Privacy Notice

This Privacy Notice explains how GN NEODIGITAL TECHNOLOGIES LTD (registration number ΗΕ 448693), Leoforos Ellados 79, 8020 Paphos, Cyprus, email: info@ndt.cy (“NDT”, “we”, “us”, “our”) collects, uses, shares and protects personal data in connection with Looper Studio (the “App”) and related online services (together, the “Services”).

This Privacy Notice is intended to meet transparency requirements under the EU General Data Protection Regulation (GDPR) and Cyprus data protection law. If you access the Services from outside the EEA/UK, local laws may also apply.

1. Who we are (controller) and how to contact us

Data controller: GN NEODIGITAL TECHNOLOGIES LTD

Registration No.: ΗΕ 448693

Address: Leoforos Ellados 79, 8020 Paphos, Cyprus

Email: info@ndt.cy

Data protection contact: support@looper.studio

2. What this Privacy Notice applies to

This Privacy Notice applies to:

• Looper Studio on macOS, iPadOS, Windows and Linux
• Our account system, licence/activation services, cloud sync
• Community features (Community Presets/Templates and Showcase)
• Our website and account portal
• Our forum and support channels (email/forum)
• Push notifications where enabled

It does not cover third-party services you may use (including but not limited to Apple, Microsoft, Polar.sh, or third-party plugin developers), which have their own privacy notices.

3. Personal data we collect

We collect personal data in the following categories:

3.1 Account and profile data

• Email address
• Username / display name
• Password (stored as a secure hash)
• Account settings and preferences
• Subscription/licence entitlement status
• If you sign in with Google or Apple: your name and email address, received from that provider

3.2 Licence/activation and device data (desktop)

For desktop versions, our backend can see devices activated and may process:

• Operating system
• Amount of RAM
• CPU information (high-level)
• Hardware identifier (hardware ID)
• Activation events and number of activations (to enforce the 1 user / 3 devices rule)

The hardware identifier is a one-way hash derived from your device’s hardware. We do not receive the raw values.

We also keep a record of each licence check: whether it was allowed or refused and why, the device name, the operating system and the app version. We do not store your IP address with these records.

3.3 User Content you choose to upload (cloud sync and community)

If you enable cloud sync or use community features, we process User Content you upload, such as:

• Projects and related files for synchronisation
• Presets/effect settings and song templates you upload (Community Presets/Templates)
• Finished songs you publish for streaming/listening (Showcase)
• Metadata associated with uploads (e.g., titles, timestamps, versioning)

Audio processing: Audio processing happens locally on your device. We do not process your audio on our servers except as necessary to store, synchronise, or stream content you choose to upload.

3.4 Crash reports and diagnostics

Crash reporting is disabled by default. If you opt in through Looper Studio’s platform-specific settings or preferences, a crash report is sent automatically to Sentry.io when the application crashes. Sentry.io processes the report on our behalf in its EU region, in Frankfurt, Germany. Based on our current configuration and understanding, crash reports are not accessible from outside the EEA.

Active crash reports in Sentry.io are deleted after 30 days.

A crash report may contain:

• information about the part of Looper Studio’s code that was running when the application stopped;
• the names, versions and locations of Looper Studio program files, its components and relevant system files;
• the Looper Studio version and build;
• your operating-system name and version and processor type;
• the name of your audio device, its sample rate, buffer size and number of channels;
• the number and names of plugins loaded at the time of the crash;
• the command names of your last 50 actions in Looper Studio, such as “Record” or “Stop clip”, without the values or content associated with those actions;
• a genuinely random installation number generated solely for crash-reporting purposes, which cannot be traced back to you or linked to identifiable user data; and
• a copy of parts of the application’s working memory at the time of the crash, which may contain limited fragments of information that the application was handling at that moment.

Except as described below for Windows, crash reports do not intentionally collect songs or user file names, audio recordings, project folders, your email address or Account information, your licence key or your computer name. The plugin information is limited to the number and names of loaded plugins and cannot identify you or reveal personal or proprietary project information. The working-memory copy may nevertheless contain limited accidental fragments of information that were present in the application’s memory when the crash occurred.

Your IP address may be used to deliver a crash report to Sentry.io but is not stored as part of the report.

On Windows, the crash-reporting tool copies your Windows user name, your computer’s name, other environment settings, the command line that started the application and its current folder into every report. Sentry.io uses these values to build the report and then deletes them. They are not stored in the report it keeps.

One computer sends at most 5 crash reports a day.

To fix a crash, we may keep a short summary of where it happened in our private issue tracker for longer than 30 days: the type of crash, the Looper Studio version, the names of functions in Looper Studio and plugin code, and the names of the loaded plugins. That summary contains no installation number, system details, list of commands or memory copy.

You may disable crash reporting at any time through the relevant setting or preference in Looper Studio. Disabling crash reporting stops future reports from being sent, including reports that have not yet been transmitted, but does not withdraw or delete a report that has already been sent.

3.5 Push notifications and in-app messaging

If you enable push notifications (or if your device settings allow them), we may process:

• A device push token / notification identifier
• Notification preferences
• Delivery and interaction data (e.g., whether a notification was delivered/opened), where available and enabled

Push notifications may be delivered through platform services (for example Apple Push Notification service (APNs) or equivalent platform services). These platform providers process data under their own policies.

3.6 Support communications

If you contact us via email, we process:

• Your contact details and account identifiers
• The content of your messages and any attachments
• Troubleshooting information you provide

3.7 Purchases and billing information

• Store transaction/receipt identifiers and entitlement status (Apple/Microsoft)
• For website purchases: limited transaction metadata (e.g., purchase status, invoice/receipt IDs) via Polar.sh

We do not store full payment card details; payment processing is handled by the relevant Store Provider or Polar.sh.

3.8 Forum data

If you use our forum we may process:

• Username/display name, profile data you choose to add
• Posts, comments, messages and moderation history
• IP address and logs for security/abuse prevention (where collected by the forum software)

3.9 Website data and cookies

When you visit our website, we may collect:

• IP address and basic device/browser information
• Cookie identifiers and usage data (see Section 12)
• Page-visit counts from Vercel Analytics, which uses no cookies and stores nothing on your device
• A record of your cookie choice: the choice, the date and a random identifier kept in your browser, without your IP address, email address or Account

3.10 Email records

We keep a record of each email we send you: its type, subject, the time it was sent and the delivery status reported by our email provider, Resend (for example, delivered or bounced). We do not keep a copy of the email’s content, and we do not track whether you open emails or click their links.

4. How we use personal data (purposes)

We use personal data to:

• Create and administer accounts
• Provide Looper Studio and the Services (including cloud sync and community features)
• Authenticate users and enforce licences/activation limits
• Process purchases/entitlements and provide access to paid features
• Provide support and respond to enquiries
• Improve stability, performance and security (including crash diagnostics)
• Detect, prevent and investigate abuse, fraud, piracy, and security incidents
• Moderate community features and enforce our terms (including handling IP complaints)
• Send marketing communications (where permitted—see Section 10)
• Send service/transactional messages (e.g., security alerts, account notices, subscription status)
• Comply with legal obligations (tax, accounting, lawful requests)

5. Legal bases for processing

We process personal data under one or more of the following legal bases:

• Contract (Article 6(1)(b) GDPR): to create and administer Accounts, provide Looper Studio and the Services, authenticate users, enforce licences and activation limits, provide cloud synchronisation and community features, process purchases and entitlements, and send necessary transactional and service-related communications.
• Legitimate interests (Article 6(1)(f) GDPR): to secure, maintain and improve the Services; prevent fraud, abuse, piracy and security incidents; provide essential technical diagnostics and support; administer and protect our business; and establish, exercise or defend legal claims. Where we rely on this basis, we balance our interests against your rights and freedoms.
• Consent (Article 6(1)(a) GDPR): where you have given consent, including when you opt in to optional desktop crash reporting, where required for non-essential Website cookies or analytics, and where consent is required for marketing communications or other optional processing. You may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
• Legal obligation (Article 6(1)(c) GDPR): to comply with applicable legal, regulatory, tax, accounting and law-enforcement requirements.

Crash reporting is disabled by default and is activated only if you opt in. The processing of crash reports after opt-in is based on your consent. Details of the information contained in crash reports, the processing location, retention period and how to disable crash reporting are provided in Section 3.4.

6. Where we store/process data (hosting and locations)

6.1 Cloud sync storage (EU)

For personal user file synchronisation, we use Cloudflare R2 with EU jurisdiction. Cloud sync files are encrypted at rest.

6.2 Forum hosting (EU)

Our forum server is located in Frankfurt, Germany (EU).

6.3 Website, CDN and data routing

Our Website and related online services may use content-delivery, security and traffic-management infrastructure to deliver content efficiently, protect against abuse and attacks, manage traffic and maintain the availability and security of the Services.

When you access the Website or related online services, certain network and technical information, such as your IP address, request data, browser and device information and security logs, may be processed at locations selected by the relevant provider according to factors such as your geographic location, network conditions, availability and security requirements.

The location of processing may differ depending on the service and its technical configuration. The fact that a user accesses the Website from outside the EEA does not, by itself, mean that all personal data is transferred outside the EEA. Website analytics, monitoring and similar technologies are described in the Cookie Policy. Information about international transfers is provided in Section 7.

6.4 Crash reports

If crash reporting is enabled in the desktop application, crash reports are sent to Sentry, operated by Functional Software, Inc., for processing on our behalf. Crash reports are configured to be processed in Sentry’s EU region, in Frankfurt, Germany. Sentry deletes crash reports after 30 days.

We do not intentionally route crash reports through a global processing region. Any access to crash reports by Sentry or its authorised personnel or service providers will be subject to the safeguards described in Section 7. The categories of information contained in crash reports are described in Section 3.4.

7. International transfers

GN NEODIGITAL TECHNOLOGIES LTD is established in Cyprus. We aim to process personal data within Cyprus or the European Economic Area wherever reasonably possible. The fact that Looper Studio is available to users worldwide does not, by itself, mean that a user’s personal data is transferred outside the European Economic Area.

Desktop crash reports are configured to be processed by Sentry.io in its EU region, in Frankfurt, Germany. Based on our current configuration and understanding, crash reports are not accessible from outside the European Economic Area.

Some other providers used to operate the Website and Services may process or access personal data outside the European Economic Area or the United Kingdom, depending on their technical configuration and service arrangements. This may include providers supporting payments, Store distribution, email, support, Website delivery, security or other infrastructure.

Where the GDPR or UK GDPR applies and a transfer of personal data outside the European Economic Area or the United Kingdom takes place, we will use a lawful transfer mechanism and appropriate safeguards required by applicable law. Depending on the circumstances, this may include an adequacy decision, the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Agreement or UK Addendum, or other legally recognised safeguards.

Further information about relevant international transfers and safeguards may be obtained by contacting us at support@looper.studio.

8. Sharing and disclosures (recipients)

We may share personal data with:

8.1 Store Providers

• Apple App Store and Microsoft Store (to confirm purchases/entitlements, handle billing/refunds per their terms).

8.2 Payment processor (website)

• Polar.sh for website payments/subscriptions.

8.3 Infrastructure, hosting and diagnostic providers

We use third-party providers to host, secure and operate parts of the Services. These providers process personal data on our behalf as processors and are subject to contractual obligations to protect personal data and process it only for authorised purposes.

Relevant providers may include:

• Cloudflare R2, for cloud-synchronisation storage;
• Sentry.io, for Website error, performance and stability monitoring and for optional desktop crash reporting;
• Supabase, for our database, Account sign-in and file storage;
• Resend, for email delivery;
• Upstash, for rate limiting;
• Vercel, for Website hosting and cookie-free page-visit counts;
• providers supporting our Website, Account systems, email delivery, forum, security and other infrastructure; and
• other service providers engaged from time to time to provide, maintain, secure or support the Services.

Sentry.io processes desktop crash reports in its EU region, in Frankfurt, Germany. Crash reporting is disabled by default and is activated only if you opt in. Active crash reports are deleted from Sentry.io after 30 days. The information contained in desktop crash reports is described in Section 3.4.

The specific information processed by each provider depends on the service it provides. Information about Website cookies and similar technologies is provided in the Cookie Policy. Information about international transfers is provided in Section 7.

8.4 Platform push notification services

Where push notifications are enabled, delivery may involve platform notification services (e.g., APNs). These providers process data as described in their own privacy policies.

8.5 Legal and safety

We may disclose personal data if we believe it is reasonably necessary to:

• comply with law, regulation, court order, or lawful request;
• protect rights, safety and security of NDT, our users or others; or
• investigate and enforce violations of our terms.

8.6 Corporate transactions

If NDT is involved in a merger, acquisition, reorganisation or sale of assets, personal data may be transferred as part of that transaction, subject to appropriate safeguards.

8.7 Analytics and advertising providers (only with your consent)

If you allow it in the cookie banner: Google (Tag Manager, Analytics and Ads), Meta, Reddit and TikTok. See the Cookie Policy.

9. Retention (how long we keep data)

We keep personal data only as long as necessary for the purposes in this Privacy Notice.

9.1 Cloud sync retention

If you stop using cloud sync (including due to subscription cancellation where cloud sync is a paid feature) or request account deletion, we will retain cloud sync content for up to 30 days to allow you to export or reinstate, after which we will delete it from active systems, subject to backup retention and legal requirements.

9.2 Account deletion grace period (reinstatement)

If you delete your account, we may retain certain account data for up to 30 days to allow account reinstatement if you change your mind. After that period, we will delete or irreversibly anonymise your account data where feasible, subject to legal obligations and backup retention.

9.3 Other retention

• Activation and device data: retained for as long as reasonably necessary for licence administration, fraud prevention, security, compatibility and support, and for any reasonable audit or security period afterwards.
• Crash reports: active crash reports in Sentry.io are deleted after 30 days. The genuinely random installation number associated with a crash report is used solely for crash reporting and cannot be traced back to you or linked to identifiable user data.
• Support communications: retained for as long as reasonably necessary to address the relevant issue and maintain appropriate business and legal records.
• Financial records: retained for the periods required by applicable tax, accounting and other legal obligations.
• Google Analytics data: retained for 14 months.

The 30-day deletion period applies to active crash-report data held in Sentry.io. This section does not make any representation about backup or residual copies held outside Sentry.io, which may be subject to the retention practices of the relevant systems or providers.

10. Marketing emails (no double opt-in)

10.1 What we send

We may send marketing emails such as product announcements, new features, special offers, and tips about Looper Studio.

10.2 How we obtain permission / legal basis

We do not use double opt-in by default.

• Where required by applicable law, we will send marketing emails only with your opt-in consent.
• Where permitted by law (including “soft opt-in”/existing-customer marketing rules), we may send marketing emails to users who have purchased or subscribed, limited to similar products or services, and we will provide a clear ability to opt out.

10.3 How to opt out

You can opt out at any time by:

• clicking the unsubscribe link in any marketing email, and/or
• changing your preferences in your account settings (if available), and/or
• contacting info@ndt.cy

Service messages: Even if you opt out of marketing, we may still send non-marketing emails necessary to provide the Services (e.g., security alerts, transactional messages, subscription notices).

11. Your rights

Depending on your location, you may have rights including:

• access to your personal data
• correction (rectification)
• deletion (erasure) in certain cases
• restriction of processing
• data portability (where applicable)
• objection to processing based on legitimate interests
• withdrawal of consent (where processing is based on consent)
• lodge a complaint with a supervisory authority

To exercise rights: contact support@looper.studio. We may need to verify your identity.

Cyprus supervisory authority: Office of the Commissioner for Personal Data Protection (Cyprus). You may also complain to your local EEA authority.

12. Cookies and analytics (website)

We use cookies and similar technologies on our website.

12.1 Types of cookies

• Essential cookies: required for core functionality (e.g., login sessions, security). These may be used without consent where permitted by law.
• Analytics cookies: used to understand website usage and improve the website. Where required by law, we will request your consent before placing analytics cookies.
• Advertising cookies: used by Google Ads, Meta, Reddit and TikTok to measure which ads lead to sign-ups and purchases, and to show our ads to people who visited the website. We place these only with your consent.

12.2 Cookie choices

You can control cookies through:

• our cookie banner / cookie settings tool at the bottom of the webpage and/or
• your browser settings (which may affect site functionality).

12.3 More information

See our Cookie Policy: https://looper.studio/legal/notice

13. Security

We implement reasonable technical and organisational measures designed to protect personal data, including security practices appropriate to the risk. However, no system is perfectly secure.

14. Special categories of data

We do not intentionally collect or process special category data (such as health data, biometric data, or data revealing racial or ethnic origin, political opinions, religious beliefs, or sexual orientation). Please do not submit such data to us.

15. Children

Looper Studio is not directed to children under 16, and we do not knowingly collect personal data from children under 16. If you believe a child has provided personal data, contact support@looper.studio.

16. Third-party links and plugins

Looper Studio supports third-party plugins (VST3/AU/AUV3). Third-party plugins and websites may collect data under their own privacy practices. We are not responsible for third-party privacy practices.

17. Changes to this Privacy Notice

We may update this Privacy Notice from time to time. If changes are material, we will provide notice via the App, Services, and/or our website. The “Last updated” date shows when this notice was last revised.

18. Contact

Questions, requests, or complaints: info@ndt.cy

Postal address: GN NEODIGITAL TECHNOLOGIES LTD, Leoforos Ellados 79, 8020 Paphos, Cyprus.