1. Controller and scope
Studiomood Ltd, Gon.Tagm. Dim. Pouliou & Kost. Pantelidi, MELINA COURT, 2nd floor, 8011, Paphos, Cyprus, company registration number HE 495191.
Email: info@volumekeys.app. Product support: support@volumekeys.app.
This policy covers the VolumeKeys website and the related contact, checkout, trial, licensing and measurement functions described below. The VolumeKeys app processes routed audio locally.
2. Website delivery and security
The website is delivered through Cloudflare. When you request a page, technically necessary connection data such as IP address, request time, requested resource, browser information and security signals can be processed to deliver the site, prevent abuse and diagnose failures.
Legal basis: our legitimate interests in secure, reliable website delivery (Article 6(1)(f) GDPR). Where data is necessary to answer a request before a contract, Article 6(1)(b) GDPR also applies.
Hosting and security logs available in our Cloudflare account are kept according to our Cloudflare plan and settings, then deleted or aggregated when no longer needed for security and fault diagnosis.
For requests from search, AI and link-preview crawlers that identify themselves, we keep daily counts by crawler, page, status and country for up to 400 days. They contain no IP address and are not linked to visitors.
3. Privacy choices
Optional services remain blocked unless you consent. Our consent panel separates Studiomood Intelligence, Cloudflare Web Analytics and Google Analytics 4. Refusing is as easy as accepting. The site continues to work when you reject optional services.
A necessary local-storage entry named volumekeys_privacy_choices_v7 stores the selected services, consent version and time for up to 180 days.
If you withdraw consent, the service no longer loads. Where we can, we clear the analytics data our own site stored in your browser, and we reload the page if the service was already running. Withdrawing consent does not reverse processing that was lawful before withdrawal.
See our cookie and storage policy for technical storage details.
Legal basis: remembering your choice and being able to show it is required by data protection law (Article 6(1)(c) and Article 7(1) GDPR). The storage entry is strictly necessary for this (section 25(2) no. 2 TDDDG and equivalent rules where applicable).
4. Studiomood Intelligence first-party measurement
Studiomood Intelligence (SI) is our own website measurement service. It starts for a visitor only after that visitor explicitly selects it in the consent panel. Rejecting, ignoring or withdrawing that choice prevents future SI browser measurement.
With your consent, a script from the VolumeKeys website sends these events to the VolumeKeys website itself, not to a third party.
The service can process a random 128-bit session identifier, event identifier, timestamp, page path without query or fragment, language, viewport range, referring hostname, approved campaign (UTM) fields, page views, whether you stayed for ten seconds, how far you scrolled, which links you followed, clicks on trial and checkout buttons, demo and video interactions, the fact that a contact form was sent (not its contents), and page-speed metrics (TTFB, LCP and CLS). The website endpoint reads a user-agent value shortened to at most 512 characters solely to derive coarse browser, operating-system and device families. The user-agent value itself is not written to the analytics tables.
After explicit SI opt-in under consent version 6 or later, the browser can store studiomood_si_analytics_session_v1 with a random identifier and expiry time in local storage. The identifier is accepted for no more than 180 days; after that, a new identifier replaces it if you have consented. If you withdraw consent, it is deleted, provided your browser allows local storage.
We use your IP address only to leave our own visits out of the measurement and to create a temporary pseudonym that limits how many requests can be sent in five minutes. That pseudonym expires after ten minutes. The raw IP is not written to the analytics tables or forwarded to another measurement service.
Consented SI events and sessions are written to the existing VolumeKeys Cloudflare D1 database in the configured Western Europe location, where they appear with previously collected consented records in the internal reports. The scheduled weekly maintenance routine applies a 400-day cutoff, so deletion occurs on the next scheduled run after a record crosses that cutoff.
SI does not use fingerprinting, customer identity, names, email addresses, payment or license data, form contents, search contents or audio for this website measurement.
Legal basis: your consent (Article 6(1)(a) GDPR and applicable rules on storage or access on your device, including section 25(1) TDDDG where applicable).
5. Cloudflare Web Analytics
Cloudflare Web Analytics loads only after you select it. Its script then sends the visited page address, the referring page, browser, operating system and device type, the country derived from the connection, and page load and responsiveness timings to Cloudflare. Cloudflare states that it does not record query strings, does not use cookies or local storage to collect these metrics and does not fingerprint visitors by IP address, user agent or other data.
We use the aggregated statistics to see which pages are visited, where visits come from and how fast the website loads, so we can improve content, campaigns and performance. Cloudflare keeps unsampled data for seven days and then a sample of about ten percent, which remains available for six months.
Legal basis: your consent (Article 6(1)(a) GDPR and section 25(1) TDDDG or equivalent ePrivacy rules). You can withdraw it at any time in the privacy settings. Provider: Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA, as our processor under its data processing addendum. Transfers to the United States rely on the EU-U.S. Data Privacy Framework adequacy decision (Article 45 GDPR) and the EU Standard Contractual Clauses (Article 46(2)(c) GDPR).
6. Google Analytics 4
Google Analytics 4 loads only after you select it. It can receive page URLs, campaign parameters, browser and device information, approximate location, page views and conversion events such as trial and checkout clicks. Google states that an IP address is used to derive location and discarded before it is logged in Analytics.
Google signals, advertising personalization and advertising audiences are disabled. GA cookies are configured to expire after no more than 180 days. User-level and event-level data governed by the GA4 retention control is kept for no more than 14 months. Aggregated reporting that is not subject to that control can remain longer.
Legal basis: your consent (Article 6(1)(a) GDPR and applicable ePrivacy rules). Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Where data is transferred to Google LLC in the United States, transfers rely on the EU-U.S. Data Privacy Framework adequacy decision (Article 45 GDPR) and the EU Standard Contractual Clauses (Article 46(2)(c) GDPR).
7. Contact and support
If you email us or use the contact form, we process your name if provided, email address, topic, message, the macOS version and audio interface if you add them in the form, attachments you choose to send by email, technical delivery metadata and our reply. Do not send passwords, license keys or unrelated sensitive data.
The app keeps a limited diagnostic history on your Mac and can create a support report when you ask it to. The report is a local file and leaves your Mac only if you send it to us yourself. It contains no audio, device names, user names, file paths, license keys, email addresses or network addresses. It does list third-party audio drivers by bundle ID, version, signing team and CPU share, and the names of the three processes with the highest CPU use per minute, plus the process IDs of apps that play audio through VolumeKeys (with their names where audio dropped out) and of any process that holds an output device exclusively. You can read it before sending it.
When you use the contact form, a Cloudflare Worker checks your entries and Cloudflare delivers them as an email to our business mailbox. The website does not store the message.
To block automated abuse, the form loads Cloudflare Turnstile once you start using it; reading the email addresses on the contact page does not load it. Turnstile evaluates technical signals such as your IP address, TLS fingerprint and browser information. Cloudflare processes these signals on our behalf and, as its own controller, also to improve its bot detection. The form also limits how many messages can be sent per minute, using a pseudonymous key derived from your IP address that is only used for this one-minute count and is not stored by us. Details are in Cloudflare’s Turnstile privacy addendum.
Legal bases: steps at your request and contract support (Article 6(1)(b) GDPR), legal duties (Article 6(1)(c) GDPR), and our legitimate interests in secure support and abuse prevention (Article 6(1)(f) GDPR). Turnstile and the rate limit are strictly necessary to provide the contact form you choose to use (section 25(2) no. 2 TDDDG).
Ordinary correspondence is kept until the request is resolved and then only as long as needed for follow-up, legal claims or mandatory records. Messages not needed for those purposes are routinely deleted within three years.
8. Checkout and payments
The live purchase URL is not configured on the date shown below. When checkout is enabled and you choose to open it, Lemon Squeezy (Link, LLC) acts as merchant of record and contractual seller. Choosing a purchase button loads Lemon Squeezy’s checkout script from app.lemonsqueezy.com and opens the checkout in a window over the current page or as a separate page. It receives the information needed to take payment, calculate tax, issue receipts, prevent fraud, handle refunds and manage disputes or chargebacks. Payment-card details are not sent to Studiomood Ltd.
Lemon Squeezy decides how it processes checkout data and is responsible for it under its own privacy policy. Where it processes license data on our instructions, its data processing agreement with us applies.
We receive the order and license data needed to provide and support VolumeKeys, such as the buyer's name and email address and order, product, variant, license, activation, refund, dispute, chargeback and status information. Lemon Squeezy shows this data in our seller account and sends parts of it to our license service. The license service stores only identifiers, not your name or email address.
Legal bases: contract performance (Article 6(1)(b) GDPR), legal duties (Article 6(1)(c) GDPR), and fraud prevention (Article 6(1)(f) GDPR). See Lemon Squeezy’s privacy policy.
9. Trial and license service
The public trial and paid activation services are not enabled on the date shown below.
The planned service is designed to use a device public key and pseudonymous device hash, trial timestamps, app and operating-system version, pseudonymous license-key correlation, Lemon Squeezy order, license and instance identifiers, activation state and security records. Raw license keys are not intended to be stored. No audio is sent.
Planned retention is seven days for rate-limit records, 180 days for webhook replay hashes and 30 days for a pseudonymized source-IP value in trial records. Trial, purchase and activation records remain only while needed to provide, secure, transfer, revoke or defend the entitlement and to meet legal record duties.
10. Recipients and international transfers
Data is disclosed only where needed to Cloudflare for hosting, security, the contact form (Turnstile and email delivery), the license service and consent-gated analytics infrastructure, Cloudflare, Inc. for Cloudflare Web Analytics only after Cloudflare Web Analytics consent, Lemon Squeezy (Link, LLC) and its payment providers for checkout and license checks, Google Ireland Limited and Google LLC only after Google Analytics 4 consent, email service providers in the EEA or the United States for receiving, forwarding and storing our business email, professional advisers, and authorities where legally required.
Cloudflare D1 used for VolumeKeys SI analytics is configured for Western Europe. Where Cloudflare, Inc., Google LLC or an email service provider processes data in the United States or another third country outside the EEA, transfers are protected under the EU-U.S. Data Privacy Framework adequacy decision (Article 45 GDPR) where certified and the EU Standard Contractual Clauses (Article 46(2)(c) GDPR) with supplementary technical and organizational measures where required.
Lemon Squeezy (Link, LLC) is based in the United States. What you enter in the checkout goes directly to Lemon Squeezy there. For license data that we exchange with Lemon Squeezy, its data processing agreement provides for the EU Standard Contractual Clauses (Article 46(2)(c) GDPR).
Contact info@volumekeys.app if you want information about an applicable transfer safeguard or a copy where available, subject to protecting the rights of others. On request we also name the specific recipients of your data.
Studiomood Ltd runs company profiles on Instagram, Facebook, X, YouTube, TikTok and Threads; VolumeKeys has no profiles of its own. This website does not load scripts, buttons or embeds from these platforms. If you visit or interact with a profile, the platform operator processes your data, including outside the EEA, as its own controller under its own privacy policy. We see your public interactions and any messages you send us, and we receive statistics from the platforms for our internal reports. For those statistics we may be joint controllers with the operator (Article 26 GDPR; Court of Justice, case C-210/16). Our legal basis is our legitimate interest in presenting our company and answering you (Article 6(1)(f) GDPR). You can use your rights with the operator or at info@volumekeys.app.
11. Retention and deletion
The service-specific periods above are maximums or review criteria, not reasons to keep data that is no longer needed. Previously collected legacy analytics and experiment records remain subject to the previously disclosed maximum 400-day period and can be deleted or aggregated sooner. Switching to our current system does not restart or extend that period.
12. Required information and your rights
You are not legally required to browse the site, accept optional measurement or send a contact request. Required checkout, trial, license and support fields are necessary only when you ask for the corresponding service.
Subject to the GDPR conditions, you can request access, correction, deletion, restriction and portability. You may withdraw consent at any time without affecting earlier lawful processing.
Right to object. Where we process personal data on the basis of legitimate interests (Article 6(1)(f) GDPR), in particular for website delivery and security, support and fraud prevention, you have the right to object at any time on grounds relating to your particular situation (Article 21 GDPR). We will then no longer process the data for these purposes unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defense of legal claims.
A pseudonymous analytics record might not identify you by name. If you request access or deletion of SI analytics data, include the session identifier shown in your browser storage if available so we can locate the record without collecting additional identity data.
Contact: info@volumekeys.app. You may also complain to the Office of the Commissioner for Personal Data Protection in Cyprus or the supervisory authority where you live or work.
United Kingdom and Switzerland. If the UK GDPR or the Swiss Federal Act on Data Protection applies to you, you have the corresponding rights and can also complain to the UK Information Commissioner's Office or the Swiss Federal Data Protection and Information Commissioner.
Other countries. If the privacy law of your country gives you further rights, you can use them through the same contact.
We do not make decisions based solely on automated processing that have legal or similarly significant effects on you.