Privacy

Who is asking

Arnaud Botton, at 139 rue Bugeaud, 69006 Lyon, France, is the controller of this data under the General Data Protection Regulation. Write to hello@opusdsp.com about any of it. There is no data protection officer: this is one person and one product, which is below every threshold that requires one.

What we hold

Four things, and nothing else.

Your account

Your name, your e-mail address and your password. The name is there because it is written inside the licence - a licence with somebody's name on it is worth less to whoever is thinking of passing it on, which is the only real brake on sharing that exists. The password is never stored: what is stored is a hash of it, by Supabase, and nobody here can read it or recover it.

What you bought

The date, the amount, the product, and Stripe's own reference for the payment. We do not receive your card number, and we could not keep it if we wanted to.

Your machines

For each computer you activate: a fingerprint and a name. The fingerprint is sixteen hexadecimal characters worked out from the machine itself; it cannot be turned back into anything about the machine and it identifies nothing but "this computer again". The name is whatever your computer calls itself, which is how you recognise which of your three machines is which on your account page. That is the whole purpose: three at a time is a promise we can only keep by being able to count them.

Logs

The site's own server logs, kept by Railway, which record the address a request came from, the page asked for and when. MOTION also asks this site once, when its window opens, whether a newer version exists; that request carries the version you are running and, like every request on the internet, your IP address. Nothing about your sounds, your presets or your projects ever leaves your computer.

Counting visits

This site uses Google Analytics to count visits, which pages are read and roughly where readers are in the world. It sets Google's own cookies to tell one visit from the next. We use it to know whether anybody is reading, and for nothing else. If you would rather not be counted, any browser setting or extension that blocks it works here - the site does not check, and nothing about it is required to buy, activate or use anything.

What we do not do

No Facebook, no pixel, no fingerprinting, no session recording, no advertising, no profiling, and nothing sold or shared with anybody for their own purposes. Apart from the analytics above, there is exactly one cookie and it is the one that keeps you signed in; it carries a signed session identifier and nothing else, and it is strictly necessary to do what you asked for.

Why we are allowed to hold it

Your account, your purchase and your machines: because we cannot sell you a licence, let you activate it or honour the three-machine promise without them. That is performance of the contract, Article 6(1)(b).

Keeping the count of machines and refusing a fourth: our legitimate interest in not having the licence passed around, Article 6(1)(f). It is the least intrusive way we could find to do it - a fingerprint that says "the same machine" and nothing more.

The record of the sale: a legal obligation, Article 6(1)(c). French law requires a seller to keep accounting records for ten years and we cannot delete an invoice because somebody asks.

The logs: legitimate interest in a site that works and is not being attacked.

Who else touches it

Three companies, each doing one job, each bound by a processing agreement and none of them permitted to use any of it for anything of their own.

• Stripe — takes the payment and keeps the record of it, in Ireland and the United States. their privacy notice
• Supabase — holds the accounts, the licences and the machines, in the European Union (Frankfurt). their privacy notice
• Railway — runs the site and keeps its logs, in the United States. their privacy notice
• Cloudflare R2 — stores the installers you download, in the European Union. their privacy notice

Two of those are in the United States. Those transfers rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework where the company is certified under it, and on the Commission's standard contractual clauses where it is not.

How long

Your account, your licence and your machines: until you delete the account, or until you ask us to. Then they go.

The record of the sale: ten years, because we are required to keep it.

Logs: a few weeks, and then they roll off on their own.

What you can make us do

Ask for a copy of everything we hold about you. Have anything wrong put right. Have it deleted - which for the account means the licence goes with it, since the licence is the account. Have it sent to you in a form you can take elsewhere. Object to what we do on legitimate interest. Have processing restricted while a disagreement is being sorted out.

Write to hello@opusdsp.com and you will get an answer within a month, in practice within a day or two, and it costs nothing.

If the answer is not good enough, complain to the CNIL: 3 place de Fontenoy, TSA 80715, 75334 Paris CEDEX 07, or cnil.fr. You can also go to the authority in the country you live in.

Children

This is a shop for a music tool, not a service for children, and we do not knowingly hold data about anybody under fifteen. If one of them has bought MOTION with a card that was not theirs to use, write to us and we will undo it.

When this page changes

The date at the top says when it last did. If a change means we start doing something materially different with what we already hold, you will get an e-mail about it rather than a quietly edited page.

See also the terms and the legal notice.