburn Music, operated by Pavel Burylichev (independent developer, Georgia)
Registered office
Leo and Nodar Gabunia Street 39, Unit 103, Tbilisi, Georgia. Please also send a copy of any postal correspondence to contact@phaseburn.music — requests are processed fastest by email.
Contact
contact@phaseburn.music — or use the contact form.
EU representative
Where an Article 27 GDPR representative is required, we will designate one; until then, and where the occasional-processing exemption applies, data-protection requests reach us directly at contact@phaseburn.music.

What we process, per feature

Beta download

Email — required on the download page — plus the platform you picked (macOS or Windows). Used to run the beta: deliver your download link, count contribution activity for beta perks, and contact you about your reports. If you joined through the earlier sign-up form, we may also hold the name, DAW and notes you chose to share then.

Email lists

We run two separate lists, and you control them independently — being on one never puts you on the other:

  • Newsletter — new blog posts from the lab notebook. Joined via the form in the site footer or the box on /download, always with double opt-in: the address counts as subscribed only after you click the confirmation link we email you.
  • Release updates — the download link when the beta opens, and a short note whenever a new build ships. Joined by ticking the dedicated box on /download.

For each list we record your email address, when you consented, which form you used and a salted hash of your IP address at that moment. We keep that record so we can demonstrate that consent was given, as the GDPR requires — it is evidence, not marketing data.

Unsubscribing takes one click and applies immediately. Every email carries an unsubscribe link for the specific list it came from, plus the standard List-Unsubscribe headers, so your mail app's own "unsubscribe" button works too. Leaving one list never affects the other, and you can also write to unsubscribe@phaseburn.music. Once you leave a list we will not put you back on it — returning requires a fresh confirmation from you.

Contact form

Email, topic and your message — used solely to answer you.

AI assistant (site chat)

The chat widget is an automated AI assistant, labeled as such in line with the EU AI Act's transparency rules — you are never chatting with a person there. The messages you type (plus the last few turns of the same conversation) are sent to our server only to generate the reply, using an AI model running on Cloudflare Workers AI. We do not store chat content: no chat logs are kept on our side, and your conversation history lives only in your browser for the current tab session. The only server-side records are anonymous per-IP rate counters that expire within 48 hours. Answers are generated and can be inaccurate; please do not enter personal data into the chat.

Preset submission

Email, preset title, the preset file, and your confirmation that you hold the rights to what you submit. Standout presets ship in the factory bank credited to their authors, so the name you provide may appear in the product.

Orders and licenses

Name, email, billing country, tax status, order details and your license key. Payment is handled by Paddle as Merchant of Record: your card data goes to Paddle directly and never touches our servers, and Paddle passes us the payment confirmation and the details needed for tax records.

License activation

Activating the plugin on a machine records a one-way machine fingerprint — a hash that cannot be reversed into your hardware details — together with the machine's operating system and its hostname. The hostname serves only as a label: you can rename it or deactivate the machine at any time on the license page. We store these with your license to enforce the three-machine activation limit.

Analytics

Cloudflare Web Analytics — cookieless and aggregate — runs without consent because it stores nothing in your browser. In addition, only if you accept the cookie banner, we use Google Analytics 4 to understand how the site is used. It sets first-party cookies (_ga, _ga_*) holding a random identifier — no name, no email — and Google LLC processes the data on our behalf; transfers to Google are covered by the EU–US Data Privacy Framework and standard contractual clauses. Decline the banner (or ignore it) and Google Analytics never loads. You can change your choice at any time on the Cookie Policy page. No cross-site tracking, no advertising identifiers, no profiles either way.

Abuse prevention

We never store raw IP addresses. Where rate limiting and abuse prevention need them, IPs are stored only as salted hashes.

Lawful bases

  • Consent — the newsletter and release-update lists (each consented to separately and withdrawable separately), Google Analytics (set only after you accept the cookie banner, withdrawable on the Cookie Policy page), and the AI assistant when you choose to chat with it.
  • Contract — orders, delivery, license management, beta participation.
  • Legitimate interests — site security, abuse prevention, aggregate cookieless analytics.
  • Legal obligation — tax and accounting records for sales.

Processors

  • Cloudflare — hosting, CDN, form handling, cookieless Web Analytics, and Workers AI (generates the AI assistant's replies; chat content is processed transiently and not stored by us).
  • Google LLC — Google Analytics 4, only after you accept the cookie banner (see Cookie Policy); processes usage data under the Google Ads Data Processing Terms.
  • Cloudflare Turnstile — invisible bot protection on our public forms. When you use a form, Turnstile analyzes browser and device signals to tell humans from bots, usually without showing any challenge. That processing is governed by the Cloudflare Turnstile Privacy Addendum and the Cloudflare Privacy Policy.
  • Paddle — our authorised reseller and Merchant of Record for card payments and VAT. Governed by the Paddle Buyer Privacy Notice.
  • Tolt — affiliate/referral attribution. When you arrive via an affiliate link, Tolt records the referral so a completed purchase can be credited; it does not receive your payment details. Governed by the Tolt Privacy Policy.
  • Resend — transactional and newsletter email delivery (confirmation links, beta emails, contact notifications).
  • Cloudflare Workers AI — powers the on-site assistant. Messages you type into the chat are processed on Cloudflare's model infrastructure to generate a reply; we do not store chat transcripts. The assistant is clearly marked as automated. It is not part of the instrument — no AI in the sound.

International transfers

The controller is based in Georgia, outside the EEA. Our processors may store data in the EU or the United States. Where personal data of EU residents leaves the EEA, we rely on appropriate safeguards — standard contractual clauses with each processor — and keep the inventory above current.

Retention

  • Beta data — until the beta ends, then deleted within 90 days unless you convert to a paid license.
  • Email lists — until you unsubscribe; unsubscribes take effect immediately. We keep a record that the address unsubscribed, and the consent evidence for it, so we can honour the request and prove we did.
  • Contact messages — 12 months after the thread closes.
  • Order and license records — for as long as needed to verify your license, plus statutory tax retention periods.
  • Salted IP hashes — 30 days.

Your rights

You can request access, rectification, erasure, restriction of processing and portability, you can object to processing based on legitimate interests, and you can withdraw consent at any time without affecting past processing. You can also complain to your local supervisory authority. The practical route for all of these is the contact form.

No sale of data

We do not sell personal data, and we run no third-party advertising. There is nothing here to monetise.

Changes

When this policy changes we update this page and the date above; material changes will be announced to affected users. Cookies have their own page: the Cookie Policy.