Privacy Policy
What we collect, why we collect it, and what you can do about it.
Last updated: 22 July 2026
Who is responsible
Sinuslabs OÜ, Sepapaja tn 6, 11415 Tallinn, Estonia, is the controller for the personal data described here. You can reach us at hello@sinuslabs.io for anything on this page, including requests to see or delete your data.
TO CONFIRM: Estonian commercial register code, VAT ID and managing director — required for the imprint, and worth naming here too.
Newsletter and free downloads
When you get a free plugin such as Bandbreite, we ask three optional questions (which DAW you use, what kind of music you make, how you heard about us) and then your email address. The questions can each be skipped; the download is never withheld for skipping them.
We store your email address, your answers, and which page or block the signup came from. We use this to send you the download, to send the newsletter, and to understand who our users are so we can build and market to them better — for example knowing which DAWs to prioritise. The download email itself is sent because you asked for it; the newsletter is sent on the basis of your consent, given when you submitted the form (Art. 6(1)(a) GDPR).
You can withdraw that consent at any time using the unsubscribe link in any newsletter, or by emailing us. Withdrawing does not affect anything sent beforehand, and you keep any plugin you already downloaded.
Purchases and licenses
Paid orders are handled by our payment provider, who receives your email address and payment details. We never see or store your card data. We store your email address, license key, product and purchase date so we can deliver your license, let you look it up again later, and meet our bookkeeping obligations. This is necessary to perform our contract with you (Art. 6(1)(b) GDPR) and, for the accounting part, a legal obligation (Art. 6(1)(c) GDPR).
Analytics
We use PostHog on its EU servers to measure how the site is used. Until you make a choice in the cookie banner, PostHog runs without writing any cookie or identifier to your device — it counts anonymous page views only. If you accept, we store an identifier so we can recognise a returning visitor and see how a journey unfolds. If you decline, we collect nothing. Your choice is remembered in your browser and you can change it at any time.
Once you give us your email address, we link it to your analytics profile so that signups, downloads and purchases from the same person are counted once rather than as strangers.
Accounts and license lookups
If you create an account or ask us to email your license key, we process your email address to answer that request and, for accounts, to keep you signed in.
Abuse prevention
Our forms send email to whatever address is entered, so we count recent submissions per address and per IP to stop the site being used to spam strangers. These counters live in memory only, are not written to a database, and disappear when the server restarts. Our legitimate interest in not being abused is the basis for this (Art. 6(1)(f) GDPR).
Who else sees your data
We use a small number of providers, each of which only processes data on our instructions:
- Brevo — newsletter and transactional email. Stores your address and the attributes described above.
- PostHog (EU Cloud) — product analytics, as described above.
- Polar — checkout and payment processing.
- Supabase — database for licenses, and hosting for audio demos.
- GitHub — hosts the plugin installer files. GitHub sees your IP address when you download.
TO CONFIRM: our hosting provider, the Supabase region, and the Polar contracting entity — each needs naming, and any provider outside the EU needs its transfer safeguard (usually Standard Contractual Clauses) stated below.
Data outside the EU
TO CONFIRM: whether any of the above transfers data outside the EU/EEA and on what basis.
How long we keep it
Newsletter data is kept until you unsubscribe or ask us to delete it. Purchase and license records are kept for as long as the license is valid and for as long as tax law requires us to keep the invoice. Analytics data is kept in aggregated form.
TO CONFIRM: exact retention periods, once your accountant confirms them.
Your rights
Under the GDPR you can ask us for a copy of your data, ask us to correct or delete it, ask us to restrict how we use it, object to our use of it, and ask for it in a portable format. Where we rely on consent, you can withdraw it at any time. Email hello@sinuslabs.io and we will answer within one month.
If you think we have handled your data badly, you can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee) or to the supervisory authority where you live.
Changes
We will update this page when what we do changes, and the date at the top will tell you when that last happened.