About this policy
Last updated: 22 September 2026. This policy explains how personal data is processed when you visit metasisaudio.com, contact us, apply for an education discount, use an account, buy or download our audio plugins, activate a licence, make a privacy choice, or use optional analytics and media services.
1. Controller
Ahmet Sis, trading as Metasis Audio
Schützenhofstr. 7
26135 Oldenburg, Germany
Email: support@metasisaudio.com
Phone: +49 176 22363032
2. Website delivery and security
When your browser requests this website, technical information such as your IP address, the requested page or file, request time, browser information and server response data is processed to deliver the content and protect the service against errors and misuse. Hosting and technical service providers may process this information on our behalf.
The legal basis is Article 6(1)(f) GDPR: our legitimate interest in providing a reliable, secure website. Information necessary to take steps at your request or provide a contracted service is processed under Article 6(1)(b) GDPR. Technical records are retained only as long as necessary for operation, troubleshooting or investigation of a specific security incident.
Hosting is provided by ALL-INKL.COM – Neue Medien Münnich, owner René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. Further provider information is available at ALL-INKL.COM privacy information.
3. Cookies, local storage and privacy choices
Necessary cookies and local storage support functions you request, including the shopping cart, account login, security controls and your privacy choice. Access to or storage on your device for these functions is based on Section 25(2)(2) TDDDG. The associated personal-data processing is based on Article 6(1)(b), (c) or (f) GDPR, depending on the purpose described below.
WooCommerce may use woocommerce_cart_hash and woocommerce_items_in_cart to keep the cart state consistent, and wp_woocommerce_session_* to associate your browser with a server-side cart session. WordPress may use wordpress_logged_in_* and wordpress_sec_* for authentication and wordpress_test_cookie to check cookie support. Their duration depends on the session and the login option you select.
Your privacy choice is stored locally on your device under metasis-consent-v2 for up to 180 days. It records your analytics and external-media choices, the applicable notice version, the time saved and the expiry time. A separate local entry called metasis-consent-id-v1 contains a randomly generated consent identifier for up to 730 days. It supports proof and administration of your choices and is not used for advertising or cross-site tracking. If browser storage is unavailable or you clear it, you may need to choose again.
When you save, accept or reject optional services, the website sends the random consent identifier and your choices to our server. The server stores only a keyed hash of that identifier, the notice version, the two yes or no choices, the time recorded and the expiry time. These records expire after 730 days and are removed by a daily cleanup. The consent record does not contain the raw consent identifier, your raw IP address, user agent, name, email address, Google identifier, page URL or cookie contents. A separate rate-limit record uses a keyed digest derived from the connecting IP address and expires after ten minutes. It does not store the raw IP address.
The server-side consent record is processed under Article 6(1)(c) GDPR in conjunction with Article 7(1) GDPR, because we must be able to demonstrate consent. Proportionate rate limiting and resolving disputes about a choice rely on Article 6(1)(f) GDPR. Our legitimate interests are protecting the preference service and being able to establish which notice and choice were recorded.
Optional analytics and external media are disabled by default. You can accept or reject both on the first layer of the privacy banner or choose them separately under Manage settings. You can change or withdraw your choice at any time through Cookie settings in the footer. Withdrawal applies for the future and does not affect processing that was lawful before withdrawal.
WooCommerce source-attribution tracking and the WooPayments frontend tracking script are disabled in this storefront. Analytics cookies are described in section 8. YouTube is described in section 9.
4. Contact and support
If you contact us, we process your contact information, message and any order or diagnostic information you choose to provide to answer the request. The basis is Article 6(1)(b) GDPR for contract-related enquiries and Article 6(1)(f) GDPR for other correspondence. Please avoid sending passwords, payment-card details or unrelated sensitive information.
Correspondence is deleted when it is no longer needed for the request, unless statutory retention requirements or the establishment, exercise or defence of legal claims require continued storage.
Website emails are sent through an ALL-INKL.COM SMTP server using an encrypted TLS connection. The email service processes sender and recipient addresses, message contents and technical delivery information for this purpose. WP Mail SMTP connects the website to that server; it does not itself replace the email provider.
The support form requires only an email address and message; your name, plugin and system/DAW details are optional. Without an email address and message we cannot respond through the form. It sends your request to support@metasisaudio.com through our existing website and email infrastructure. The form does not add a message database, external CAPTCHA, analytics or newsletter subscription. Authorised support staff and our hosting/email processors handle the request; information is not used for advertising.
For abuse prevention, the form uses a keyed daily digest of the connecting IP address and a submission counter expiring after ten minutes. It does not store the raw IP in that counter or include it in the support email. A separate keyed submission identifier and reference expire after two hours to prevent repeated sends. Form signatures expire after two hours. These technical measures rely on Article 6(1)(f) GDPR, our legitimate interest in protecting the contact service against spam and repeated submissions. They do not set additional form cookies. General hosting and mail-service records are described separately in this policy.
Education discount applications
If you apply for our student or teacher discount, we require your name, email address, student or teacher status, educational institution and one current supporting document. We use this information to check eligibility, respond to your request and, after manual approval, issue a personal discount code. The basis for these steps requested before a possible purchase is Article 6(1)(b) GDPR. Proportionate protection against duplicate or fraudulent applications relies on Article 6(1)(f) GDPR. The decision is made by a person, not solely by an automated system.
Only proof showing your name, institution, current education status and a date or validity period is needed. Please cover unrelated details such as student or staff numbers, photos, addresses, dates of birth and grades. Do not submit government identity documents. Without the required information and sufficient proof we cannot verify eligibility through this form. If you cannot provide a suitable document, contact support to discuss your circumstances.
Applications use our existing website, hosting and email infrastructure. Authorised site administrators review the proof. Uploaded documents and application contact details are encrypted in a private database record; the documents are not placed in the public media library. Access to a document requires an authenticated administrator and a signed request. The notification sent to support contains the application reference and a protected administration link, not the document. Decision emails contain the outcome and, if approved, the code; documents are not attached. No external verification service, CAPTCHA provider, advertising service or newsletter signup is involved.
The document is deleted from the active application store when a decision is recorded. Unreviewed documents are removed by the scheduled cleanup after 30 days, and application records after 90 days from submission. A reviewer who downloads a document is instructed to delete that local copy after review. Discount-code and resulting order records are separate: the code is restricted to the application email and one order, expires 30 days after approval, and relevant purchase and accounting records follow the retention rules in section 5. If an application requires further correspondence, the contact and support retention rules above apply.
The education form uses a signed submission identifier valid for two hours and a keyed daily digest of the connecting IP address with a counter expiring after ten minutes. A keyed submission reference expires after two hours to prevent duplicate submissions. The counter does not store the raw IP address. These security measures rely on Article 6(1)(f) GDPR and do not add form cookies. General hosting records are described in section 2. You can exercise your rights using the contact details in this policy; include your application reference if available.
5. Accounts, orders and digital delivery
WooCommerce is used to provide the shop and customer accounts. Depending on the service you use, we process your name, email address, billing details, account authentication data, ordered products, payment status and order history. This enables us to manage your account, process orders, provide downloads and respond to purchase-related questions.
The basis is Article 6(1)(b) GDPR. Accounting and other statutory records are retained under Article 6(1)(c) GDPR for the applicable legal periods. Data required to investigate misuse or defend legal claims may be retained under Article 6(1)(f) GDPR for as long as that purpose requires. Deleting an account does not automatically erase records that must be kept by law.
Information marked as necessary in an account or checkout form is required to provide that service. Without it, we may be unable to create the account or fulfil the order.
6. Payments
When you select a payment method, the relevant payment provider processes the information needed to authorise the transaction and protect against fraud. We receive the transaction status and information needed to reconcile your order. Payment-provider services may include processing outside the European Economic Area.
Where offered at checkout, WooPayments is provided within the Automattic group in partnership with Stripe. Payment processing can involve contact and billing details, order and transaction information, device/network data and payment-method information. The payment service receives payment details directly through its payment interface. The basis for transaction-related processing is Article 6(1)(b) GDPR; legal record-keeping and proportionate fraud prevention may rely on Article 6(1)(c) or (f) GDPR. See the Automattic Privacy Policy, the Stripe Privacy Policy and WooCommerce payment privacy information for the relevant entities, processing and international-transfer safeguards.
7. Plugin licences, devices and transfers
When ordering, we store the contract documents supplied to you, your express digital-delivery consent and its time with the order, and include them in the contractual email confirmation. For an accepted licence transfer we also record the contract documents supplied to the new holder. This documents the agreement and fulfils information obligations under Articles 6(1)(b) and 6(1)(c) GDPR; relevant documents are retained for the applicable statutory periods and, where necessary, the establishment or defence of legal claims.
The public online withdrawal function processes your name, confirmation email, description of the contract or products, statement and receipt time. No login or exact order number is required. The first step prepares a signed confirmation valid for one hour; the statement is recorded when you confirm it. We store the submitted statement privately in WordPress, send an acknowledgement to you and notify support. This serves our contractual and statutory duties under Articles 6(1)(b) and 6(1)(c) GDPR. Records are retained while needed to process the withdrawal and meet applicable documentation or legal-claim requirements. Access and erasure requests are reviewed against those continuing duties. Abuse protection uses a daily keyed IP digest with a request count that expires one hour after its last update, without storing the raw IP in that record.
The Metasis License Manager links a licence to its customer, product and authorised computers. It provides activation, deactivation, downloads, support and voluntary account-based licence transfers. Contract-related processing is based on Article 6(1)(b) GDPR. Proportionate protection against unauthorised sharing and requests that overload the service is based on Article 6(1)(f) GDPR.
When you activate a current plugin, it sends the product identifier, purchase email, licence key and a machine identifier to our licence server over HTTPS. The server checks the licence and available device places and returns a signed local authorisation and a device-specific deactivation receipt. The machine identifier is linked to your licence and is pseudonymous, not anonymous. Your account password, audio, projects and recordings are not sent by the licensing component.
After activation, current plugins validate their authorisation locally and do not perform periodic licence-server checks. Opening a plugin or playing audio does not trigger a licence-server connection. A connection is made when you explicitly activate, verify an older activation or deactivate a computer. Deactivation sends the product and machine identifiers and the device-specific receipt. If it fails, the plugin stores a pending local request; it contacts the server again when you choose Retry. Older releases may have a different deactivation interface; support can help you update.
Local files store the signed authorisation, purchase email contained in that authorisation, device receipt and, if applicable, a pending deactivation. Local trial files record the first trial start and last observed time to enforce the seven-day trial without periodic network requests. Access to this device storage is necessary to provide the activated plugin or trial you request, under Section 25(2) TDDDG; associated personal-data processing relies on Article 6(1)(b) GDPR.
Server licence records contain the key, product, customer name and email, customer/order references, device allowance, status and creation time. Device records contain a licence reference, machine identifier and activation/deactivation times. The administrator sees authorised devices and licence events, not a live installation count or listening activity. Customers deactivate computers inside the plugin; the browser account cannot free individual device places. Support can help with a lost or broken computer.
Licence and active-device records are retained while needed to provide and verify your continuing licence. Deactivated device records and support/security events are removed by the daily cleanup after 365 days. A server-local snapshot made for the licence-system migration is removed after 30 days. Statutory accounting records and information needed for a specific unresolved legal claim are governed by the retention purposes described elsewhere in this notice.
For a transfer, we process the licence reference, sender account, recipient email, confirmation of relinquishing the licence, invitation status and relevant times. The recipient receives an invitation valid for seven days. On acceptance, the licence and its download access pass to an existing account for that email, or a new account is created and receives a password-setup email. Both parties receive a completion notification. The original invoice, billing details and other purchases are not transferred. The account-creation and licence-delivery emails are transactional messages. A pending transfer can be cancelled; it expires if not accepted. Closed transfer records are removed by the daily cleanup once their creation date is more than 365 days old.
To limit abusive API requests, the server temporarily stores a request count under a keyed, daily changing digest derived from the requesting IP address. This rate-limit record expires ten minutes after its last update; it contains no raw IP address or licence key. The hosting server separately processes connection and security information as described in section 2. Licence services use our hosting and email providers; no advertising or analytics service receives data from the licensing component.
8. Optional Google Analytics
With your permission, we use Google Analytics 4 to understand how visitors find and use the public storefront and to improve its content, navigation and performance. The provider for customers in the European Economic Area is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Google Analytics is implemented in basic consent mode. The Analytics tag is not downloaded and no Analytics request is sent before you actively allow Analytics. Rejecting optional services or leaving the banner unanswered prevents the tag from loading. The legal bases are your consent under Section 25(1) TDDDG for access to or storage on your device and Article 6(1)(a) GDPR for the associated processing of personal data. Consent is voluntary and is not required to use the shop.
After consent, Analytics can process a pseudonymous client identifier, visited page paths, first-party referrer information, interaction and event data, session statistics, approximate location, browser and device characteristics, operating system, language and timestamps. We send page paths without URL query parameters and reduce referrer information to its origin and path. We do not intentionally send names, email addresses, order details, payment information, licence keys, support messages, form contents or other directly identifying account data to Analytics.
The Analytics measurement tag is not made available on cart, checkout, customer-account, support, education-discount or withdrawal-form pages, or while a visitor is logged in. This prevents Analytics measurement on those pages even if Analytics was allowed elsewhere.
After consent, Google Analytics may set the first-party cookies _ga and _ga_<container-id> to distinguish pseudonymous users and preserve session state. We configure these cookies to expire after 90 days from their first setting and not to extend the expiry on later visits. Browser restrictions can shorten this period. If you withdraw Analytics consent, we disable further measurement, remove Analytics cookies accessible to the website and reload the page if the Analytics tag had already loaded.
Advertising storage, advertising user data and advertising personalisation remain denied. Google Signals for behavioural reporting, advertising personalisation signals and URL passthrough are disabled, advertising-data redaction is enabled, and the Analytics property is not linked to Google Ads. We do not use Analytics for remarketing, personalised advertising or advertising audiences.
Google states that Google Analytics does not log or store individual IP addresses. IP-address data is used at collection time to derive approximate location and is then discarded before event data is logged. Google may nevertheless receive the IP address as part of the network connection to its service. Further details are available in Google’s information on EU-focused Analytics data and privacy and regional data collection.
User-level and event-level data in the Analytics property is configured for a retention period of two months, with reset on new activity disabled. Google explains that this setting does not affect standard aggregated reports, which can therefore remain available for longer. Google may retain information for additional periods where its terms or legal obligations require this.
Google Site Kit connects the WordPress administration area to our Google Analytics property so authorised administrators can view reports. Site Kit does not insert the Analytics measurement tag on the storefront and does not bypass the consent gate described above.
Analytics data may be processed in the United States and other countries outside the EEA. Google states that, where applicable, it relies on the EU-US Data Privacy Framework and may use the European Commission’s Standard Contractual Clauses for transfers not covered by an applicable framework. See the Google Privacy Policy, the Google Analytics Terms, Google’s data processing terms and Google’s international transfer information.
You can withdraw Analytics consent at any time through Cookie settings in the footer. Withdrawal applies to future collection. It cannot undo data already transmitted while consent was active.
9. Optional YouTube videos
Product videos connect to YouTube only after you allow external media and start playback. The service is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Playback uses youtube-nocookie.com; that domain does not mean that playback is anonymous or that no personal data is processed.
When a video is loaded, Google can receive your IP address, device and browser information, referrer information and information about the video request and playback. If you are signed in to a Google account, Google may associate the interaction with that account. Data may also be processed in the United States. The legal bases for optional device access and personal-data processing are Section 25(1) TDDDG and Article 6(1)(a) GDPR.
You can withdraw external-media permission at any time through Cookie settings. Embedded players are then removed and future playback is blocked until you allow it again. Withdrawal does not affect processing that was lawful before withdrawal and cannot undo data already received by Google. Details of Google’s processing and international-transfer mechanisms are available in the Google Privacy Policy and Google’s international transfer information.
10. Newsletter and local assets
We do not offer newsletter registration. Buying a plugin or creating an account does not subscribe you to marketing emails.
The storefront serves Space Grotesk fonts, its navigation icons and product imagery locally. Loading these assets does not require a connection to an external font or icon service.
11. Recipients, international transfers and retention
Data is accessible to authorised people who need it to operate the service and to relevant hosting, email, payment, analytics and technical providers described in this policy. Providers acting on our instructions are engaged under the applicable data-processing requirements. Information may also be disclosed where legally required, for example to tax authorities, or to professional advisers where necessary.
For transfers outside the EEA, an applicable adequacy decision or appropriate safeguards under Articles 44 to 49 GDPR are required. The actual safeguard depends on the provider and processing described above. You may contact us for information about safeguards applicable to your data.
Unless a specific period is stated, retention depends on the purpose of processing, the duration of the service relationship, statutory record-keeping duties and any outstanding legal claims. Data is deleted or access is restricted when no further lawful purpose requires retention.
12. Your rights
Subject to the conditions in the GDPR, you may request access, correction, erasure, restriction of processing and data portability. You may withdraw consent at any time for the future. If processing is based on legitimate interests, you may object on grounds relating to your particular situation. You may object to direct marketing at any time.
To exercise these rights, contact support@metasisaudio.com. We may request proportionate information to verify that the request concerns your data.
You may lodge a complaint with a data-protection supervisory authority, including the authority where you live or work or where you believe a violation occurred. For our location in Lower Saxony, see The State Commissioner for Data Protection of Lower Saxony.
13. Updates
This notice is updated when the website, its services or applicable requirements change. The current version and its update date are available on this page.