1. Controller and scope
Studiomood Ltd, Gon.Tagm. Dim. Pouliou & Kost. Pantelidi, MELINA COURT, 2nd floor, 8011, Paphos, Cyprus, company registration number HE 495191.
Email: [email protected]. Product support: [email protected].
This policy covers the VolumeKeys website and the related contact, checkout, trial, licensing, measurement and product-channel functions described below. The VolumeKeys app processes routed audio locally. Separate notices from a store, payment provider, social platform or other service can also apply when you choose that service.
2. Website delivery and security
The website is delivered through Cloudflare. When you request a page, technically necessary connection data such as IP address, request time, requested resource, browser information and security signals can be processed to deliver the site, prevent abuse and diagnose failures.
Legal basis: our legitimate interests in secure, reliable website delivery (Article 6(1)(f) GDPR). Where data is necessary to answer a request before a contract, Article 6(1)(b) GDPR also applies.
We do not intentionally export routine delivery logs into a customer-profile database. Account-accessible hosting and security logs are retained according to the active Cloudflare plan and configuration, then deleted or aggregated when no longer needed for security and fault diagnosis.
We separately count requests from self-identifying search, AI, marketing, SEO and link-preview crawlers in daily aggregates to understand how public pages are indexed and accessed. The stored fields are day, crawler provider and category, a sanitised path without query data, resource type, response status, two-letter country code and request count. We do not store an IP address or the full user-agent value in this table and do not link the aggregates to a visitor profile. To the extent a row can be personal data, the legal basis is our legitimate interest in understanding automated access to public pages (Article 6(1)(f) GDPR). The configured maintenance routine applies a 400-day cutoff during its weekly scheduled run. We do not treat that code setting as proof of recurring production deletion; successful production-run evidence remains a verification requirement.
3. Privacy choices
Optional services remain blocked unless you consent. Our consent panel separates Studiomood Intelligence, Cloudflare Web Analytics, Google Analytics 4, advertising, and external media. Refusing is as easy as accepting. The site continues to work when you reject optional services.
A necessary local-storage entry named volumekeys_privacy_choices_v6 stores the selected services, policy version and time for up to 180 days. A new service or material purpose change requires a new consent version. Consent version 6 enables SI only after a visitor expressly selects SI. Cloudflare measurement, advertising and external-media integrations require consent version 7 or later, so they cannot start from a version 6 or older choice.
Withdrawal stops future loading. It clears recognizable first-party analytics storage where we can do so and reloads the page when a previously enabled service is withdrawn. It does not reverse processing that was lawful before withdrawal.
The former VolumeKeys first-party analytics browser script is retired and excluded from the public build. Its collection endpoint is disabled by default. A previously issued __Host-vk_analytics_session cookie is expired on the next request that still sends it. Previously collected consented records remain in the same D1 store and internal report until the existing retention routine deletes them. Activating SI does not restart their retention period.
Technical storage details are listed in our cookie and storage policy.
4. Studiomood Intelligence first-party measurement
This service is active for VolumeKeys. It starts for a visitor only after that visitor explicitly selects Studiomood Intelligence in the consent panel. Rejecting, ignoring or withdrawing that choice prevents future SI browser measurement.
With consent, a local script sends events to a same-origin VolumeKeys endpoint. That endpoint verifies the origin, JSON type and body size, enforces a bounded request limit, and requires the browser to declare that Studiomood Intelligence consent is active. It rejects fields outside the published allowlist and writes accepted events directly to our Cloudflare D1 database used by the private dashboard.
The service can process a random 128-bit session identifier, event identifier, timestamp, page path without query or fragment, language, viewport range, referring hostname, whitelisted UTM fields, page views, ten-second engagement, scroll milestones, navigation targets, configured trial and checkout clicks, configured demo and video interactions, successful contact-form submission without its contents, and the currently implemented TTFB, LCP and CLS performance metrics. The website endpoint reads a user-agent value shortened to at most 512 characters solely to derive coarse browser, operating-system and device families. The user-agent value itself is not written to the analytics tables.
Page views, engagement, scroll, navigation and performance paths exist in the active client. Trial, checkout, contact, demo and video events are emitted only when the corresponding production function is configured and actually succeeds or is used. The current checkout, trial, contact and external-video production settings are empty.
After explicit SI opt-in under consent version 6, the browser can store studiomood_si_analytics_session_v1 with a random identifier and expiry time in local storage. The identifier is accepted for no more than 180 days; a later consented measurement replaces it after expiry, and withdrawal removes it where local storage is available. With SI enabled and selected, vk_hero_surface_180d can also store which of two homepage designs was shown and its expiry time for up to 180 days. Without that active service and consent, the design is chosen only for the current page view and is not stored. The design entry contains no user identifier, profile or behavioural history and is removed when SI consent is withdrawn.
The website endpoint uses the connection IP only to create a short-lived HMAC pseudonym for a five-minute rate-limit bucket. The truncated rate key expires after ten minutes. The raw IP is not written to the analytics tables or forwarded to another measurement service.
Consented SI events and sessions are written to the existing VolumeKeys Cloudflare D1 database in the configured Western Europe location, where they appear with previously collected consented records in the internal reports. The scheduled weekly maintenance routine applies a 400-day cutoff, so deletion occurs on the next scheduled run after a record crosses that cutoff. We do not treat that code setting as proof of recurring production deletion; successful recurring production-run evidence remains a verification requirement.
The private dashboard is protected by Cloudflare Access. SI does not use fingerprinting, customer identity, names, email addresses, payment or license data, form contents, search contents or audio for this website measurement.
Legal basis: your consent (Article 6(1)(a) GDPR and applicable rules on storage or access on your device). Where German law applies, this includes section 25(1) TDDDG. Its precise territorial application remains a legal assessment for the particular service.
5. Cloudflare Web Analytics
A VolumeKeys site entry exists in Cloudflare Web Analytics and the Cloudflare dashboard currently labels it “Automatic setup”. The website configuration keeps the beacon disabled and the enforcing Content Security Policy does not currently permit the beacon domains. Before activation, automatic injection must be switched off or otherwise proven not to bypass the separate Cloudflare Web Analytics choice. The consent version must also be increased before Cloudflare Web Analytics can be selected. The exact VolumeKeys site tag and the two narrowly scoped CSP origins will be added only in that tested activation revision.
When enabled, the Cloudflare beacon receives page and performance signals plus connection data needed to deliver the beacon. Cloudflare states that Web Analytics does not use cookies or local storage for this purpose and that the IP address is used for approximate location and then discarded. Cloudflare keeps unsampled Web Analytics data for seven days and makes a ten-percent sample available for six months.
Legal basis: your consent (Article 6(1)(a) GDPR and applicable ePrivacy rules). Cloudflare Web Analytics remains separate from necessary hosting and security processing.
6. Server-side dashboard connectors
The private Studiomood Intelligence dashboard can retrieve account or aggregate reporting data server to server from services such as Google Analytics, Search Console, Bing, Lemon Squeezy, advertising platforms and Studiomood’s own social accounts when the relevant company connection is configured.
A dashboard connector does not by itself load a script on VolumeKeys, place a website cookie or access a visitor’s device. It is therefore not a separate website consent service. A provider already embedded in the website, such as Google Analytics or a future YouTube player, remains subject to its own consent choice and the provider-specific disclosures below.
7. Google Analytics 4
Google Analytics 4 loads only after you select it. It can receive page URLs, campaign parameters, browser and device information, approximate location, page views and listed conversion events. Google states that an IP address is used to derive location and discarded before it is logged in Analytics.
Google signals, advertising personalization and advertising audiences remain disabled unless you also select Advertising. GA cookies are configured to expire after no more than 180 days. User-level and event-level data governed by the GA4 retention control is kept for no more than 14 months. Aggregated reporting that is not subject to that control can remain longer.
Legal basis: your consent (Article 6(1)(a) GDPR and applicable ePrivacy rules). Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
8. Advertising measurement
Google Ads and the Meta Pixel are prepared as separate advertising functions in the consent logic, but their production identifiers are not configured on the date shown below. If configured later, they will load only after Advertising consent and a consent-version increase and can process campaign parameters, browser or device information, page and conversion events, and provider identifiers used for attribution or audiences.
Advertising consent can also enable Google signals, advertising personalization and demographic or interest reporting. Those values can be modeled or inferred and are not our first-party source of truth.
Legal basis: your consent. Recognizable first-party advertising cookies are expired when consent is withdrawn.
9. YouTube video
The local video poster does not contact YouTube. No production YouTube video ID is configured on the date shown below, so the player is disabled. If configured later, the player will be created only after the consent version is increased, you allow external media and you press play. We use YouTube’s privacy-enhanced domain, but Google can still receive connection data and, depending on your account and browser state, associate playback with you.
Legal basis: your consent. Refusing has no effect on the rest of the website. Withdrawal blocks future loads but cannot reverse data already sent during playback.
10. Contact and support
If you email us or use the contact form, we process your name if provided, email address, topic, message, attachments you choose to send, technical delivery metadata and our reply. Do not send passwords, license keys or unrelated sensitive data.
The contact endpoint is not enabled on the date shown below. The form therefore does not transmit a message and directs you to the appropriate VolumeKeys email address. If enabled later, Cloudflare Turnstile will be used for abuse prevention and the configured email provider will deliver the message.
Legal bases: steps at your request and contract support (Article 6(1)(b) GDPR), legal duties (Article 6(1)(c) GDPR), and our legitimate interests in secure support and abuse prevention (Article 6(1)(f) GDPR).
Ordinary correspondence is kept until the request is resolved and then only as long as needed for follow-up, legal claims or mandatory records. Messages not needed for those purposes are routinely deleted within three years.
11. Checkout and payments
The live purchase URL is not configured on the date shown below. When checkout is enabled and you choose to open it, Lemon Squeezy acts as merchant of record and contractual seller. It receives the information needed to take payment, calculate tax, issue receipts, prevent fraud, handle refunds and manage disputes or chargebacks. Payment-card details are not sent to Studiomood Ltd.
We receive limited order and license information needed to provide and support VolumeKeys, such as order, product, variant, license, activation, refund, dispute, chargeback and status identifiers.
Legal bases: contract performance (Article 6(1)(b) GDPR), legal duties (Article 6(1)(c) GDPR), and fraud prevention (Article 6(1)(f) GDPR). See Lemon Squeezy’s privacy policy.
12. Trial and license service
The public trial and paid activation services are not enabled on the date shown below. Before activation, this section will be checked against the deployed entitlement configuration and updated if necessary.
The planned service is designed to use a device public key and pseudonymous device hash, trial timestamps, app and operating-system version, pseudonymous license-key correlation, Lemon order, license and instance identifiers, activation state and security records. Raw license keys are not intended to be stored. No audio is sent.
Planned retention is seven days for rate-limit records, 180 days for webhook replay hashes and 30 days for a pseudonymised source-IP value in trial records. Trial, purchase and activation records remain only while needed to provide, secure, transfer, revoke or defend the entitlement and to meet legal record duties.
14. Recipients and international transfers
Data is disclosed only where needed to Cloudflare for hosting, security and consent-gated analytics infrastructure, Lemon Squeezy and its payment providers for checkout, Google and Meta only after the relevant consent and production configuration, the configured email provider for contact delivery, professional advisers, and authorities where legally required.
Cloudflare D1 used for VolumeKeys SI analytics is configured for Western Europe. Providers can nevertheless process support, security, telemetry or account data outside the EEA. Where Chapter V GDPR applies to a transfer, it must be covered by an adequacy decision, the EU Standard Contractual Clauses or another lawful mechanism, with supplementary safeguards where required. We verify the applicable mechanism provider by provider. Optional services whose mechanism has not been confirmed remain disabled. Contact [email protected] for the current position for a specific provider.
Contact [email protected] if you want information about an applicable transfer safeguard or a copy where available, subject to protecting the rights of others.
15. Retention, deletion and security
The service-specific periods above are maximums or review criteria, not reasons to keep data that is no longer needed. Previously collected legacy analytics and experiment records remain subject to the previously disclosed maximum 400-day period and can be deleted or aggregated sooner. Migration does not restart or extend that period.
We use HTTPS, purpose-limited service credentials, access controls, product separation, bounded input and rate checks, and restricted private-dashboard access. No internet service is completely risk-free. We review access and delete or anonymise data when its stated purpose and applicable retention duties end.
16. Required information, your rights and changes
You are not legally required to browse the site, accept optional measurement or send a contact request. Required checkout, trial, license and support fields are necessary only when you ask for the corresponding service.
Subject to the GDPR conditions, you can request access, correction, deletion, restriction and portability, or object to processing based on legitimate interests. You may withdraw consent at any time without affecting earlier lawful processing.
A pseudonymous analytics record may not identify you by name. If you request access or deletion of SI analytics data, include the session identifier shown in your browser storage if available so we can locate the record without collecting additional identity data.
Contact [email protected]. You may also complain to the Office of the Commissioner for Personal Data Protection in Cyprus or the supervisory authority where you live or work.
We do not use solely automated decisions that produce legal or similarly significant effects.
We update this policy when the service, providers or legal assessment changes. A material new optional purpose or service will not inherit an older consent choice. The date below identifies this version.
13. Social channels and public monitoring
Studiomood Intelligence can display metrics and content from Studiomood’s own connected social accounts for VolumeKeys. Platform access credentials are kept server-side and product data is separated in the dashboard. This processing supports management of our own channels and does not depend on website analytics consent.
No collection of public third-party posts for VolumeKeys is active on the date shown below. It will not be activated until a documented legitimate-interests assessment, source and field list, retention rule, objection process and Article 14 notice procedure are complete. We will not use this data for solely automated decisions with legal or similarly significant effects.
If public monitoring is activated, the anticipated purpose is to find product questions, compatibility reports and public feedback that are relevant to VolumeKeys. The anticipated legal basis is our legitimate interest under Article 6(1)(f) GDPR, balanced against the context, sensitivity and reasonable expectations of the person who posted the material. Objections can be sent to [email protected].