Privacy Policy

Last updated: October 23, 2026

We collect as little personal data as possible. This policy explains which data we process when you visit this website, buy a plugin or use your account, why we do it and what rights you have.

1. Controller

The controller under the EU General Data Protection Regulation (GDPR) is

Email: privacy@cavatus.dev

2. Visiting this website

Hosting and server log files

This website runs on a server of STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany, within the EU. When you open a page, the server records the IP address, the date and time, the requested page, the referring page and the browser's user agent. We need this data to deliver the website and to keep it secure, for example to defend against attacks (Art. 6 (1) (f) GDPR). The log files are deleted after 14 days at the latest. STRATO processes this data on our behalf under a data processing agreement.

Fonts

The fonts are served from our own server. Your browser does not connect to Google or other font services.

Statistics without cookies

To learn how visitors find this website and where it could be better, we count page views and a few actions, such as adding a plugin to the cart, downloading a demo or signing up for the waitlist. We use Umami, an open-source software that runs on our own server at STRATO (stats.cavatus.dev); no data goes to other companies.

Umami sets no cookies and stores nothing on your device. It does not store your IP address: it derives the country, region and city from it and then discards it, and tells visits apart only by a value that changes every day and cannot be traced back to you. It records the page, the website you came from and the campaign parameters of the link (such as utm_source), as well as browser, operating system, device type, screen size and language. We have a legitimate interest in improving our website and reaching the right audience (Art. 6 (1) (f) GDPR). If your browser sends a Do Not Track signal, nothing is counted. We delete the data after 24 months.

We do not use advertising or tracking tools that follow you across websites, and we do not set cookies for statistics or advertising.

3. Prices and checkout with Paddle

Our reseller Paddle.com Market Limited, 30 Old Bailey, London EC4M 7AU, United Kingdom (“Paddle”) sells our products as merchant of record. To show prices in your currency and to open the checkout, our pages load a script from Paddle. Your browser sends your IP address to Paddle, which uses it to determine your country and the applicable taxes. If you buy something, Paddle processes your name, email address, country, payment details and order details as an independent controller. Details are in Paddle's privacy policy. The United Kingdom has an adequacy decision of the European Commission.

Your cart is kept in your browser's local storage, so it is still there when you come back. If you follow a link with a discount code, the code is kept there as well, for up to 30 days. At checkout, our server checks the code with Paddle and passes it to the checkout.

The legal basis is our legitimate interest in showing correct local prices and offering a secure checkout (Art. 6 (1) (f) GDPR) and, for a purchase, the performance of a contract (Art. 6 (1) (b) GDPR).

4. Your purchase, license and account

After a purchase, Paddle sends us the order details and your Paddle customer ID, and we retrieve your name and email address from Paddle. We use this data to create your license, send you your license key and download link, provide your account and help you with support requests (Art. 6 (1) (b) GDPR). It is stored in a database on our server at STRATO (see section 2), with daily backups on the same server. If you redeem a gift code instead, you enter your name and email address on our website, and we use them in the same way.

• License: Your license key contains your name and email address, so the plugin can show who it is licensed to.
• Account: You sign in with a link we send to your email address. While you are signed in, we set a strictly necessary session cookie, which expires after 30 days or when you sign out.
• Emails: We send transactional emails such as your license and sign-in links through Brevo GmbH, Köpenicker Str. 126, 10179 Berlin, Germany. Brevo processes your email address, your name and the content of these emails on our behalf under a data processing agreement and keeps delivery logs so that we can tell whether an email arrived. Brevo stores the data on servers in the EU; some of its service providers are located in the USA, for which Brevo relies on the EU-US Data Privacy Framework and the EU standard contractual clauses.

We keep this data as long as your account exists. Records that we must keep under commercial and tax law are stored for the statutory retention periods of up to ten years.

5. Launch waitlist and newsletter

If you sign up to be notified at launch, we store your email address, the page you signed up on, the wording you agreed to and the time of your sign-up. We then send you an email with a confirmation link (double opt-in). Only once you confirm do we write to you, based on your consent (Art. 6 (1) (a) GDPR): when Cavatus SSD and Cavatus LFO launch, and now and then about new plugins and offers. If you don't confirm, we delete your address after 30 days.

We send these emails through Brevo (see section 4), which keeps confirmed addresses in a contact list for us. In these emails, and only in these, Brevo records whether an email is opened and which links are clicked, so that we can see what interests our readers. You agree to this with your sign-up.

You can withdraw your consent at any time, with the unsubscribe link in every email or by writing to privacy@cavatus.dev. We keep the record of your sign-up and confirmation as proof of your consent for as long as we may need it, at most three years after you unsubscribe.

6. Our profiles on social media

We present our plugins on Instagram, Facebook, TikTok and YouTube. The links to these profiles on our website are plain links: your browser contacts a platform only when you click one.

When you visit one of our profiles, the platform processes your data under its own privacy policy, often also for advertising, and may transfer it to countries outside the EU such as the USA. We have no influence on this. We see what every profile owner sees: your public profile, the comments and messages you send us, and statistics that do not identify you. We use comments and messages to reply (Art. 6 (1) (f) GDPR, our legitimate interest in presenting our plugins and talking with people interested in them).

• Instagram and Facebook: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. For the statistics Meta provides about our profiles (Page Insights), Meta and we are joint controllers (Art. 26 GDPR). Meta takes primary responsibility under its Page Insights Controller Addendum, and you can exercise your rights directly with Meta. Privacy policy: Meta.
• TikTok: TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland. For the statistics about our profile, TikTok and we are joint controllers under the TikTok Analytics Joint Controller Addendum. Privacy policy: TikTok.
• YouTube: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, D04 E5W5, Ireland. Privacy policy: Google.

Requests about the data the platforms hold are best sent to them directly, since only they have full access. If you write to us, we will pass your request on.

7. Contacting us

If you email us, we use your message and contact details to answer your request (Art. 6 (1) (b) or (f) GDPR) and delete them when they are no longer needed, unless statutory retention periods apply.

8. Your rights

You have the right to

• access the personal data we hold about you (Art. 15 GDPR),
• have incorrect data corrected (Art. 16 GDPR),
• have your data deleted or its processing restricted (Art. 17 and 18 GDPR),
• receive your data in a portable format (Art. 20 GDPR),
• object to processing based on our legitimate interests, on grounds relating to your particular situation (Art. 21 GDPR),
• withdraw a consent at any time, with effect for the future (Art. 7 (3) GDPR).

To exercise these rights, write to privacy@cavatus.dev. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).

9. Changes

We update this policy when our website or our services change. The current version is always on this page.