AUREL AUDIO / CUSTOMER INFORMATION

Privacy

Draft customer information for sandbox testing. Live purchases are closed.

Privacy notice version 2026-10-17.3-draft. Updated October 17, 2026.

Who is responsible

Alexander Lentz, operating as Aurel Audio, is the controller for the Aurel website, direct purchases, customer accounts, activation and support. Stripe, Cloudflare and Resend also process data under their applicable roles and terms. For transactions sold through Link, Stripe acts as merchant of record and processes payment, tax, fraud, transaction-support and legal-compliance data under its own applicable responsibilities. See Stripe’s privacy notice. Aurel receives the order information needed to supply and support the license.

Information we use and why

• Purchases: name, email, billing/tax details and order, payment and refund references. We use these to supply purchases, keep financial records, prevent fraud and provide support. Stripe collects payment-card details; Aurel's application does not receive full card numbers or CVCs.
• Accounts: email, account identifiers and first/last names you save. A one-use email link signs you in for one hour.
• Activation: license and registration identifiers, a product-specific device hash, computer name, registered name, and authorization/check timestamps. A raw Windows MachineGuid stays on the device; the plugin sends a derived hash. We use these to activate up to three computers and renew 30-day offline authorizations. We do not transmit your audio or DAW project contents for licensing.
• Security and hosting: network request information, including IP addresses and technical logs. The application uses hashed identifiers for rate limits. A hash can still be personal data; it is not treated as anonymous simply because it is hashed.
• Purchase acknowledgements and withdrawal: the exact terms and information shown, document versions/digests, acknowledgement time and checkout reference; withdrawal name/email, order reference, statement, receipt time and processing status.
• Support: messages and files you choose to send. Do not send payment passwords, full card details, or unrelated sensitive information.

Legal bases where GDPR applies

We use necessary account, order, delivery, licensing and support information to perform the contract or take requested steps before it. We retain records needed to meet legal obligations, including tax and consumer duties. Preventing misuse and maintaining secure services may rely on legitimate interests, subject to your rights and a documented assessment. We do not treat license acceptance as blanket marketing consent.

Service providers and international transfers

Cloudflare hosts the website, Worker services and databases and forwards support mail; Stripe processes payments, billing and tax calculations and, for Managed Payments transactions, handles covered indirect-tax compliance and payment support through Link; Resend delivers transactional emails; Google's Gmail receives support mail. Data may be processed in the United States and other countries. Before live EU sales, the applicable provider contracts, transfer mechanisms and safeguards must be verified and documented. This draft does not claim those checks are already complete.

Retention

Sign-in links and sessions expire after one hour; scheduled cleanup removes expired authentication records. Rate-limit records are retained briefly for abuse prevention and cleanup. License and device records remain while needed to supply and support the license, handle security and resolve disputes. Deactivating a computer marks the registration inactive and does not erase its history immediately.

We keep financial and consumer-contract records for applicable legal limitation and recordkeeping periods; EU OSS records, if that scheme is used, require a 10-year retention period. A verified erasure request is assessed against those obligations. Unneeded support material should be removed when the issue and retention need end. Final operational retention periods and provider log retention remain launch-review items.

Your rights and requests

Where applicable, you may request access, correction, erasure, restriction, portability, or object to processing. Email support@aurel-audio.com from your purchase/account address. We may verify ownership before releasing data or changing a license. GDPR requests are normally answered within one month, subject to lawful extensions and exceptions. You may complain to the data protection authority where you live or work, or where an alleged infringement occurred.

Deleting data essential to an active license can affect account recovery and activation. We will explain the consequences and any records that must be retained before acting. This does not remove your statutory rights.

Cookies, tracking and children

The account uses a necessary, HttpOnly session cookie, with SameSite restrictions and Secure on HTTPS. The storefront does not add advertising or analytics scripts, and does not request camera, microphone or location access. Stripe and hosting providers may use necessary fraud-prevention or service technologies on their own pages. Aurel does not knowingly market the service to children.

Updates to this notice

Material changes will be described in an updated notice. A change to this webpage does not by itself establish consent where consent is required.