Privacy

Version 1.5 · 14 October 2026

Short version: this website sets no cookies, runs no tracking and no advertising pixels. We do not know who you are until you buy something, and even then your payment details never reach us.

Who is responsible

Sarah Johnston, Moosackerweg 30, 87544 Blaichach-Gunzesried, Germany (Oscillate Audio). Contact: [email protected].

When you browse

The site is hosted on Cloudflare Pages. Cloudflare records technical log data such as IP address, time of request and browser type in order to deliver the page and defend against attacks. We do not build profiles from it and we have no analytics tool installed.

Fonts are served from our own site. No request goes to Google or any other font service.

When you buy

Payments are processed by our online reseller Link (Sold through Link, LLC, a Stripe company), acting as merchant of record and as the seller of record for your transaction; card processing is carried out by Stripe. Link and Stripe process your payment data under their own privacy policies (link.com/privacy, stripe.com/privacy). After payment we receive your email address, country, product and order number so that we can deliver your download and licence key. The reseller collects your name, email address, billing country and payment details and is responsible for that data under its own privacy notice, linked in the checkout.

We receive from the reseller only what we need to deliver your order and keep our books: your email address, the products bought, the amount and the country. We never see your card number.

Customer list. After a purchase your email address and the products you own are kept in our order database on Cloudflare and in a list called "Customers" at Brevo (see below). We use them to send you your serial, download links and update notices, never for advertising. Legal basis: Art. 6(1)(b) GDPR.

Mailing list

Our free devices (OSCILLATE CUE, TARN and TALUS) come in exchange for your email address and a subscription to our newsletter; the sign-up form says so before you send it. We store your email address, the time of your request and the wording of the consent you gave, so that we can prove the consent later. We use a double opt-in: you receive one mail asking you to confirm, and nothing else follows until you do. Every mail carries a one-click unsubscribe link; unsubscribing deletes the address. We do not sell, rent or share the list, and we do not use it for anything but news about our own devices. Legal basis: your consent, Art. 6(1)(a) GDPR, which you may withdraw at any time with effect for the future. You keep the free device when you unsubscribe.

Brevo. The newsletter, the double opt-in mail and the "Customers" list run on Brevo (Sendinblue SAS, 55 rue d'Amsterdam, 75008 Paris, France), which processes the addresses as our processor under a data processing agreement. Brevo may record whether a newsletter was delivered and opened, so that we can see that mails arrive; we do not build profiles from it.

When you download

Download links are generated by our own service on Cloudflare Workers and the files are stored in Cloudflare R2. The link contains your order number so that a leaked link can be traced back to the order it came from. Links expire after 72 hours.

Email

Order emails are sent through Brevo. If you sign up for a free device, your address is stored solely to send you the download and our newsletter (about once a week: new releases, updates and recommendations for our own products). Every message carries an unsubscribe link, and one click is enough.

Update notices. When a product you own gets an update, we send you one short service email through Brevo: the product, the new version, what changed and a link to My licenses. This is not advertising and does not depend on the newsletter. We use your email address and the list of products you own, which we hold anyway for your purchase. Legal basis: Art. 6(1)(b) GDPR (your purchase, including telling you about updates to it) and our legitimate interest in informing you about updates and fixes, Art. 6(1)(f) GDPR. Every update notice carries a link to stop them, and you can switch them off or on again under My licenses; we then set a flag on your customer record and send no further update notices.

Reviews. Only buyers can review a product: the review link is tied to a paid order. If you tick “remind me” on the download page after a purchase, we store your email address, the order, the time and the wording of that tick and send you exactly one email after seven days asking you to rate what you bought (Art. 6(1)(a) GDPR, your consent; you can withdraw it any time with the cancel link shown after ticking or by writing to us). Without the tick we never ask by email; you can rate under My licenses. When you submit a review, we publish the stars, your headline and text, the display name you choose, the country of your order and the date on the product page, and we pass them to search engines as structured data so they may appear in search results (Art. 6(1)(a) GDPR, the consent you give when submitting). Ask us at any time and we delete your review. We publish every genuine review, positive or negative; we only remove unlawful content or spam. Nobody is paid or rewarded for a review.

Inside the plug-ins

Our plug-ins and devices work offline. Unlocking checks your serial on your own computer and writes a small licence file to your Documents folder; nothing is sent to us.

Update check. By default, our plug-ins and Max for Live devices ask at most once a day whether a newer version exists, by requesting https://dl.oscillateaudio.com/api/version/<product> — for example /api/version/cairn. The request carries only what any connection technically needs: your IP address and the time of the request. It contains no identifier, no serial number, no email address and nothing about your computer or your projects. Our service answers with the latest version number, a short note and, for paid plug-ins, a list of check values of refunded licences; the plug-in compares that list with its own serial on your computer and switches a refunded licence off. Nothing about your serial leaves your computer for this. Our service does not log or count these requests. The service runs on Cloudflare Workers; Cloudflare processes the IP address as our processor to deliver the answer, as described under When you browse. Legal basis: our legitimate interest in telling you about updates and bug fixes for software you use, Art. 6(1)(f) GDPR. You can switch the update notice off in the plug-in or device at any time. Free devices then make no connection at all; paid plug-ins still ask at most once a week, with exactly the request described above, so that refunded licences can be switched off. Legal basis for that: our legitimate interest in preventing refunded licences from being used, Art. 6(1)(f) GDPR.

Transfers outside the EU

We are based in Germany. Cloudflare, Link/Stripe and Brevo process data in or outside the EU. Where data leaves the EU or UK, it does so under the providers' standard contractual clauses or the EU–US Data Privacy Framework.

How long we keep things

Order records are kept as long as tax law requires. Newsletter addresses are deleted as soon as you unsubscribe. Server logs at Cloudflare are deleted according to their retention policy.

Your rights

Where the GDPR applies, you have the right to access the data we hold about you (Art. 15), to have it corrected (Art. 16) or deleted (Art. 17), to restrict its processing (Art. 18), to receive it in a portable format (Art. 20), and to object to processing based on our legitimate interest (Art. 21). You can withdraw a consent at any time with effect for the future. Write to [email protected] and a person answers. You may also complain to a data protection supervisory authority, in particular the one where you live.