Privacy policy
Last updated: 23 July 2026
This policy explains what personal data BNO Audio collects, why we collect it, who we share it with, and what rights you have. We keep it short and specific, because a privacy policy that nobody reads protects nobody.
1. Who is responsible for your data
BNO Audio VOF is the data controller.
Address: Roostenlaan 274, 5644 BS Eindhoven, Netherlands
Email: support@bno.audio
Chamber of Commerce (KvK): 42058243
VAT: NL869515986B01
We are not required to appoint a Data Protection Officer. For any privacy question, email support@bno.audio. We aim to respond within 48 hours.
2. What we collect and why
When you buy something
| Data | Why | Legal basis |
|---|---|---|
| Name, email address, billing address, country | To process your order, issue an invoice, and comply with tax law | Performance of a contract, and legal obligation for tax records |
| Payment method details | Handled entirely by our payment providers. We receive only a confirmation and the last digits and card brand, never your full card number | Performance of a contract |
| Order contents and history | To deliver your licenses and handle support and refunds | Performance of a contract |
When you activate a plugin
| Data | Why | Legal basis |
|---|---|---|
| Email address | To link the license to you | Performance of a contract |
| License key | To validate your purchase | Performance of a contract |
| Machine fingerprint, device name, operating system, plugin version | To enforce the activation limit, to let you see and manage your active devices, and to prevent license abuse | Performance of a contract, and our legitimate interest in preventing piracy |
A machine fingerprint is a value derived from characteristics of your computer. It is not your name, but it can identify a device, so we treat it as personal data.
When you use the account portal or BNO Manager
| Data | Why | Legal basis |
|---|---|---|
| Email address and password (stored hashed by our licensing provider) | To authenticate you | Performance of a contract |
| Your licenses and active device list | To let you manage activations | Performance of a contract |
| Basic technical data such as IP address and app version | Security, rate limiting, and abuse prevention | Legitimate interest |
When you visit our store
| Data | Why | Legal basis |
|---|---|---|
| Strictly necessary cookies and session data | To keep your cart and your session working | Legitimate interest, no consent required |
| Analytics data collected by Shopify | To understand how the store is used | Consent, collected through our cookie banner |
| Session activity recorded by MIDA: pages viewed, clicks, scrolling, and session context such as device, browser, and country | To see where the store is confusing or broken, through anonymous session replays and heatmaps | Consent, collected through our cookie banner |
| Advertising events sent to Meta: pages and products viewed, and purchases completed, together with the identifiers Meta uses to recognise a browser | To measure how our advertising performs and to show relevant ads. Some of these events are also sent to Meta from Shopify's servers (Meta's Conversions API), following the same consent choice | Consent, collected through our cookie banner |
| If you click play on an embedded YouTube video: your IP address and the cookies YouTube sets | To play the video. Nothing is sent to YouTube or Google until you click play | Consent, by your choice to start the video |
See our Cookie Policy for details.
When you contact us
We keep the content of your emails and any information you choose to include, so that we can help you and refer back to earlier conversations. Legal basis: legitimate interest and performance of a contract.
3. What we do not do
- We do not sell your personal data.
- We do not load analytics or advertising trackers unless you consent to them in our cookie banner.
- We do not send marketing email unless you explicitly ask for it.
- Our plugins do not record, transmit, or analyse your audio. Audio processed by a BNO Audio plugin never leaves your computer.
- Our plugins do not report your project names, your DAW session contents, or your other installed software.
- Our account portal does not run analytics, advertising pixels, or session recording.
4. Who we share data with
We use a small number of service providers. Each of them processes data on our instructions, under a data processing agreement.
| Provider | What they do | Where |
|---|---|---|
| Shopify | Runs our online store, checkout, and payment processing (Shopify Payments, Shop Pay), and provides store analytics | Canada and United States |
| PayPal | Alternative payment method, if you choose it. PayPal acts as an independent controller for the payment itself, under its own privacy policy | United States and EU |
| Meta | Advertising measurement and targeting through the Meta pixel and the Conversions API, if you accept marketing cookies. Meta acts as an independent controller for its own use of this data, under its own privacy policy | Ireland and United States |
| MIDA | Session replays and heatmaps showing how the store is used, if you accept analytics cookies | [VERIFY: MIDA/BSS Commerce data location, see note below] |
| Cryptlex | License management and activation. Stores your email address, license keys, and the machine fingerprints of your activated devices. We use the EU region | European Union |
| Cloudflare | Hosts our backend API, our account portal, and our download infrastructure | Global network |
| Resend | Sends our transactional email: order confirmations, license keys, and password resets | United States |
If you click play on an embedded video, YouTube and Google also receive data, as their own controllers, under Google's privacy policy.
We may also disclose data where we are legally required to do so, for example to tax authorities or in response to a valid legal order.
Transfers outside the EEA. Some of these providers are established outside the European Economic Area or process data there. Where that happens, the transfer is based on an adequacy decision of the European Commission, or on Standard Contractual Clauses together with supplementary safeguards, as set out in each provider's data processing agreement.
5. How long we keep data
- Order and invoice data: 7 years, because Dutch tax law requires it.
- License and activation data: for as long as your license is active. If you request deletion of your account, we anonymise or delete the associated activation records, but you will lose access to your licenses.
- Support emails: up to 3 years after the last contact.
- Analytics data: according to Shopify's retention settings, and to MIDA's retention settings for session replays and heatmaps.
- Advertising data held by Meta: according to Meta's own retention policies.
6. Your rights
If you are in the EU or EEA, the GDPR gives you the right to:
- Access the personal data we hold about you.
- Rectify data that is inaccurate or incomplete. You can edit most of your details directly in the account portal.
- Erase your data ("right to be forgotten"), subject to our legal obligation to keep invoice records.
- Restrict or object to processing that is based on our legitimate interest.
- Data portability: receive your data in a structured, machine readable format.
- Withdraw consent at any time, where processing is based on consent. This does not affect the lawfulness of processing before withdrawal. For cookies and trackers, use the Cookie preferences link in the footer of any page.
To exercise any of these rights, email support@bno.audio. We will respond within one month. We do not charge for this.
If you are unhappy with how we handle your data, you can lodge a complaint with the Dutch data protection authority:
Autoriteit Persoonsgegevens
Postbus 93374, 2509 AJ Den Haag, Netherlands
autoriteitpersoonsgegevens.nl
If you live in another EU country, you can also complain to your local supervisory authority.
7. Security
- All traffic to our website, our account portal, and our API is encrypted with TLS.
- Passwords are stored hashed by our licensing provider. We never see them.
- Access to our admin systems is limited to the two partners of BNO Audio and protected by two factor authentication.
- We never see your full payment card details.
No system is perfectly secure. If we become aware of a data breach that is likely to result in a risk to your rights, we will notify the Autoriteit Persoonsgegevens and, where required, you directly.
8. Children
Our products are not directed at children under 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, contact us and we will delete it.
9. Changes to this policy
We may update this policy. The current version is always on this page, with the date it was last updated. For material changes we will notify you by email.
Contact
Questions about this policy, or about your data:
support@bno.audio
BNO Audio VOF
Roostenlaan 274
5644 BS Eindhoven
Netherlands