Privacy Policy

SoundFingers is operated by Mathieu Rahm, micro-entrepreneur registered in France. We are committed to protecting your personal data in accordance with the EU General Data Protection Regulation (GDPR — Regulation (EU) 2016/679) and French Law No. 78-17 of January 6, 1978 (Loi Informatique et Libertés, as amended).

1. Data Controller

As a micro-entrepreneur, Mathieu Rahm acts as the sole data controller. No Data Protection Officer (DPO) is legally required at this scale; all data-related inquiries are handled directly by the controller.

2. Data We Collect

2.1 Account & Order Data

• Full name
• Email address
• Billing country
• Purchase history (products, amounts, dates, order IDs)
• License activation records, including the machine identifier — a hardware/software fingerprint generated locally by the plugin using the JUCE framework. It does not contain your name, location, or any directly identifying information, but is considered personal data under GDPR as it can be linked to your account.

2.2 Payment Data

Payments are processed by Stripe or PayPal. We do not store or access full card numbers or bank details. We retain only: payment method type, transaction reference, amount, currency, and status (confirmed/refunded).

2.3 Technical & Security Data

• IP address (collected at login, checkout, download, and activation events)
• Browser type and version (via standard HTTP headers)
• Timestamps of account activity (login, download, license activation/deactivation)

2.4 Communications

Email messages you send to us (support, inquiries, refund requests) are retained to manage your request and maintain correspondence history.

2.5 Product Reviews

If you choose to review a plugin you own, we store the review content (rating, optional title, and text) together with a public author name derived from your account name (e.g. “Jean-Baptiste M.”). Reviews are moderated before publication and, once approved, are displayed publicly on the corresponding product page. We retain the original text you submitted as an internal audit record even if the displayed text is later corrected for spelling or grammar. Reviews are optional and never required to use a purchased plugin.

2.6 Data We Do Not Collect

We do not collect demographic data, behavioral tracking data, third-party ad identifiers, or any data not listed above. We do not use third-party advertising cookies.

3. Legal Basis for Processing

4. How We Use Your Data

• Fulfillment: To process your purchase, generate download links, and deliver license credentials.
• Account management: To allow you to log in, view your orders, and manage activations.
• Communication: To send transactional emails (order confirmation, license delivery, password reset) and respond to support inquiries.
• Security: To detect and prevent unauthorized access, fraudulent transactions, or abuse of the download and activation systems.
• Legal compliance: To fulfill obligations under French accounting and commercial law.

We do not use your data for automated profiling or automated decision-making that produces legal effects.

5. Third-Party Data Processors

We use the following service providers who may process personal data on our behalf. Each is bound by a Data Processing Agreement (DPA) and appropriate GDPR safeguards.

We do not sell, rent, or trade your personal data to any third party for their own commercial purposes.

6. Cookies

We use the minimum number of cookies necessary to operate the Site:

We do not use analytics cookies, advertising cookies, or any third-party tracking cookies. No cookie consent banner is required for strictly necessary cookies under the ePrivacy Directive. See our Cookie Policy for more detail.

If we introduce optional cookies (e.g. analytics) in the future, this policy will be updated and your prior consent will be requested.

7. Data Retention

Upon account deletion, we anonymize or delete all data not subject to a legal retention obligation. Published reviews are unlinked from your identity and their public author name is replaced with a neutral label. Retention periods are enforced periodically via an internal purge process.

8. International Data Transfers

Some processors operate outside the European Economic Area (EEA). Where this occurs, we ensure appropriate safeguards are in place:

• Stripe (USA): Standard Contractual Clauses (SCCs) adopted by the European Commission.
• Backblaze (USA): Standard Contractual Clauses.

You may request details of the specific transfer mechanisms in place by contacting privacy@soundfingers.com.

9. Your Rights Under the GDPR

You have the following rights with respect to your personal data:

• Right of access (Art. 15): Obtain confirmation of whether we process your data and receive a copy.
• Right of rectification (Art. 16): Request correction of inaccurate or incomplete data.
• Right of erasure (Art. 17): Request deletion of your data where it is no longer necessary, or where you withdraw consent, subject to legal retention obligations.
• Right to restriction of processing (Art. 18): Request that we limit processing in certain circumstances.
• Right to data portability (Art. 20): Receive your data in a structured, commonly used, machine-readable format (JSON or CSV).
• Right to object (Art. 21): Object to processing based on legitimate interest, including at any time for direct marketing purposes.
• Right to withdraw consent (Art. 7(3)): Where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, send your request to privacy@soundfingers.com with sufficient information to identify your account. We will respond within 30 days. We may ask you to verify your identity before acting on the request. You can also download a copy of your data and delete your account directly from your account settings.

10. Right to Lodge a Complaint

If you believe your data has been processed unlawfully or your rights have not been respected, you have the right to lodge a complaint with the supervisory authority in your country of residence. In France:

11. Security

We implement appropriate technical and organizational measures to protect your personal data, including:

• HTTPS/TLS encryption for all data in transit
• Secure password hashing (bcrypt)
• Time-limited, signed download URLs (no permanent public file access)
• Role-based access controls on the admin interface
• Regular security reviews

No system is entirely immune to breaches. In the event of a personal data breach likely to result in a high risk to your rights and freedoms, we will notify you without undue delay.

12. Changes to This Policy

We may update this Privacy Policy as the Site evolves. Changes will be posted on this page with an updated date. For material changes, we will notify registered users by email at least 30 days before the change takes effect.

13. Contact