# Privacy

## Who is responsible
Radikaal Group Oy (Business ID 2392134-7), Kreetantie 7 A 2, 33950 Pirkkala, Finland is the controller of the personal data described here. Contact: [support@sacredaudioplugins.com](mailto:support@sacredaudioplugins.com).

## What we collect and why
- **Orders:** your name, e-mail address, billing country, what you bought and the licence key we issued. We need these to deliver your licence, send keys again on request, handle refunds, and keep accounting records required by law.
- **Payments:** Stripe collects your payment details and billing address. We receive the result of the payment, not your card number.
- **Your account:** your e-mail address, an optional name, your password (stored only as a salted PBKDF2 hash we can't reverse) or your Google account id if you sign in with Google, when you signed up and last signed in, the page you signed up from and the site that referred you, and which installers you downloaded. We need these to give you the downloads and your licence keys. You can delete your account any time on your account page.
- **News by e-mail:** only if you tick the box, and we keep when you agreed. Untick it in your account, or use the link in any newsletter, to stop.
- **Support e-mail:** what you write to us, to answer you.
- **The plug-ins:** they don't send personal data. If update checks are on, each plug-in downloads a small public file once a day; the request contains only the product name and version.
- **This website:** no tracking, no advertising, no analytics cookies. We count page views as anonymous daily totals per page, referring website and country, without cookies, IP addresses or any identifier. The only cookie is the sign-in cookie, set when you sign in and needed for your account to work. Cloudflare, our host, processes technical data such as IP addresses to deliver and protect the site.

## Who processes data for us
- Stripe Payments Europe, Ltd. (payments, receipts, invoices)
- Cloudflare, Inc. (hosting, database, e-mail delivery)
- Google (only if you choose Sign in with Google: Google tells us your e-mail address, name and account id)

Some processing may take place outside the EU/EEA, under the European Commission's standard contractual clauses or adequacy decisions.

## How long we keep it
Order records are kept for as long as you may need your licence and at least as long as Finnish accounting law requires (currently 6 years after the end of the financial year). Support e-mails are deleted when no longer needed. Accounts are kept until you delete them; deleting removes your account and download history, while order records stay for accounting.

## Your rights
You can ask for a copy of your data, ask us to correct or delete it (except records we must keep by law), object to processing, or ask for data portability. Write to [support@sacredaudioplugins.com](mailto:support@sacredaudioplugins.com). You can also complain to the Finnish Data Protection Ombudsman (tietosuoja.fi).