1. Controller
Studiomood Ltd, Tagm gonia demetriou pouliou & Kost. Pantelidi, MELNA COUTR, 8011, Paphos, Cyprus, company registration number HE 495191.
Email: [email protected]. Product support: [email protected].
2. Website delivery and security
The website is delivered through Cloudflare. When you request a page, technically necessary connection data such as IP address, request time, requested resource, browser information and security signals can be processed to deliver the site, prevent abuse and diagnose failures.
Legal basis: our legitimate interests in secure, reliable website delivery (Article 6(1)(f) GDPR). Where data is necessary to answer a request before a contract, Article 6(1)(b) GDPR also applies.
Cloudflare may process data outside the EEA under appropriate transfer safeguards. See Cloudflare’s privacy policy.
We do not intentionally export routine delivery logs into a separate customer-profile database. Retention of hosting and security logs depends on the Cloudflare plan and security configuration in use; account-accessible logs are kept only as long as reasonably needed for security and fault diagnosis, then deleted or aggregated.
3. Privacy choices and storage
By default, we use only technically necessary storage. Optional services remain blocked unless you consent. If production identifiers are configured, consent can enable the first-party Porcelain/Obsidian page-design experiment, Google Analytics for audience measurement, Google Ads and the Meta Pixel for campaign measurement, and YouTube for external video. A necessary local-storage entry records your choices, a version marker and a timestamp; we ask again after 180 days.
With Analytics consent, two first-party experiment cookies keep one page-design assignment for up to 180 days and prevent duplicate funnel counts. One cookie is signed; the other stores only the assigned variant.
Cloudflare D1 stores aggregate daily exposure, trial and checkout counts. If you open checkout, a signed marker containing the experiment, variant and assignment date is passed to Lemon Squeezy. Signed order and refund webhooks let us count net purchases and revenue.
The experiment database stores the Lemon order ID, status and financial totals needed for deduplication and refunds, but no customer name, email, IP address, device fingerprint or audio. Withdrawing consent clears the experiment cookies and stops future measurement. Experiment rows are scheduled for deletion after no more than 400 days.
You can reject optional content as easily as accepting it. Change or withdraw your choice at any time:
Storage details
volumekeys_privacy_choices_v2(local storage, necessary): stores the selected consent categories, a version marker and timestamp for up to 180 days.__Host-vk_ab_sessionand__Host-vk_ab_variant(first-party cookies, Analytics consent): store the experiment assignment and already-counted events for up to 180 days.- A signed checkout-attribution marker (Analytics consent) can be sent to Lemon Squeezy only when you open checkout. It expires after no more than 400 days.
4. YouTube video
The local video poster does not contact YouTube. The YouTube player is created only after you allow external media and press play. We use YouTube’s privacy-enhanced domain, but Google can still receive connection data and, depending on your account and browser state, associate playback with you.
Legal basis: your consent (Article 6(1)(a) GDPR and applicable ePrivacy rules). Refusing has no effect on the rest of the website. Withdrawal blocks future loads but cannot reverse data already sent during playback.
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. See Google’s privacy policy.
5. Contact and support
If you email us or use the contact form, we process your name if provided, email address, topic, message, attachments you choose to send, technical delivery metadata and our reply. Do not send passwords, license keys or unrelated sensitive data.
When the production contact endpoint is enabled, the form uses Cloudflare Turnstile to distinguish legitimate requests from automated abuse without image puzzles and sends the message through our configured transactional email provider. Until that endpoint is enabled, the form does not transmit data and the page directs you to the appropriate VolumeKeys email address.
Legal bases: steps at your request and contract support (Article 6(1)(b) GDPR), compliance with legal duties (Article 6(1)(c)), and our legitimate interests in secure support and abuse prevention (Article 6(1)(f)).
We retain ordinary correspondence until the request is resolved and then only as long as needed for follow-up, legal claims or mandatory record-keeping. Messages not needed for those purposes are routinely deleted within three years.
6. Checkout and payments
Lemon Squeezy acts as merchant of record for purchases. It receives the information needed to run checkout, take payment, calculate tax, issue receipts, prevent fraud and handle refunds. Payment-card details are not sent to Studiomood Ltd.
We receive limited order and license information needed to provide and support VolumeKeys, such as order, product, variant, license and status identifiers. The legal bases are contract performance, legal duties and fraud prevention.
7. Trial and license service
When trial and paid activation are enabled, the entitlement service is designed to store only limited operational data: a device public key and pseudonymous device hash, trial timestamps, app and operating-system version, pseudonymous license-key correlation, Lemon order/license/instance identifiers, activation state and security records. Raw license keys are not intended to be stored. No audio is sent to this service. The final production privacy notice will be checked against the deployed entitlement configuration before activation.
- Rate-limit records are removed after seven days.
- Webhook replay hashes are removed after 180 days.
- A pseudonymised source-IP value is removed from trial records after 30 days.
- The pseudonymous trial record remains while the trial programme is offered so reinstalling does not create repeated trials.
- Purchase and revocation records remain while needed to operate, transfer, refund, secure or defend the license and are reviewed when the product or license relationship ends.
Legal bases: providing the trial or paid license (Article 6(1)(b) GDPR), fraud and abuse prevention plus license security (Article 6(1)(f)), and legal record-keeping where applicable (Article 6(1)(c)).
8. Recipients and international transfers
Data is disclosed only where needed to Cloudflare (hosting, security, Turnstile and entitlement infrastructure), the configured transactional email provider (contact delivery), Lemon Squeezy and its payment providers (checkout), Google Analytics, Google Ads, Meta and YouTube only after the relevant consent and production configuration, professional advisers, and authorities where legally required.
Where a provider processes data outside the EEA, we rely on an adequacy decision, the EU Standard Contractual Clauses or another lawful transfer mechanism, together with supplementary safeguards where required.
Contact [email protected] if you want more information about the applicable transfer safeguard or a copy where available, subject to protecting the rights of others.
9. Required and optional information
You are not legally required to browse the website or send a contact request. If you choose to start a trial, purchase, activate a license or request support, the fields marked as required and the operational identifiers described above are necessary to perform that request.
Without the required information, we may be unable to complete the checkout handoff, issue or verify an entitlement, prevent repeated trial use or answer your request. Optional message fields and optional consent categories can be left blank or rejected.
10. Your rights
Subject to the GDPR conditions, you can request access, correction, deletion, restriction, portability, or object to processing based on legitimate interests. You may withdraw consent at any time without affecting earlier lawful processing.
Contact [email protected]. You may also complain to the Office of the Commissioner for Personal Data Protection in Cyprus or the supervisory authority where you live or work.
We do not use solely automated decisions that produce legal or similarly significant effects.