1. Controller
Studiomood Ltd, Tagm gonia demetriou pouliou & Kost. Pantelidi, MELNA COUTR, 8011, Paphos, Cyprus, company registration number HE 495191.
Email: info@volumekeys.app. Product support: support@volumekeys.app.
2. Website delivery and security
The website is delivered through Cloudflare. When you request a page, technically necessary connection data such as IP address, request time, requested resource, browser information and security signals can be processed to deliver the site, prevent abuse and diagnose failures.
Legal basis: our legitimate interests in secure, reliable website delivery (Article 6(1)(f) GDPR). Where data is necessary to answer a request before a contract, Article 6(1)(b) GDPR also applies.
Cloudflare may process data outside the EEA under appropriate transfer safeguards. See Cloudflare’s privacy policy.
3. Privacy choices and storage
We use no advertising or audience-analytics cookies. A technically necessary local-storage entry records whether you allow optional external media. It contains the choice, a policy version and a timestamp, and is requested again after 180 days.
You can reject optional content as easily as accepting it. Change or withdraw your choice at any time:
4. YouTube video
The local video poster does not contact YouTube. The YouTube player is created only after you allow external media and press play. We use YouTube’s privacy-enhanced domain, but Google can still receive connection data and, depending on your account and browser state, associate playback with you.
Legal basis: your consent (Article 6(1)(a) GDPR and applicable ePrivacy rules). Refusing has no effect on the rest of the website. Withdrawal blocks future loads but cannot reverse data already sent during playback.
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. See Google’s privacy policy.
5. Contact and support
If you email us or use the contact form, we process your name if provided, email address, topic, message, attachments you choose to send, technical delivery metadata and our reply. Do not send passwords, license keys or unrelated sensitive data.
The form uses Cloudflare Turnstile to distinguish legitimate requests from automated abuse without image puzzles. Turnstile processes browser and device signals for security. Form messages are delivered through our configured transactional email provider, Resend.
Legal bases: steps at your request and contract support (Article 6(1)(b) GDPR), compliance with legal duties (Article 6(1)(c)), and our legitimate interests in secure support and abuse prevention (Article 6(1)(f)).
We retain ordinary correspondence until the request is resolved and then only as long as needed for follow-up, legal claims or mandatory record-keeping. Messages not needed for those purposes are routinely deleted within three years.
6. Checkout and payments
Lemon Squeezy acts as merchant of record for purchases. It receives the information needed to run checkout, take payment, calculate tax, issue receipts, prevent fraud and handle refunds. Payment-card details are not sent to Studiomood Ltd.
We receive limited order and license information needed to provide and support VolumeKeys, such as order, product, variant, license and status identifiers. The legal bases are contract performance, legal duties and fraud prevention.
7. Trial and license service
The entitlement service stores only limited operational data: a device public key and pseudonymous device hash, trial timestamps, app and operating-system version, pseudonymous license-key correlation, Lemon order/license/instance identifiers, activation state and security records. Raw license keys are not stored. No audio, hardware serial number, customer name or customer email is stored in this service.
- Rate-limit records are removed after seven days.
- Webhook replay hashes are removed after 180 days.
- A pseudonymised source-IP value is removed from trial records after 30 days.
- The pseudonymous trial record remains while the trial programme is offered so reinstalling does not create repeated trials.
- Purchase and revocation records remain while needed to operate, transfer, refund, secure or defend the license and are reviewed when the product or license relationship ends.
Legal bases: providing the trial or paid license (Article 6(1)(b) GDPR), fraud and abuse prevention plus license security (Article 6(1)(f)), and legal record-keeping where applicable (Article 6(1)(c)).
8. Recipients and international transfers
Data is disclosed only where needed to Cloudflare (hosting, security, Turnstile and entitlement infrastructure), Resend (contact delivery), Lemon Squeezy and its payment providers (checkout), Google/YouTube after consent, professional advisers, and authorities where legally required.
Where a provider processes data outside the EEA, we rely on an adequacy decision, the EU Standard Contractual Clauses or another lawful transfer mechanism, together with supplementary safeguards where required.
9. Your rights
Subject to the GDPR conditions, you can request access, correction, deletion, restriction, portability, or object to processing based on legitimate interests. You may withdraw consent at any time without affecting earlier lawful processing.
Contact info@volumekeys.app. You may also complain to the Office of the Commissioner for Personal Data Protection in Cyprus or the supervisory authority where you live or work.
We do not use solely automated decisions that produce legal or similarly significant effects.