What we collect, why, and who else sees it. In short: no cookies, no advertising, cookieless visit counts, and only what a purchase or your message needs.
The controller of your personal data is Paweł Witkowski, trading as Tonestatic, Krakowska Street 12/2, 48-385 Otmuchów, Poland, NIP 7532165811, REGON 366444644. Contact: help@tonestatic.com.
The site is hosted by Netlify, Inc., whose servers log each request (your IP address, browser and the page) to deliver the site and keep it secure.
The site sets no cookies and runs no advertising. We count visits with Umami (Umami Software, Inc.), which sets no cookies either. Its script records page views and some clicks - which download or manual you took, which buttons you used to try or buy a plugin, what you added to the cart and Checkout, the sound previews you played, the face theme you picked, and that you sent us a message (with the topic you chose, never what you wrote) - and processes the referring site, your browser and device type, your country and the network details needed to receive the request. Umami does not store your IP address. We use the reports only to understand how the site is used. Legal basis: our legitimate interest in knowing how the site is used (GDPR Art. 6(1)(f)).
The site keeps one thing in your own browser, which never leaves it: whether you chose the dark or light plugin face. While you buy, the tab also holds what is in your cart, your trial number and whether you came from a trial or test link; all of it goes when you close the tab.
The installers are downloaded from download.tonestatic.com, which is served by Bunny.net (BunnyWay d.o.o., Slovenia); its servers log each download (your IP address, browser and the file) to deliver it and keep it secure.
The Alpine, Grains and Steps pages show videos hosted on YouTube (Google Ireland Limited). Nothing is loaded from YouTube until you press play: the picture you see first is our own file. Pressing play loads YouTube’s player from youtube-nocookie.com, which then receives your IP address, browser details and which video you are watching, and may store information in your browser, under Google’s privacy policy. Legal basis: our legitimate interest in showing you the video you asked to play (GDPR Art. 6(1)(f)).
No Paddle script runs on this site until you press Checkout. Then our server creates the order at Paddle (the products, and your trial number if you came from a trial) and Paddle’s checkout opens, either on Paddle’s own page or over ours, with Paddle’s script loaded from paddle.com at that moment. What you type there, and what Paddle’s checkout collects to prevent fraud, goes to Paddle and is covered by Paddle’s privacy notice.
The contact form sends your name, email address, topic and message to us through Netlify Forms; emails to our addresses are handled by Apple iCloud Mail. We use them only to answer you, and delete them within 2 years of the conversation ending. Legal basis: our legitimate interest in answering you (GDPR Art. 6(1)(f)), or taking steps towards a contract you asked about (Art. 6(1)(b)).
Paddle.com, our reseller, processes your payment and is responsible for the payment data it collects; see Paddle’s privacy notice. Paddle passes us your name, email address, country and order details, which we need to deliver your licence, support you and keep the records tax law requires. Legal basis: performing the contract (Art. 6(1)(b)) and our legal obligations (Art. 6(1)(c)). We keep them for as long as your licence is active, and order records for the period accounting law requires.
When you start the 14-day trial, the plugin sends the email address you type, which plugin you opened, and an identifier of your computer to our licence server, which runs on Netlify. The identifier is a one-way hash of your computer’s hardware id, so the id itself never leaves your computer; the server uses it to give each computer one trial. We use your email address to send you two emails about the trial - a welcome when it starts and a reminder the day before it ends - and nothing else. Legal basis: taking steps towards a contract you asked for (Art. 6(1)(b)).
When you activate a plugin with a licence key, it sends the key and the same computer identifier, so that the limit of 3 computers per key works. Legal basis: performing the contract (Art. 6(1)(b)).
When you unlock Steps Free, the plugin sends the email address you type, whether you ticked “Email me about Tonestatic plugins and offers”, and the same computer identifier to our licence server, which notes when it was unlocked. We keep them as the record that Steps Free is unlocked on that computer, so that reinstalling it unlocks it again. If you left the box unticked, we use your address for nothing else. If you ticked it, we may send you occasional emails about Tonestatic plugins and offers; each will have a link to stop them, and you can withdraw your consent at any time by writing to us. Legal basis: performing the agreement under which we provide Steps Free (Art. 6(1)(b)), and for those emails, your consent (Art. 6(1)(a)). We keep the record until you ask us to delete it.
While any Tonestatic plugin on your computer is not yet licensed - before you start a trial, during it, or after it ends - the plugin checks in with our licence server when your music software loads it, and once a day while it stays loaded. That is how it knows whether this computer has had its trial, and how a licence you buy reaches it by itself, with no key to type. Once every plugin is activated, it checks about once a month whether your keys are still valid (they are not, after a refund), and once after you install an update. A check-in carries the computer identifier, any licence keys the plugin holds, and which plugin it is and its version number, and nothing else. If one fails - you are offline, say - the plugin carries on as it was. After you press Buy in a plugin, it checks in about once a minute for up to 30 minutes, or until the licence arrives, so that what you bought unlocks it without your doing anything. Legal basis: our legitimate interest in giving each computer one trial and delivering what you bought (Art. 6(1)(f)), and performing the contract (Art. 6(1)(b)).
Every one of these requests - the trial, unlocking Steps Free, an activation, a check-in - also says which Tonestatic plugin sent it and its version number. We keep the latest of these for each computer identifier, to know which versions are in use and whether an update has reached the people who need it, and delete it 2 years after that computer last checked in. Legal basis: our legitimate interest in maintaining and supporting the plugins (Art. 6(1)(f)).
We keep a trial record - your email address and the computer identifier - for 2 years after the trial ends, so that a computer is not given a second trial in that time, and then delete it. We keep licence records for as long as the licence is active. When we change a record by hand - give a trial more days, move a licence, free a computer - we keep a note of the change, with the email address and computer identifier it was about, for 2 years, to answer questions about it later. You can ask us to delete yours sooner at any time (see Your rights).
Our emails - the trial emails, your licence keys, keys you ask us to send again and, if you opted in from Steps Free, emails about Tonestatic plugins and offers - are sent through Resend (Plus Five Five, Inc.), which processes your email address to deliver them.
Once a day, when a plugin opens, it asks tonestatic.com for the latest version of each plugin, to tell you when an update is out. The request carries nothing about you or your computer - only what any web request does, such as your IP address, which Netlify logs as it does for this website. You can switch it off in the plugin’s menu, under Updates.
The plugins do not send any audio, project or usage data anywhere.
Netlify, Apple, Paddle, Resend, Umami and Google (YouTube) may process data outside the European Economic Area, including in the United States. Where they do, the transfer is covered by the EU–US Data Privacy Framework or by the European Commission’s standard contractual clauses.
You can ask us for a copy of your data, to correct or delete it, to restrict or object to its use, or to receive it in a portable form: write to help@tonestatic.com. You can also complain to the Polish data protection authority, the President of the Personal Data Protection Office (UODO), or to the authority where you live.