Privacy Policy
Effective date: 2026-10-02
This policy explains what GANUE Audio ("GANUE", "we", "us") does with personal data. Contact for anything on this page: [email protected].
The controller is GANUE Audio, contactable at [email protected].
1. The short version
We keep the minimum needed to sell you a plugin, deliver your licence, and let you get your files back years later. We do not run advertising, we do not profile you, we do not sell or share your data with anyone for their own purposes, and we never see your card details.
2. What we collect, and why
When you buy a paid product
Checkout is handled by Gumroad, our payment provider, which acts as the merchant of record (see Terms of Sale). It passes us only what we need to fulfil the order, read back from Gumroad's own sale record:
| Data | Why we have it | Legal basis (GDPR/UK GDPR) |
|---|---|---|
| Email address | To send your licence file and download links, and to reissue them later | Performance of a contract |
| Display name (if you gave one) | Printed inside the signed licence file | Performance of a contract |
| Order ID and product/SKU bought | To match a licence to an order, and to prevent double issuance | Performance of a contract |
| Country, amount, currency, tax amount, date | Order records and bookkeeping | Legal obligation |
| Licence IDs we issued, and when | To reissue a lost licence, and to audit use of the signing key | Performance of a contract; legitimate interests (fraud and key-use auditing) |
When you download a free product -- the free products are delivered through a third-party email/delivery service (Kit; see section 5), which collects the email address you give it.
When you email support -- we keep the correspondence so we can follow up.
Server logs -- our host records ordinary technical connection data.
3. What we deliberately do NOT store
- Card, bank or payment details. These exist only with Gumroad. We never receive them.
- Postal address and phone number.
- Raw IP addresses. Where we need one for abuse rate-limiting or for counting downloads, it is stored as a salted hash and discarded after 24 hours.
- The bodies of Gumroad's ping (webhook) requests. A ping is treated as a trigger, not as data: we read the order back through Gumroad's own API and keep that reading, not the raw notification.
- Anything about what you do inside the plugin. GANUE plugins verify licences entirely offline. They do not phone home, do not report usage, and do not send us telemetry of any kind.
4. Analytics and cookies
This website sets no cookies of its own and runs no advertising or
third-party analytics tracking. The web font is served from our own domain.
Download counts. When you download a file from dl.ganueaudio.com we record
the file, the time, the HTTP status, your country (as reported by Cloudflare), the type of
client (browser / download tool / crawler) and a salted hash of your IP address (IPv6: of its
/64 prefix). We use this only to count downloads. The hash is deleted after 24 hours (at most
48), the record after 30 days; we keep daily totals only.
The product pages load Gumroad's checkout overlay script (gumroad.js)
so you can buy without leaving the page; that script is a third party and may set
its own cookies under Gumroad's own policy.
The checkout itself runs on Gumroad's technology and is subject to Gumroad's own privacy policy and cookies.
5. Who else processes your data
| Processor | Role | Where |
|---|---|---|
| Gumroad | Merchant of record: checkout, payment, tax, receipt, buyer email and country. Acts as an independent seller for the transaction, under its own privacy policy | United States (Gumroad, Inc.) |
| Google Workspace (Gmail API) | Sends the licence email (.ganuelicense attachment, download links) from [email protected]. Google does not choose what is sent -- the message is built by our own Worker and handed to the gmail.send-scoped API | United States |
| Cloudflare | Website hosting; the store-api / store-signer Workers; the D1 order/licence ledger; R2 signed download links | Global edge |
| Kit | Delivery of free products and product announcements you opted into. Unchanged by this pass | US |
We do not sell personal data, and we do not share it for anyone else's marketing.
6. International transfers
We use service providers in the United States (Google Workspace, and Gumroad, Inc.) and a global edge network (Cloudflare), so your data may be transferred across borders. Where applicable, these transfers rely on the standard contractual clauses or equivalent safeguards in our agreements with those providers.
7. How long we keep it
| Order records (email, amount, date) | Indefinitely, because we promise you can get your files back for life, and because Japanese bookkeeping law requires the transaction record (7 years). On an erasure request we anonymise the email and keep the amount and date |
|---|---|
| Licence records | Indefinitely, so we can reissue a lost licence |
| Signing-key audit records | Indefinitely (small, and it is our record of what was ever issued) |
| Payment webhook (ping) records | 90 days |
| Email delivery logs | 24 months |
| Rate-limit and download-count hashes | 24 hours (at most 48) |
| Download-count records (no hash) | 30 days; daily totals kept |
| Server logs | 30 days |
8. Your rights
Depending on where you live, you may ask us to give you a copy of your data, correct it, delete it, restrict or object to our use of it, or receive it in a portable form. Write to [email protected] and we will answer.
One honest limit: where a law requires us to keep a transaction record, we cannot delete that record. In that case we remove your email address from it and keep only the amount and date, which no longer identify you.
If you are in the EEA or the UK you may also complain to your local data protection authority. If you are in Japan you may contact the Personal Information Protection Commission.
9. Security
The signing key that issues licences is held offline and separated from the public web path. The equivalent mail-sending key is gmail.send-scoped only, stored as a Worker secret, unable to read or delete mail or forge a licence. Logs are written without personal data beyond the salted hashes described above. Downloads for buyers are served over signed, time-limited links. No system is perfect, and we would tell you plainly if something went wrong.
10. Children
GANUE products are not aimed at children, and we do not knowingly collect data from anyone under 16.
11. Changes
If we change this policy we will change the effective date at the top, and for material changes we will say so on the site.