Privacy Policy

1. Who we are

908 Audio ("we", "us") develops and sells the 908 BD, SClap, LowConga and HHat audio plugins through this website. For any privacy question, contact us through the Support page or by email — see "Contact" below.

2. What data we collect

Email address — used to deliver your license key and download link, and to reply if you contact support.

Device identifier (hashed) — when you activate a plugin, it computes a one-way SHA-256 hash of a hardware identifier on your machine. We never see or store the raw hardware identifier, only the hash, and it cannot be reversed back to identify your specific hardware.

Purchase data — amount, currency, payment provider and an order/transaction identifier. We never see or store your card number, PIx key or wallet seed — payment details are handled entirely by our payment providers (see section 4).

IP address — used briefly to rate-limit abuse (e.g. someone trying many license keys in a row) and appears in request logs. We also keep a one-way hash of the IP (never the address itself) alongside each license activation attempt, so that if there's ever an incident we can tell what happened and when. It is not used to track you across sessions or for advertising.

Support messages — the email address and message you submit through the Support form, plus the serial/order ID you provide to prove the request is about a real purchase.

3. Why we process it, and on what legal basis

To fulfil your purchase and issue/activate your license — necessary to perform our contract with you.

To prevent fraud and abuse (e.g. license keys being brute-forced, or a device pretending to be many different customers) — our legitimate interest in keeping the licensing system usable for paying customers.

To answer support requests — necessary to perform our contract with you, or based on your consent to be contacted.

To keep minimal accounting/order records where a legal or tax obligation requires it.

4. Who we share it with

We use a small number of external providers to run the store and the license backend. Each only receives the data it needs to do its job:

Paddle — our Merchant of Record for card and PayPal payments; they handle your payment details directly and issue receipts/tax documents. NOWPayments — processes cryptocurrency payments. Mercado Pago — processes Pix payments (Brazil). Resend — delivers transactional email (license keys, support replies). Supabase — hosts the database that verifies and activates your license.

These providers are located outside Brazil (mainly the United States and the European Union), so using them involves an international transfer of your data. We only share the minimum needed (e.g. email and order amount — never your device identifier with payment providers, and never your card details with us). We do not sell your data to anyone, and we do not use advertising or analytics trackers on this site.

5. Cookies and tracking

This site sets no cookies and loads no third-party analytics or advertising scripts. The only data sent to your browser is what is needed to render the page and process your purchase.

6. How long we keep it

Because our license is a one-time, lifetime purchase, we keep your email and license record for as long as the license could still be activated or supported — there is no fixed expiry — unless you ask us to delete it (see section 8). Rate-limiting data (like IP-based counters) is kept only briefly and cleared automatically once it is no longer needed for abuse prevention. Order/payment records are kept as long as reasonably needed for support, refunds and any applicable accounting obligation.

7. Security

We use HTTPS everywhere, store device identifiers only as one-way hashes, redact email addresses from application logs, and rate-limit the endpoints that touch license data. No system is perfectly secure, but we design with the principle of collecting and keeping the least data necessary.

8. Your rights

Under the LGPD (and, where it applies, the GDPR) you can ask us to: confirm whether we process your data; access the data we hold about you; correct inaccurate data; anonymize, block or delete data that is unnecessary or excessive; receive a copy of your data in a portable format; be told which third parties we've shared your data with; and object to processing based on our legitimate interest. Deleting your data will deactivate your license — we'll always confirm before doing that.

9. How to exercise these rights

Use the Support page (same form used for technical issues) with your purchase email and serial/order ID, or email us directly, and tell us what you'd like (access, correction, deletion, etc.). We verify every request against the serial or order ID for a real purchase before acting on it — this stops someone else from deleting or accessing your license just by knowing your email address. We aim to respond within 15 business days.

10. Changes to this policy, and contact

We may update this page as the product or our providers change; the date at the top always reflects the latest version. For any question about this policy or your data, use the Support page or email us — the address is the one shown on that page.