Privacy Policy
Ambiova — Ambient Soundscapes Last updated: [LAST UPDATED DATE]
This Privacy Policy explains what personal data Ambiova collects, why, who we share it with, and what rights you have. We built Ambiova to need as little data as possible: there are no user accounts, no advertising, and no cookie banner, because we don't use tracking cookies.
1. Who is responsible
The service is operated by:
[COMPANY LEGAL NAME] [LEGAL FORM / REGISTRATION NO.] [REGISTERED ADDRESS] Email: [CONTACT EMAIL] Website: [WEBSITE URL]
In this policy, "Ambiova", "we", "us" and "our" mean [COMPANY LEGAL NAME]. For the data we process ourselves, we are the data controller under the EU General Data Protection Regulation (GDPR) and the UK GDPR.
Payments are handled by Creem, which acts as the merchant of record. Creem is a separate, independent controller of your payment and billing data. See section 3.2.
2. Summary
| Question | Answer |
|---|---|
| Do I need an account? | No. |
| Do you use tracking or advertising cookies? | No. |
| Is my listening activity, mix, or audio sent to your servers? | No. Your mixes, custom presets and listening time stay in your browser. |
| Who processes my payment? | Creem (merchant of record). We never see your card or bank details. |
| What do you see about paying customers? | Name, email address, license key and subscription details, via Creem's dashboard. |
| Do you sell personal data? | No. |
3. What data we process
3.1 Data stored on your device
Ambiova is a local-first web app. The following is stored only in your browser (using localStorage, and a service worker cache on paid plans). We do not receive it, except where stated in section 3.3:
- Settings and mix state: your last mix snapshot, volume and channel levels, theme (light/dark), and other player preferences.
- Custom presets you create. If you use the export feature, the file is saved on your device and is not sent to us.
- Free-tier listening clock: a counter of how many minutes you have played today (by your device's local date), used to apply the daily free allowance.
- Device identifier: a random ID generated on your device (used as the "instance name" when you activate a license). It is not derived from your hardware.
- License information (paid plans only): your license key, the activation ID returned by Creem, plan name, and when it was last verified.
- Offline cache (paid plans only): audio samples and app files cached so Ambiova can work offline.
This storage is strictly necessary to provide the features you ask for. You can remove it at any time by clearing your browser's site data, or, for licenses, by using Settings → Deactivate this device.
3.2 Purchases through Creem
When you buy Ambiova Pro or Commercial, the checkout, payment, tax calculation and invoicing are handled by Creem (Armitage Labs OÜ, Estonia) as merchant of record. Creem collects your name, email address, billing address and payment details, and is the controller for that processing. Please read Creem's Privacy Notice.
What we receive and can see when we log in to the Creem dashboard:
- your name and email address
- your license key(s) and activation counts
- your plan and subscription status (active, cancelled, past due, and so on) and billing period dates
- order and invoice references
We do not see your full card number, bank details, or your complete billing information. We use this data only to deliver your license, provide support, manage subscriptions, prevent fraud and misuse of license keys, and meet legal obligations. We do not maintain a separate customer database, and we do not use your email address for marketing.
Creem also acts as a processor on our behalf for certain functions under its Data Processing Agreement, which forms part of Creem's merchant terms with us.
3.3 License activation and verification (paid plans only)
Free use of Ambiova does not contact our license servers. If you activate a paid license, the app sends requests to our own API (hosted on Cloudflare Pages Functions), which relays them to Creem's license service. These requests contain:
- your license key
- your device's random instance name and the activation (instance) ID
- standard technical request data, such as your IP address, browser user-agent and timestamp, which necessarily reach our hosting provider when any request is made
The app re-verifies your license when it starts and about once every 24 hours while online, so that access ends when a subscription ends.
To enforce subscriptions, we also keep a small record on a Cloudflare KV (key-value) store. It is written only when Creem notifies us of a purchase or subscription change (via a signed webhook) and contains:
- your license key
- subscription status and current period end date
- Creem's product, customer and subscription IDs
- the timestamp of the last event
This record does not contain your name, email address, or payment details. Its lookup keys are stored as one-way hashes. It is used only to decide whether a license may be activated or validated, and to release device activations when a subscription ends. We do not write your listening data, presets, or mix settings to it.
3.4 Hosting and security logs
Ambiova is hosted on Cloudflare. To deliver the site, Cloudflare processes technical data such as your IP address, request time, requested URL, and browser and device information. Cloudflare also uses this data for security, such as protection against abuse and attacks. Our functions are designed not to log request bodies, license keys, or signatures.
3.5 Privacy-friendly analytics
We use Cloudflare Web Analytics to understand aggregate usage, such as page views, referrers, countries, and page performance, so we can keep the site fast and improve it. According to Cloudflare, this service does not use cookies or local storage, does not fingerprint visitors, and does not track people across websites. We cannot identify individual visitors from it, and we do not combine it with license or purchase data.
3.6 Fonts
Ambiova uses the typefaces Playfair Display and Inter, which we host ourselves. Your browser loads the font files from our own site, so no request is made to Google, and your IP address and browser details are not shared with any font provider for this purpose.
3.7 Support and contact
If you email us, we process your email address, the content of your message, and anything you choose to share, so that we can respond. If you contact us about a purchase, we may match your request against the Creem dashboard.
4. What we do not do
- We do not create user profiles or accounts.
- We do not run advertising, and we do not use advertising or cross-site tracking technologies.
- We do not collect your microphone, location, contacts or any other device sensor data.
- We do not receive the audio you generate, your mix, your presets, or your listening history.
- We do not sell your personal data or share it for advertising.
5. Legal bases and recipients
| Purpose | Data | Legal basis (GDPR) | Recipients |
|---|---|---|---|
| Deliver the app and keep it secure | IP address, technical request data | Legitimate interests (Art. 6(1)(f)) in running and securing the service | Cloudflare |
| Store settings, presets and the free listening clock on your device | Local device data | Strictly necessary to provide the service you request; no consent needed | None (stays on your device) |
| Sell, bill and invoice paid plans | Name, email, billing and payment data | Contract (Art. 6(1)(b)); legal obligations (Art. 6(1)(c)), handled by Creem | Creem |
| Issue and verify license keys; end access when a subscription ends | License key, instance ID, subscription status, IP address | Contract (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f)) in preventing key misuse | Cloudflare, Creem |
| Customer support | Name, email, message, license and subscription details | Contract (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f)) | Creem (dashboard), our email provider |
| Aggregate analytics | Aggregate page-view and performance data | Legitimate interests (Art. 6(1)(f)) in improving the service | Cloudflare |
| Legal claims and compliance | As needed | Legal obligations; legitimate interests | Advisers, authorities where required |
Our service providers:
- Creem (Armitage Labs OÜ, Tallinn, Estonia): merchant of record and payment processing. Privacy Notice · Data Processing Agreement
- Cloudflare, Inc.: hosting, Pages Functions, KV storage, security and Web Analytics. Privacy Policy
We may also disclose data where required by law, or to protect our rights, for example in the event of fraud or a legal dispute.
6. International transfers
Cloudflare is headquartered in the United States and may process data there and in other countries. Creem is based in Estonia and uses its own sub-processors, including some outside the EU/EEA. Where personal data leaves the EU/EEA or the UK, transfers rely on an adequacy decision (such as the EU–US Data Privacy Framework, where the recipient is certified), or on the European Commission's Standard Contractual Clauses. You can contact us for more information about the safeguards.
7. How long we keep data
| Data | Retention |
|---|---|
| Settings, presets, listening clock, license lease (on your device) | Until you clear your browser data or deactivate the device. You control this. |
| Subscription record for license enforcement (Cloudflare KV) | While the license is active and afterwards for [RETENTION PERIOD], so that a lapsed key cannot be reactivated. Then deleted or anonymised, unless the law requires longer. |
| Name, email, order and license data in the Creem dashboard | As long as needed for the customer relationship, plus statutory accounting and tax retention periods applied by Creem. See Creem's Privacy Notice. |
| Support emails | Up to [RETENTION PERIOD] after the matter is closed, unless needed for a legal claim. |
| Hosting and security logs | According to Cloudflare's retention practices. |
| Aggregate analytics | As aggregated, non-identifying statistics. |
8. Cookies and similar technologies
Ambiova does not use cookies for tracking, analytics or advertising, so there is no cookie banner. We use your browser's local storage (and, on paid plans, a service worker cache) only for functions you request: remembering your mix, presets, theme, free-tier allowance and license. Cloudflare Web Analytics runs without cookies or local storage.
Note that Creem's checkout is a separate website with its own cookie practices; see Creem's Privacy Notice.
9. Your rights
If GDPR or UK GDPR applies to you, you have the right to:
- access the personal data we hold about you and get a copy
- rectification of inaccurate data
- erasure of your data, where the conditions in the law are met
- restriction of processing
- data portability
- object to processing based on legitimate interests
- withdraw consent where processing is based on consent (we do not currently rely on consent)
- lodge a complaint with a supervisory authority, such as the authority in your country of residence or workplace [SUPERVISORY AUTHORITY, if known]
To exercise these rights, email [CONTACT EMAIL]. We may need to verify your identity, for example by checking that you control the purchase email address. Because we cannot see anything you keep on your device, you can delete that data yourself by clearing your browser's site data. For billing data held by Creem, you can also contact Creem at support@creem.io.
US and other regions: we do not sell or share personal information for cross-context behavioral advertising. If your local law gives you additional rights, contact us and we will respond as required.
10. Security
We use HTTPS everywhere, keep API keys and secrets on the server only (never in the app code), verify Creem webhooks with signatures, and store our subscription lookup keys as hashes. No system is perfectly secure, so we cannot guarantee absolute security. If a data breach affects you, we will notify you and the authorities as required by law.
11. Children
Ambiova is not directed at children under 16, and we do not knowingly collect personal data from them. Paid plans may only be purchased by people who are of legal age in their country. If you believe a child has given us personal data, contact us and we will delete it.
12. Changes to this policy
We may update this policy when our practices, providers or the law change. The "Last updated" date above shows the current version. If a change is significant, we will highlight it in the app or on the website.
13. Contact
Questions or requests about privacy: [CONTACT EMAIL] [COMPANY LEGAL NAME], [REGISTERED ADDRESS]
See also our Terms of Service.