Privacy Policy

Hodfords Solutions Limited (HSL), operating the Flat4Audio store, is the data controller for the Flat4Audio store sales, customer account, order fulfilment, support and software-licensing activities described in this policy.

• Company number: Registered in England and Wales under number 14158129
• Registered office and postal address for privacy enquiries and complaints: 63 Havelock Road, Brighton, England, BN1 6GL
• Privacy and support email: support@flat4audio.com

Scope and separate notices: This policy covers only the Flat4Audio store, customer accounts, orders and plugin licensing controlled by HSL. It does not cover the existing pre-launch Flat4Audio waitlist collected at flat4audio.com, for which Hodfords Limited (Room 13A, Man Lok Building, 93 Bonham Strand East, Sheung Wan, Hong Kong; privacy contact privacy@hodfords.com) is the controller under its separate Waitlist Privacy and Personal Information Collection Statement, nor does it alter the seller or privacy arrangements governing historical orders processed by Paddle.com Market Ltd or legacy Stripe accounts.

Opening the Flat4Audio store does not change the controller of those existing waitlist records or extend their marketing consent. Hodfords Limited remains responsible for that waitlist; HSL controls the purchase, account and licensing data described in this policy. Read the separate waitlist privacy notice. Waitlist privacy requests remain directed to privacy@hodfords.com.

We collect only the personal data needed to process your orders, provide your account and software licences, support you, keep the service secure and meet our legal obligations:

• Account and contact data (supplied by you): Your email address, optional account password (stored only as a one-way cryptographic hash) or single-use magic-link sign-in token (stored only as a SHA-256 hash), and the content and timestamps of any support, refund or privacy messages you send us.
• Order, billing, consent and licence records (supplied by you at checkout and generated by the store): Your declared billing details (full name, email address, billing country, optional postcode/region, customer status as consumer or business, and optional business name/VAT number); your order reference (orderRef), product SKU and title, GBP price (gross, net and tax amounts), applied tax rule and calculation snapshot; the exact version and text of the Terms of Service and immediate-download consent you accepted at checkout (termsVersion, consentVersion, consentedAt); your 24-character licence serial key (AUR1-XXXXX-XXXXX-XXXXX-XXXXX); your entitlement status (active, suspended or revoked); and your installer download history.
• Plugin activation data (generated when you activate, refresh or deactivate the software): When your plugin or standalone application contacts our activation server (https://api.flat4audio.com/api/activate or /api/deactivate), it sends: (1) your licence serial key; (2) the product identifier (productId); (3) a one-way SHA-256 hash of your operating system’s hardware/platform UUID (machineIdHash, salted with “auriatorium-licence-v1:”); (4) your computer’s host name (machineName, shown in your online My Library page so you can identify and manage your activated computers); and (5) for encrypted-ROM instruments such as Vicious Circle, a locally generated 32-byte X25519 public key (machinePublicKey) used to seal the sample decryption key to that computer, together with activation and last-seen timestamps (activatedAt, lastSeenAt, status). Because these identifiers are linked to your licence serial and account entitlement to enforce the 2-computer limit, we treat them as personal data (pseudonymised/hashed identifiers), not anonymous data. Our audio plugins and standalone applications do not read, scan or transmit your DAW projects, audio recordings, personal files or lists of other installed software, and contain no analytics, crash-reporting or behavioural telemetry trackers.
• Security and technical data (collected automatically when you use the store or licensing API): Your IP address, browser User-Agent string, request timestamps, rate-limiting counters and session metadata (auth_sessions secret hash, creation/expiry times and session IP/User-Agent), used to authenticate you securely and protect accounts, downloads and licence seats against abuse.

New software payments are processed through Revolut (Revolut Ltd). Payment details are collected directly on Revolut’s hosted checkout (checkout.revolut.com).

• No full card numbers or security codes held by HSL: HSL never receives, processes or stores full payment card numbers (PAN) or card security codes (CVV/CVC).
• Transaction metadata received from Revolut: To verify payment completion, fulfil your order, maintain statutory tax records and handle refunds or disputes, HSL receives and stores from Revolut’s Merchant API and signed webhooks: Revolut order, payment, customer and dispute identifiers (providerOrderId, paymentId, customer.id); payment status and timestamps; transaction, fee and settlement amounts; the billing address recorded on the payment; and non-sensitive payment-method verification metadata (payment_method.type, card_country_code, cardholder_name, and pass/fail status indicators for 3D Secure three_ds, billing address, postcode and cvv_verification).
• Location evidence and minimisation: To verify UK VAT / tax place-of-supply treatment and prevent payment fraud, we record your declared billing country/region, the card-issuing country code (card_country_code) reported by Revolut, and the country derived locally from your checkout IP address together with a keyed, one-way SHA-256 hash of that IP address (ipCountry and ipHash). The country lookup uses a local DB-IP database; your IP is not sent to DB-IP. Card-country and IP-derived location are treated as tax and fraud-prevention indicators rather than conclusive proof of residence. Personal billing and IP-hash evidence in our tax-evidence records is retained only for the applicable tax-verification and audit review period and is subject to structured redaction once no longer required.

Under the UK General Data Protection Regulation (UK GDPR), we rely on specific lawful bases for each purpose. Agreement to this Privacy Policy is never treated as blanket consent.

• Payment, download fulfilment and licence issuance/verification — Performance of a contract (Article 6(1)(b) UK GDPR): We process your email address, declared billing details, order/consent records, licence serial key and machine activation data (machineIdHash, machineName, machinePublicKey) where objectively necessary to enter into and perform our sale and software-licence contract with you, including unlocking the software during its 7-day offline allowance window and sealing sample-content keys to your activated computers. Supplying your email address, billing name and country at checkout, and permitting the plugin to send your licence serial and machine identifiers on activation, is mandatory to purchase and activate the software; without them, we cannot complete your order or unlock the software outside Demo Mode.
• Account access and access to purchased licences — Performance of a contract (Article 6(1)(b) UK GDPR): We process your email address, authentication tokens/session records, order history and registered machine list where necessary to provide and maintain your online account, installer re-downloads and self-service computer deactivation/re-enabling in My Library (/library).
• Purchase and licence support vs. general enquiries — Performance of a contract (Article 6(1)(b)) and Legitimate interests (Article 6(1)(f) UK GDPR): Where you contact us about an order, download, activation seat reset, refund request or faulty digital content claim, we process your contact and order details to perform our contract with you (or take steps at your request before contracting). For general pre-sale or non-contractual enquiries, we rely on our legitimate interest in responding to prospective customers and administering the service.
• Security, proportionate fraud/abuse prevention and legal-claim evidence — Legitimate interests (Article 6(1)(f) UK GDPR): We process IP addresses, User-Agent details, session metadata, rate-limiting logs, Revolut payment-check metadata (three_ds, cvv_verification, address/postcode) and licence-seat audit events where necessary for our legitimate interests in protecting customer accounts and the service, preventing unauthorised key sharing or payment fraud, enforcing the disclosed 2-computer limit, and establishing, exercising or defending legal claims.
• Tax and accounting records required by law — Legal obligation (Article 6(1)(c) UK GDPR): We retain order summaries, tax calculation snapshots (purchase_tax_snapshots), place-of-supply tax evidence (tax_evidence), refund records and financial ledger entries (revolut_financial_facts and commerce_financial_ledger) to comply with HSL’s statutory obligations under the Companies Act 2006 (sections 386–388) and Value Added Tax Act 1994 / HMRC VAT Notice 700/21.
• Optional consent-based processing — Consent (Article 6(1)(a) UK GDPR): Store checkout and account creation do not subscribe you to marketing emails. Any optional marketing communication or non-exempt cookie/analytics technology requires your separate, affirmative opt-in consent and can be withdrawn at any time.

We do not sell your personal data. We disclose personal data only where necessary for the stated purposes to the following recipients:

• Revolut (Revolut Ltd, United Kingdom): Payment processing and refund execution for HSL where acting on HSL’s instructions as a payment processor/service provider; Revolut also acts as an independent data controller for its own fraud prevention, regulatory compliance (AML/KYC) and Revolut Pay activities under the Revolut Customer Privacy Notice and Revolut Business Acquiring Terms.
• Stripe and Paddle (Paddle.com Market Ltd): Historical payment records, refunds, disputes and post-sale administration solely for historical orders placed under those original seller/provider arrangements.
• Hodfords-operated outgoing mail servers: Our group mail relay sends account sign-in links, order confirmations, receipts and licence information. It handles recipient addresses, message content and delivery metadata to deliver and troubleshoot those messages. The Hodfords group infrastructure that operates the relay is described below.
• Hosting, infrastructure and authorised group support (Hodfords LLC and Icelab Networks, LLC, United States; Hodfords Limited, Hong Kong): Our store and licensing PostgreSQL databases and application servers are hosted in the United States by our group technology processor Hodfords LLC (16192 Coastal Highway, Lewes, Delaware 19958, USA) on physical server hardware owned by Icelab Networks, LLC (8191 SouthPark Lane, Suite 201, Littleton, Colorado 80120, USA). Authorised engineering, operations and customer-support personnel within the Hodfords group (located in the United Kingdom, Hong Kong and Vietnam) may access account, order or licensing records strictly on a least-privilege, need-to-know basis to resolve support requests, administer refunds or maintain system security under written intercompany data-processing and confidentiality obligations.
• Professional advisers and authorities: Accountants, auditors, legal advisers and tax or regulatory authorities (such as HM Revenue & Customs or the Information Commissioner’s Office) where necessary for statutory compliance, auditing or legal claims.

International transfer safeguards: Where personal data is accessed from or transferred outside the United Kingdom to a jurisdiction without a general UK adequacy regulation (including the United States, Hong Kong or Vietnam), we rely on approved UK GDPR Chapter V safeguards—specifically the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses (SCCs), supported by transfer risk assessments, TLS encryption in transit, cryptographic hashing and strict database row-level security (RLS) controls. You may request further information or a copy of the applicable safeguards (with commercially sensitive details redacted) by emailing support@flat4audio.com.

We retain personal data only for justified purposes and periods, with scheduled review and deletion or anonymisation when no longer needed:

• Accounting, purchase and tax records: Our shared retention policy keeps these records for ten complete calendar years after the end of the latest relevant year, covering our cross-border VAT and GST obligations. Records may be held longer where the law requires it, including certain Canadian general ledgers, or for an ongoing tax inquiry, dispute or legal claim. Retention boundaries are review dates, not automatic deletion dates.
• Detailed billing and customer-location evidence: We retain the information needed to support the tax treatment of a purchase alongside its tax records. After the applicable retention period and any holds expire, we review personal details for deletion or anonymisation while preserving records we must still keep.
• Accepted terms, consent, refund and dispute evidence: These records follow the same ten-year-after-year-end policy where they support the purchase and its tax treatment, with longer retention for unresolved inquiries or claims.
• Licence entitlement and machine activation records (Entitlement, Licence, MachineActivation): Retained for as long as your software licence remains active—including after web-account closure where necessary to honour your perpetual licence and 2-computer activation entitlement—and for up to 6 years following a permanent licence revocation or refund.
• Customer account and authentication records (users, auth_sessions, login_tokens): Active account records are kept until you request account deletion. Single-use sign-in links (login_tokens) expire after 15 minutes and are deleted after use or expiry. Browser sessions (auth_sessions) expire after 30 days of inactivity (90-day maximum ceiling) or immediately on sign-out.
• Support records (aftercare_support_records, refund_requests): Retained while the enquiry is open and for up to 24 months after resolution for follow-up, or for the 6-year post-financial-year statutory period where part of a financial refund or dispute record.
• Security, rate-limiting and email delivery logs: Rate-limiting counters expire within 1 to 10 minutes. Purchase-related email delivery evidence follows the purchase-record retention period above. Mail-relay transmission logs are kept only as needed for delivery, troubleshooting and security; server security and operational audit logs are retained for up to 12 months unless required for an active security investigation.
• Backups and legal holds: Encrypted database backups follow a fixed rolling rotation cycle and are overwritten on expiry. Justified legal holds for active claims, disputes or regulatory inquiries pause normal deletion until resolved.

Depending on the processing and applicable legal conditions under the UK GDPR and Data Protection Act 2018, you may request access, correction (rectification), erasure, restriction of processing and data portability of your personal data.

YOUR RIGHT TO OBJECT — You may object at any time to processing of your personal data based on our legitimate interests (Article 6(1)(f) UK GDPR) on grounds relating to your particular situation. If we ever use your information for direct marketing, you have an unconditional right to object at any time, and we will stop immediately.

Where we rely on your consent, you may withdraw that consent at any time without affecting the lawfulness of earlier processing. These rights are subject to applicable statutory conditions and exemptions (such as records we are legally required to keep or minimum licence records needed to maintain an active software entitlement you wish to keep).

Automated decision-making (UK GDPR Articles 22A–22D): We do not take legally or similarly significant decisions about you solely by automated means. Automated checks in our checkout and licensing flows (such as enforcing the 2-computer seat cap, flagging tax-location discrepancies or holding a transaction during a payment/fraud check) either apply deterministic contract rules or route exceptions for human review. You can always contact support@flat4audio.com to make representations, request human intervention or contest any restriction on your purchase, account or licence.

Exercising your rights and making a privacy complaint: To exercise a data right or make a privacy complaint, email support@flat4audio.com or write to Hodfords Solutions Limited, 63 Havelock Road, Brighton, England, BN1 6GL. We respond to data-rights requests within one (1) month, and we acknowledge privacy complaints within 30 days, investigate them fairly and communicate the outcome promptly. You also have the right to complain to the UK Information Commissioner’s Office (ICO) at https://ico.org.uk/make-a-complaint/ or by calling 0303 123 1113.

Where you buy or use our services from outside the United Kingdom, Hodfords Solutions Limited remains the data controller (an APP entity under the Australian Privacy Act 1988, an agency under the New Zealand Privacy Act 2020, a data controller under the EU GDPR, the Malaysian PDPA and the Thai PDPA, and a responsible party under South Africa’s POPIA). The purposes, data categories, recipients and retention periods set out above apply equally across all regions.

Cross-border transfers: transfers from the European Economic Area to the United Kingdom rely on the European Commission’s UK adequacy decision; onward transfers to our processors in the United States and Hong Kong rely on the European Commission’s Standard Contractual Clauses together with technical encryption and access safeguards. From Australia, New Zealand, Malaysia, Thailand and South Africa, your personal data is disclosed to our UK, US and Hong Kong systems to perform our contract with you, under binding contractual data-protection obligations comparable to your local law.

EU representative (GDPR Article 27): EU checkout is currently unavailable, and we have not appointed an EU representative. We handle privacy enquiries through support@flat4audio.com. Before opening EU checkout, we will either appoint a representative established in the EU and publish their contact details here, or document why an Article 27 exemption applies.

Your regional authority: in addition to the UK Information Commissioner’s Office, you may complain to your local data-protection authority — the relevant EU/EEA supervisory authority; in Australia the Office of the Australian Information Commissioner; in New Zealand the Office of the Privacy Commissioner; in Malaysia the Personal Data Protection Commissioner; in Thailand the Personal Data Protection Committee; and in South Africa the Information Regulator.

We use strictly necessary cookies and local storage technologies across the store, hosted checkout and audio plugins (exempt from prior consent under regulation 6 of the UK Privacy and Electronic Communications Regulations (PECR)). Our audio plugins use no advertising, retargeting or analytics cookies. With your prior affirmative consent, the Flat4Audio store additionally sets Google Analytics 4 analytics cookies and Meta (Facebook/Instagram) advertising cookies (described below); declining or withdrawing consent keeps them off:

• auth_session (First-party HttpOnly, SameSite=Lax, Secure cookie): Holds an opaque random session token (stored only as a SHA-256 hash on our server) to keep you signed in after using a sign-in link or password. Expires after 30 days of inactivity (90-day hard ceiling) or immediately when you sign out.
• __Host-stripe_guest / stripe_guest (First-party capability cookie): Authorises your browser to view post-checkout order confirmation status and installer download links for 30 days following a guest checkout.
• aur-cart / f4cart and hosted-checkout-attempt:* / hosted-checkout-order:* (Browser localStorage): Keeps your current shopping basket on your device and stores a temporary checkout attempt UUID (attemptKey) during checkout to prevent duplicate payment orders on page refresh (cleared automatically once the order settles).
• Revolut Hosted Checkout cookies (checkout.revolut.com): Used by Revolut on its hosted payment page for payment session security, 3D Secure authentication and fraud prevention under the Revolut Cookie Notice.
• Plugin licence files (.serial, .aurlic, machine.mkey): Stored locally on your computer in ~/Library/Auriatorium/licences/ (macOS) or %APPDATA%\Auriatorium\licences\ (Windows) solely to verify your signed licence receipt and unwrap sample content keys during offline use.
• Google Analytics 4 cookies (_ga, _ga_<id>) — set by Google LLC only after you consent: When you choose “Accept analytics” in the cookie banner, these first-party cookies measure aggregate, non-advertising site usage (such as pages viewed, sessions and approximate country) so we can improve the store. This site's Measurement ID is G-EF8NQQPLCW. They load only after your affirmative choice, carry no Google advertising signals, and you can decline or withdraw at any time via the banner. See the Google Privacy Policy.
• Meta Pixel cookies (_fbp, _fbc) — set by Meta only after you allow advertising: When you choose “Accept all” or “Allow advertising”, these first-party cookies (each stored for up to 90 days) let us measure the effectiveness of our Meta (Facebook/Instagram) advertising. They load only after your separate advertising choice; declining, choosing “Analytics only”, or withdrawing via “Cookie settings” keeps them off. See the Meta Cookies Policy.

With your separate affirmative advertising consent (selected via our cookie banner or the footer “Cookie settings” control), this store uses the Meta (Facebook/Instagram) Pixel (ID 1104619929035232) and, where enabled, the server-side Meta Conversions API to measure the effectiveness of our advertising. When you allow advertising, the browser pixel loads from connect.facebook.net, sets the _fbp cookie (and reads or sets _fbc if you arrived via a Meta ad click, each stored for up to 90 days), and logs PageView and completed checkout Purchase events. When a paid order completes and you had granted advertising consent at checkout, our server also sends a deduplicated Purchase event via the Conversions API containing the order total (value and currency), the order reference as the deduplication event_id, a one-way SHA-256 hash of the buyer email address, and any present _fbp/_fbc cookie identifiers. Hodfords Limited (Hong Kong), Hodfords Solutions Limited(Merchant of Record for store checkouts), and Meta Platforms Ireland Limited act as joint controllers for the collection and transmission of this event data under the Meta Controller Addendum, and transfers to Meta Platforms, Inc. (US) rely on the UK Extension to the EU-US Data Privacy Framework and the UK IDTA / Standard Contractual Clauses. If you decline advertising, choose “Analytics only”, or withdraw your consent via “Cookie settings”, optional browser tracking stops and future checkouts do not include advertising consent. Withdrawing consent does not undo data already sent from an earlier consented visit or checkout.

Google Analytics loads only after your prior affirmative consent and can be withdrawn at any time using the cookie banner. Any further non-exempt analytics or advertising technology would likewise not load unless and until you give prior affirmative consent, and we will update this notice with full provider details and withdrawal controls before activation.

Questions about your privacy? Email support@flat4audio.com or write to Hodfords Solutions Limited, 63 Havelock Road, Brighton, England, BN1 6GL.