Privacy policy

This policy explains which personal data Titanscore Audio collects through titanscoreaudio.com and the Ostinato and Piano plugins, why, and for how long. It follows the Swiss Federal Act on Data Protection (FADP) and, for visitors and customers in the European Union and the EEA, the General Data Protection Regulation (GDPR).

This site uses no analytics and no social widgets. The Meta Pixel, which measures our advertising, runs only if you agree to it, and purchases are reported to Meta only as described under Advertising measurement below. We do not build profiles about you ourselves, your data is never sold, and no decisions about you are made automatically.

TUNES OF FANTASY GmbH, Häberlinstrasse 65, 8500 Frauenfeld, Switzerland, trading as Titanscore Audio. Write to us through the contact form for anything concerning your data.

Hosting: the site runs on Cloudflare. To deliver the pages and protect them from attacks, your IP address and the technical details of each request (time, page, browser, operating system) are processed. We do not keep these server logs ourselves.

Fonts: the typefaces are served from this website itself. No outside font service is contacted.

Videos: the trailers and walkthroughs are hosted on YouTube and embedded in privacy-enhanced mode. Nothing is loaded from YouTube until you press play; from then on, YouTube (Google) receives your IP address and the technical details of your browser, and may set cookies of its own.

Cookies and storage: the site itself sets a single cookie, and only when you sign in to your account. It keeps you signed in for thirty days and is removed when you sign out. Your cart and your privacy settings are kept in your browser’s local storage, on your device only. If you agree to marketing, the Meta Pixel sets cookies of its own (_fbp, and _fbc when you arrive from one of our ads), which last up to ninety days.

Legal basis in the EU: our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR).

If you agree under Privacy settings (“Accept all”, or Marketing switched on), the site loads the Meta Pixel from Meta Platforms Ireland Ltd, Dublin, Ireland. It tells Meta when you view a page or an instrument, add an instrument to the cart, start the checkout and complete a purchase, with the amount and the currency, together with your IP address, the technical details of your browser and Meta’s cookies. With this we can see which of our ads lead to a sale. Meta can link these events to your Facebook or Instagram account and use them for its own purposes under Meta’s privacy policy.

Purchases: when you buy, our server also reports the purchase to Meta through Meta’s Conversions API, so that it is counted even when a browser blocks the pixel: the order number, the amount, the currency and the instruments, your email address and your country in hashed form (a scrambled code that Meta matches against its own accounts), the technical details of your browser and, if present, Meta’s cookie IDs. These details travel with your order through Paddle. We report a purchase if you agreed to marketing. If your billing address is in the USA or Australia, where the law does not require consent beforehand, we also report it when you have made no choice, but never if you chose “Only necessary” or switched Marketing off. For every other country, a purchase is reported only with your consent.

We and Meta are jointly responsible for collecting this data and passing it to Meta; for everything Meta does with it afterwards, Meta alone is responsible. Without your consent, nothing is loaded from Meta in your browser. You can withdraw or object at any time under “Privacy settings” at the bottom of every page; the Meta cookies on this site are then removed, and later purchases are no longer reported.

Legal basis in the EU, the United Kingdom and Switzerland: your consent (Art. 6(1)(a) GDPR).

When you write to us, we receive your name, your email address, the topic and your message, and keep them only as long as the conversation needs it. To keep out spam, the form is protected by Google reCAPTCHA, which is loaded only on the contact page and may set cookies of its own, and your IP address is held for one hour to limit the number of messages.

Legal basis in the EU: answering your request and, where it concerns a purchase, taking steps towards a contract (Art. 6(1)(b) and (f) GDPR).

An address left for the newsletter is used for that newsletter and nothing else, and kept until you leave the list. Every mail carries a way to leave, and asking is enough too. Legal basis in the EU: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.

Payments are handled by Paddle.com Market Ltd, London, United Kingdom, as merchant of record. Paddle processes your payment and billing data as its own controller under Paddle's privacy policy; we never see your card or bank details.

From Paddle we receive your name, your email address, the order number, the products and the amount. With these we issue your licence keys and send them to you. We keep them, together with your keys and the machines they are activated on, for as long as your licence exists, because your licence depends on them. Order records are kept for as long as Swiss accounting law requires.

Your account is protected by the password you choose at checkout or when you create a free account; we store it only as a salted hash, from which the password cannot be recovered. If you forget it, a sign-in link goes to your email address; it is valid for thirty minutes and can be used once. A session lasts thirty days.

If you take a free instrument such as Chords, you give your name, your email address and a password at checkout; there is no payment and Paddle is not involved. We first send you a link to verify your email address; once you click it, we issue the free licence key, which is then in your account. An unverified request is deleted after three days. We keep the account, your keys and the machines they are activated on for as long as your licence exists, or until you ask us to delete the account. The password is stored only as a salted hash.

Your email address is also added to our newsletter when you take a free instrument; the checkout page says so before you confirm. Legal basis in the EU: our legitimate interest in telling you about updates and new instruments (Art. 6(1)(f) GDPR). Every newsletter mail carries a way to leave, and asking is enough too.

Legal basis in the EU: performing the contract with you (Art. 6(1)(b) GDPR) and legal retention duties (Art. 6(1)(c) GDPR).

Activation: when you activate, the plugin sends the email and licence key you entered, the product name, the plugin version, the operating system, an identifier of the machine and the name of your computer as set in your system settings, which may include your name, to our licence server. This is used only to check the licence, to count your machines and to show them to you by name in your account, so you know which one to release. A machine entry is deleted when you release it.

Licence check: when the computer is online, the plugin occasionally sends the licence key, the product name and the machine identifier to confirm the licence is still valid.

Update check: each time the plugin is loaded, it reads a small file from titanscoreaudio.com that says which version is current. It sends nothing but the product name and version.

Activations, releases and sign-ins are logged with the licence they belong to, so that we can help with support questions and notice misuse. Nothing else leaves your computer: the plugins do not send your music, your MIDI or your projects anywhere.

Legal basis in the EU: performing the contract with you and our legitimate interest in protecting the licence against misuse (Art. 6(1)(b) and (f) GDPR).

We use these providers, each only for the purpose named above:

• Cloudflare, Inc., USA: hosting, security, licence server and database
• Google LLC, USA, and Google Ireland Ltd: spam protection on the contact form, and the trailer and walkthrough videos on YouTube
• Resend, Inc., USA: sending our emails, such as sign-in links and licence keys
• Paddle.com Market Ltd, United Kingdom: payment and billing
• Meta Platforms Ireland Ltd, Ireland, and Meta Platforms, Inc., USA: measuring our advertising, only with your consent

Your data may therefore be processed in the United Kingdom and the USA. Switzerland and the EU recognise the United Kingdom as providing adequate protection. Transfers to the USA rely on the Swiss-US and EU-US Data Privacy Framework where the provider is certified, and otherwise on the standard contractual clauses approved for this purpose.

You can ask at any time which data we hold about you and receive a copy, have it corrected or deleted, object to its use or have it restricted, receive it in a common format, and withdraw any consent you have given. Write to us and it is done within thirty days, unless the law requires us to keep something.

If you believe we handle your data wrongly, you can complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC) in Bern or, if you live in the EU or EEA, to the data protection authority in your country.

If this policy changes, the new version appears on this page with a new date.