This policy explains what personal data we collect through this website, why we collect it, who else handles it and what you can require us to do with it. In short, we ask for an email address in four places, and that is the only thing we ever ask you for. We also count page views, without cookies and without tracking anyone between sites. The plugins themselves transmit nothing.
Who we are
Noem determines what personal data is collected through this site and the purposes it is used for, which makes us the controller of that data under the UK and EU General Data Protection Regulation. We are based in India. Any question about this policy, or any request under it, should be sent to hello@noemaudio.com.
What we collect, and why
Downloading a plugin. Your email address, which plugin you asked for, and whether you ticked the box to hear about new releases. Accepting the licence is required to download. Our basis is the step you asked us to take before providing the file. Subscribing is a separate tick, and if you leave it unticked your address is recorded but never sent anything.
The mailing list. Your email address, and which of the three topics you chose. Our basis is your consent, which you can withdraw at any time from the link in every email we send.
An account. The name you give us, your email address, a password that we never see in readable form, whether the address has been proven, and the dates you signed in. The name is only used to address you; leave it as anything you like. Our basis is performing the service you signed up for. Signing in with Google instead tells us your address and nothing else about your Google account.
The contact form and the data request form. Your name, address and message, or your address and what you are asking for. Both arrive as an email and are stored nowhere else. Our basis is our legitimate interest in answering people who write to us, and for a data request, our legal obligation to handle it.
Keeping the site and its forms secure. Cloudflare Turnstile receives your IP address when it verifies that a submission is not automated, and our hosts record standard request information, including IP addresses, in their server logs. Our basis is our legitimate interest in protecting the site from abuse and in keeping it working. We consult the logs only when diagnosing a fault.
What the plugins do not collect
Kine and Lapse contain no networking code. Both are compiled with their framework’s web and networking components disabled, so neither binary is capable of opening a network connection. There is no usage tracking, no online licence check and no crash reporting in either of them. Your projects, presets and audio remain on your own machine and are never transmitted to us.
Neither plugin uses machine learning, and nothing you make with them is used to train anything. That holds for the material people send us as well: a track sent in for the radio picks is listened to and, with permission, linked. It is not training data.
Who else processes it
Resend sends our email and holds the mailing list. Google, through Firebase Authentication, holds accounts and passwords. Cloudflare runs the bot check and stores the installers. Vercel hosts the site and serves every page. PostHog counts page views.
Each of these is a company we pay to carry out a specific function on our behalf. Each publishes a data processing agreement that forms part of the terms on which we use it, and which we are bound by. Those agreements commit the provider to processing data only on our documented instructions, to holding it securely, and to not using it for its own purposes. They are the provider’s standard terms rather than terms we negotiated individually, and they take effect when an account is opened.
We rely on those commitments, but we cannot inspect these companies’ systems and we do not control how they operate them. So what is set out above is the contractual position between us and them, not a guarantee of their conduct. Each also acts as a controller in its own right for its own business purposes, which is separate from the work it does for us and is covered by its own privacy notice. Should we become aware that a provider is not meeting the terms it is bound by, we will move the service or tell you.
Where it goes
We are outside the European Economic Area, and so are most of the companies above. Where data is transferred out of the EEA or the UK, it is covered by the European Commission’s standard contractual clauses, together with the UK addendum where the UK GDPR applies. Ask us and we will tell you which one covers a given service. The analytics counts are the exception and are processed in the European Union, in Germany.
How long it is kept
Mailing list. Until you unsubscribe or ask us to remove you.
Accounts. Until you delete it, or after three years of not signing in.
Messages you send us. Kept in our inbox while the conversation is useful, then deleted within two years.
Server logs. Thirty days at our hosts, then discarded.
Page views. Aggregate counts, kept while the project exists. Closing the account erases them within thirty days.
What you can ask for
You have the right to obtain a copy of the personal data we hold about you, to have inaccurate data corrected, to have it erased, to have our use of it restricted, to object to our reliance on a legitimate interest, and to receive it in a portable form so that you can take it elsewhere. Where we rely on your consent, you may withdraw it at any time, although withdrawal does not affect anything done on the basis of that consent beforehand.
Two of these you can exercise without contacting us at all. The unsubscribe link in every email takes effect immediately, and the delete button on the account page removes your account and your address at once. For anything else, use the data request form or write to us. We will respond within one month, as the legislation requires, and usually sooner. We do not charge for this.
We carry out no automated decision making and no profiling. Nothing on this site evaluates you or reaches a decision about you without a person involved.
If you are not happy with how we handled it
We would ask you to raise it with us first, so that we have the opportunity to put it right. You are also entitled to lodge a complaint with a data protection supervisory authority. In the EEA that is the authority for the country where you live or work, or where you consider the problem arose, and the European Data Protection Board publishes the list of them. In the UK it is the Information Commissioner’s Office. Exercising that right costs you nothing and does not require our agreement.
Cookies and what is stored in your browser
This site sets no cookies of its own, and uses nothing that tracks you across other websites.
Three things do store information on your device. Cloudflare Turnstile may set a cookie while it verifies a form submission. Signing in stores a session, which is what keeps you signed in between visits and which is removed when you sign out. Alongside it we store two small values: a flag recording that somebody is signed in, and the name on the account. They are what let the header show your initial and a menu without loading the entire sign-in library on every page, and both are removed when you sign out.
Each of the three is strictly necessary to provide a function you have asked for, so none requires your consent, and there is accordingly nothing for a cookie banner to ask you.
Counting page views
We count page views using PostHog, configured in its cookieless mode and hosted in its European region. It sets no cookie, stores nothing on your device, does not track you across other sites and does not build a profile of you. What we see is how many people read a page, not who they were. Our basis is our legitimate interest in understanding which pages are worth maintaining. If your browser sends a Do Not Track or Global Privacy Control signal, we do not count your visit at all.
Counting visits without storing anything on your device works by deriving a temporary value from your IP address and browser. That value changes regularly, is never written to your machine, and is not used to recognise you on a later visit. It is what lets us tell one visit from another on a given day without knowing who either of you is.
Alongside page views we count four actions: a completed download, a newsletter subscription, a message sent through the contact form, and a walkthrough video being played. A download also records which plugin and which operating system, because that is what tells us which builds are worth maintaining. None of these records anything about you. Not your address, not your name, not the contents of a message, and nothing that would let us recognise you on a later visit.
Children
This site is not directed at children and we do not knowingly collect personal data from anyone under the age of sixteen. If you believe a child has provided us with their data, write to us and we will erase it.
Changes
We may update this policy. Where it changes in substance, the date at the top of the page changes with it, and that version replaces this one. See also the terms and the licence.