Last updated: 11 October 2026
This Privacy Policy describes the processing of personal data in connection with hitshaper’s website and services. Personal data means information relating to an identified or identifiable individual. The applicable framework includes Swiss data protection law and, where its territorial scope is met, the EU General Data Protection Regulation (GDPR).
1. Who is responsible for your data?
The controller responsible for the processing described in this policy is:
Please send privacy enquiries and requests concerning your personal data to support@hitshaper.com. Include sufficient information for us to identify the relevant account or transaction, but do not send your password or full payment card details.
2. Website access, hosting and security
Our website, database and email services are hosted by Infomaniak in Switzerland. When you access the website, technical information such as your IP address, requested pages, request time and browser information is processed to deliver the service and investigate technical problems or misuse. Security checks may use IP addresses to identify and block suspicious requests.
We also use Sentry for application error reporting and performance diagnostics. Reports can contain technical request information and diagnostic context. For signed-in users, our integration associates the account email address with diagnostic events so that problems affecting an account can be investigated.
3. Accounts, downloads and support
When you register or request a plugin download, we process your first name, last name, email address, account credentials and newsletter preference. Your account may also contain a country, professional role, registration source, confirmation status and information about products and licenses associated with you.
We use this information to create and administer your account, confirm your email address, provide downloads, recover account access and respond to your requests. Information required by a registration or purchase form is needed to provide the corresponding service. Newsletter subscription is optional.
If you contact us, we process your contact details, correspondence and information you provide about your operating system, DAW, plugin or transaction. Please avoid including unrelated personal data in support messages, attachments or screenshots.
4. Purchases, payments and donations
Payments are handled through Stripe or PayPal, depending on the checkout used. These providers process payment credentials and other information required to authorise the transaction, prevent fraud and meet their own obligations. Their privacy notices apply to processing they perform in their own capacity.
We process the order and payment information needed to fulfil a purchase or donation, associate a license with your account, handle enquiries and maintain transaction records. This may include contact details, product, amount, currency, transaction reference and payment status. Our checkout does not store full payment card numbers or card security codes in the hitshaper account database.
5. Licenses and plugin activation
For products requiring activation, we process account and license information to check your entitlement and issue an authorisation. Activation records can include a machine identifier, IP address, operating-system information and timestamps. These records help us manage activations, recognise previously authorised machines and investigate licensing problems or misuse.
Offline authorisation also uses a machine identifier supplied through your account. A machine identifier is used for licensing; it is not a request for access to the files on your computer.
6. Newsletters and product communications
We use CleverReach to manage mailing lists and deliver newsletters. Depending on your relationship with us, records sent to CleverReach can include your email address, name, country, professional role, registration date, subscription status and product-related tags. Our integration can synchronise account records with an inactive subscription status even when promotional email has not been requested.
The newsletter preference determines whether you request news and offers. You can withdraw that preference through your account, use the unsubscribe link in a newsletter or contact us. Account confirmations, password recovery, download delivery and communications necessary to administer your purchase or license are separate from promotional newsletters.
7. Cookies and preferences
The website uses cookies for session management, account functions and interface preferences. For example, cookies can remember that you have acknowledged the cookie notice or already seen the newsletter offer. The acknowledgement cookie is set for one year; the newsletter-offer cookie may persist for 30 days or up to one year, depending on the interaction.
You can use browser settings to block or delete cookies. Restricting cookies may affect sign-in and other account functions. Deleting cookies does not delete an account or records already held by us or a service provider.
8. Embedded content and external services
Some pages contain YouTube videos. Loading an embedded player establishes a connection to Google/YouTube and can disclose technical information about your visit, even before you play a video. If you are signed in to a Google account, Google may associate the interaction with that account according to its settings and policies.
Registration forms use Google reCAPTCHA to help distinguish genuine requests from automated abuse. The service can process connection, browser, device and interaction information when the form is loaded or used. The website also requests web fonts from Google Fonts, which involves sending technical connection information to Google.
Links to Audiolounge, social networks and other external websites take you to services operated by their respective providers. Purchases or support requests made directly with Audiolounge are subject to its own privacy information. Information you choose to submit there is handled by that provider.
9. Purposes and legal grounds
We process data to provide requested services, administer accounts and licenses, handle payments and support, protect the service against misuse, diagnose faults and communicate with customers. Where the GDPR applies, processing necessary to provide a requested service is based on Article 6(1)(b), statutory record-keeping on Article 6(1)(c), and proportionate security and service-administration interests on Article 6(1)(f). Where processing requires consent, Article 6(1)(a) applies. A description in this policy does not itself constitute consent.
10. Recipients and international processing
Recipients include the hosting and email provider, payment providers, mailing-list provider, diagnostic service and Google services described above, to the extent involved in the relevant activity. Data may also need to be disclosed to professional advisers or competent authorities in connection with legal obligations or claims.
Swiss hosting does not mean that all processing takes place in Switzerland. External providers may process information in the European Economic Area, the United States or other countries in which they or their service providers operate. The applicable provider arrangements and transfer safeguards must be assessed for each service; the location of our hosting alone does not establish those safeguards.
Further information about these providers is available in their privacy notices: Infomaniak, Stripe, PayPal, CleverReach, Sentry and Google.
11. Retention and protection
Retention depends on the purpose of the record. Account and license records support access to purchased products and authorisation; support correspondence provides a history of an enquiry; security and diagnostic records assist investigation; transaction documents may be subject to statutory retention requirements. We do not specify a single deletion period for all of these categories.
A deletion request is assessed against continuing service needs and applicable retention duties. Where records must be retained, deletion may be limited accordingly. Removing an account can affect access to downloads and licenses; we will address these consequences when handling your request.
Passwords are stored using one-way hashing. Access controls and encrypted transport help protect personal data, but no online service can guarantee absolute security. Keep your credentials confidential and contact us if you suspect unauthorised access to your account.
12. Your rights and how to exercise them
Subject to the applicable law and its conditions, you may request access to your personal data, correction of inaccurate information, deletion, restriction of processing or delivery of data in a portable format. You may also object to certain processing, including direct marketing, and withdraw consent with effect for the future.
Contact us using the details in section 1. We may need reasonable additional information to verify your identity before disclosing or changing account data. We will respond within the applicable statutory time limits and explain any restrictions on a request. You can also raise a concern with the Swiss Federal Data Protection and Information Commissioner or, where applicable, the supervisory authority in your country of residence, workplace or the place of the alleged infringement.
13. Changes to this policy
We may revise this policy to reflect changes to our services, providers or applicable requirements. The date above identifies the current version. Please also consult the End-User License Agreement for the contractual terms governing use of our software.