You can use this website without telling us anything about yourself. Where we do need personal data — the mailing list, or an account — we ask for it and tell you what it is for. Our plugins are different. They send us usage data unless you turn that off, the first screen you see says so, and the switch stays in settings for as long as you own the plugin.
This page explains what we collect, why we collect it, who else can reach it, how long we keep it, and the rights you hold over it. It is written to meet the General Data Protection Regulation (GDPR) and the data protection law that applies to us. The rights listed further down are open to anybody who asks, wherever you live.
We have put technical and organizational measures in place to protect the data we handle. Data sent over the internet can never be perfectly secure, so you are always free to reach us another way, by email, rather than through a form on this site.
This policy uses the terms the GDPR uses. So that it reads plainly for everyone, here is what they mean.
Personal data is any information relating to an identified or identifiable person. Somebody is identifiable if they can be picked out, directly or indirectly, by reference to something like a name, an identification number, location data, or an online identifier such as an IP address.
Data subject is the person whose personal data is being handled. On this site that is you.
Processing is anything done with personal data: collecting it, recording it, storing it, using it, sharing it, changing it, or erasing it.
Controller is whoever decides why and how personal data is handled. For this website, that is us.
Processor is a company that handles personal data on the controller's behalf and under its instructions, such as the service that delivers our email.
Consent is a freely given, specific, informed and unambiguous indication that you agree to your data being handled, given by a statement or a clear affirmative action.
Profiling is automated processing used to evaluate or predict things about a person, such as their behavior, interests or location. We do not do it, and the heading Automated decisions and profiling below says so plainly.
The controller for the purposes of the GDPR and other applicable data protection law is:
XPLTD AUDIO LLC
PO Box 24, Willow Springs, MO 65793
Email: support@xpltdaudio.com
Website: xpltdaudio.com
We have not appointed a Data Protection Officer, and we are not required to. Everything in this policy is handled by writing to the address above, and a person answers it.
Like nearly every website, ours runs on a web server that keeps a log of the requests it answers. Those entries can include the address of the browser making the request (an IP address), the browser type and version, the operating system, the page you came from, which pages you asked for, and the date and time.
We do not use any of that to work out who you are, and we do not combine it with anything else. It exists so the site can be served correctly, so we can tell whether something is broken, and so an attack on our systems can be investigated and reported. The lawful basis for keeping it is our legitimate interest in running a site that works and is not being abused.
If you enter your email address into the signup form, we use it to send you news about our products. That is the only thing it is for.
We confirm every address before adding it. You will receive a message asking you to click a link, and until you do, nothing is sent to you. This is deliberate: it means nobody can put your address on our list but you.
The lawful basis is your consent, given when you click that link. You can withdraw it at any time, and Your rights, further down, explains how.
Your address is held by Kit, a mailing list service acting as our processor. Kit is a United States company and its servers are in the United States, so if you are in the EU or the UK your address is transferred there. Kit sends the confirmation message and every later email, and provides the unsubscribe link in each one.
We intend to move the list onto a server we run ourselves. If we do, this section will say so before it happens, and your existing consent moves with your address rather than being asked for again.
We do not sell, rent, trade, or share your address with anybody for their own purposes.
If you email us, we keep what you send so we can answer you, and so we have a record of what was said if you write again. We do not sell it, and we do not give it to anyone for their own purposes. Some companies can reach it because they run the systems it sits on. Our mail is hosted on a server rented from InMotion. SMTP2GO delivers the mail our systems send you, and Brevo delivers it when SMTP2GO cannot. One person outside the company administers that server and can reach what is stored on it. That list is short on purpose, and this page names everybody on it.
The lawful basis is our legitimate interest in answering the people who contact us, and where your message is about buying or using our software, performing that agreement with you.
If you create an account, we ask for your email address, a handle, and, if you want one, a display name. The email address is how you sign in. The handle is public and you can change it. Your password is held by a sign-in server we run ourselves, on our own machines; we never see the password, and it is never stored in our own database.
When you sign in, we record the time, the browser, and the address it came from, and keep that record for 90 days so you can see where your account has been used. We keep a record of each email we sent you for 13 months. Email to you is delivered by SMTP2GO, and by Brevo when SMTP2GO cannot.
You can download a copy of the data we hold about you from your account. The link works for 24 hours and once.
You can disable your account. That signs you out everywhere, stops our email to you, and frees the computers your licenses were running on; your purchases and your licenses stay, and signing in again turns the account back on.
You can also ask us to delete your account. We wait 30 days, and we email you a link that cancels the deletion during those days. After that, your personal data is removed from our systems and your handle is released. One row survives: a record that an account existed and was deleted, with a key only you hold, so that a person who kept the key can prove the account was theirs. We also keep the record that you said yes or no to usage data, because losing a no would let us collect from someone who refused.
If you switch this site between its light and dark appearance, that choice is saved in a cookie named theme, set for xpltdaudio.com for one year, so this site and the account area remember it together. It holds one word, light or dark. Your browser sends it to our web server with each request, as browsers do with every cookie; this site does nothing with it, and the account area reads it to draw its pages in the theme you chose. If you chose a theme here before 4 October 2026, that choice was saved in your browser's local storage, and the site moves it into the cookie on your next visit. Clearing your browser's cookies removes it.
If you sign in to the account area, it sets a second cookie on xpltdaudio.com, named xa_signed_in. It holds the single character 1 and says nothing about who you are. This site reads it to decide whether to ask the account area for your name and account menu. Without that cookie, this site sends nothing to the account area.
This site sets no cookie other than the theme cookie, and reads none other than that one and the signed-in cookie, both described above. It runs no analytics, no advertising, no tracking pixels and no third-party scripts of any kind. We do not build a profile of you, we do not follow you across other websites, and we do not sell personal data to anyone.
Server log entries are kept only as long as they are useful for the purposes under What the server records when you visit, and are then deleted or overwritten.
Your address stays on the mailing list until you leave it. When you leave, we keep a record that you asked to leave and when. That record exists so you are not added again by accident, and it is the reason we do not simply erase everything, because erasing it is what would let a later import put you back.
Where the law requires us to keep something for a set period, such as records connected to tax, we keep it for that period and no longer.
You can exercise any of these by writing to support@xpltdaudio.com. You do not have to explain why, there is no charge, and we will not make it difficult.
a. Confirmation. To be told whether we hold personal data about you at all.
b. Access. To receive a copy of what we hold, along with what it is used for, who has received it, how long we intend to keep it, and where we got it if it did not come from you.
c. Rectification. To have anything inaccurate corrected, and anything incomplete completed.
d. Erasure. To have your data deleted, where it is no longer needed for the purpose it was collected for, where you withdraw consent, or where it has been handled unlawfully.
e. Restriction. To have us hold your data but stop using it, for instance while a dispute about its accuracy is resolved.
f. Portability. To receive the data you gave us in a structured, commonly used, machine-readable format, and to have it sent to another controller where that is technically possible.
g. Objection. To object to processing based on our legitimate interests. If you object to direct marketing, we stop, with no balancing of interests and no argument.
h. Withdrawing consent. To take back consent at any time. Every email we send carries a link that removes you in one click, and you can write to us instead if you prefer. Withdrawing does not undo anything that was lawful before you withdrew.
i. Complaint. To complain to your data protection supervisory authority. In the EU that is the authority in the country where you live or work; in the UK it is the Information Commissioner's Office.
We make no decisions about you by automated means, and we do not profile you.
Consent, for the mailing list. Performance of a contract, for anything necessary to sell you software and let you use it. Legal obligation, where a law such as tax law requires us to keep records. Legitimate interests, for keeping the website running and secure and for answering people who write to us, in each case only where your rights and freedoms do not override that interest.
Our plugins are not on sale yet. Test builds are in the hands of testers who accepted a Tester Agreement.
A plugin sends us one message each time it starts, unless you turned usage data off. The message carries the plugin version and format, your operating system and its version, the host application and its version, the sample rate, the buffer size, and whether the previous session ended cleanly. It never carries audio, your project, or file names. It is stored against your account, and it is deleted with your account.
Usage data is on by default. The first screen the plugin shows you says so and lets you turn it off; the same switch stays in the plugin's settings, and on the Privacy page of your account. When it is off, our server refuses the message and stores nothing.
If this policy changes, the date below changes with it. If a change affects how we handle personal data we already hold, we will tell the people it affects by email rather than expecting them to notice.
Last updated 22 October 2026.