Legal · Updated 27 October 2026

Privacy Policy

Effective date: 27 October 2026

This policy explains what personal data we collect, why, who we share it with, and the rights you have. It covers our website at https://alteredlabs.net (the “Site”), our desktop software (the “Software”), our emails and our support.

We collect as little as we can. We never sell your personal data for money.

1. Who is responsible for your data

The data controller is Altered Labs. Privacy contact: [email protected]

We have not appointed a Data Protection Officer because the law does not require one for our activities. Send any privacy question to [email protected].

Lemon Squeezy is a separate controller

Lemon Squeezy LLC (“Lemon Squeezy”) is our reseller and Merchant of Record. When you buy, you buy from Lemon Squeezy. Lemon Squeezy processes your payment, charges tax and issues your invoice. For this, Lemon Squeezy collects your payment and billing data as its own controller, under the Lemon Squeezy Privacy Policy. We never receive your full card details.

iOS and iPadOS apps

Our iOS and iPadOS apps are sold through the Apple App Store. Apple processes your purchase and payment data under Apple’s Privacy Policy. The privacy details for each app are shown on its App Store page.

2. What we collect and why

2.1 When you visit the Site

Data	Why	Legal basis (GDPR)
IP address, browser type, requested pages, time, referrer (server and security logs, handled by Cloudflare)	To deliver the Site, keep it secure and stop attacks and abuse	Legitimate interests (Art. 6(1)(f)): running a secure website
Your choices for theme, cart and cookie consent, stored in your browser	To remember your settings and cart	Strictly necessary; legitimate interests (Art. 6(1)(f))
Analytics data: pages viewed, clicks, device type, approximate location (country/city), how you arrived, cookie IDs (Google Analytics 4)	To understand how the Site is used and improve it	Consent (Art. 6(1)(a))
Advertising data: cookie IDs, click IDs, pages viewed, purchase events (Google Ads, Meta Pixel)	To measure our ads and show relevant ads to people who visited the Site	Consent (Art. 6(1)(a))

Analytics and advertising tools only load after you consent (see section 4 and our Cookie Policy).

2.2 When you buy

Lemon Squeezy shares order data with us so we can deliver and support your license:

Data	Why	Legal basis
Name, email address, country, order number, products, price paid, currency, tax, coupon used, VAT ID (for business orders), license key	To deliver your license, provide support and updates, handle refunds and revoke refunded keys	Performance of a contract (Art. 6(1)(b))
Order and payout records	To meet our accounting and tax duties	Legal obligation (Art. 6(1)(c))

2.3 When you activate and use the Software

Data	Why	Legal basis
License key, your computer’s name as your operating system reports it (for example “Studio-Mac”), an activation ID, your IP address, and activation and validation times	To activate licenses, enforce the activation limit, run periodic validation, show your activated computers in your account and detect key sharing	Performance of a contract (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f)): protecting our software against misuse
Product, version and operating system (update checks)	To tell you when an update is available	Legitimate interests (Art. 6(1)(f))

Our license service is run by Lemon Squeezy LLC (USA). When you activate, validate or deactivate a license, the Software sends the data above directly to Lemon Squeezy’s license service (api.lemonsqueezy.com), not to a server of ours. Lemon Squeezy stores the activation with your license key, and we can see it in our Lemon Squeezy dashboard and in your account on the Site. The computer name is what lets you tell your computers apart there. If you prefer, rename your computer before you activate.

The Software also makes an identifier from your computer’s hardware, but it stays on your computer. It is only used to lock the license and trial files to that computer, and it is never sent.

The Software does not send us your music, projects, samples or files. Apart from licensing and update checks, it does not send usage data to us unless a feature clearly tells you and you agree.

2.4 When you contact us

If you email us, we receive your email address, your message and anything you attach. We use this to answer you. Legal basis: performance of a contract or steps before a contract (Art. 6(1)(b)), or our legitimate interest in answering questions (Art. 6(1)(f)).

If you use the contact form, you give us your name (optional), email address, topic, order number (optional) and message. Our server forwards them to our support mailbox and does not keep a copy. The same legal bases apply.

2.4a Your account on the Site

To sign in, you enter your email address and we email you a one-time link that works for 20 minutes. There is no password.
When you open your account, our server asks Lemon Squeezy for the orders, license keys, activated computers and download files linked to your email address, and shows them to you. We do not store a copy on our server.
From your account you can free a computer, download your files and ask for a refund. We send these requests to Lemon Squeezy.
A cookie called al_session keeps you signed in for 30 days, or until you sign out. It contains your email address and an expiry date, signed so it cannot be forged.
To stop abuse, our server counts sign-in, contact and sign-up requests per IP address and per email address. It keeps these counts in memory only, for up to 24 hours.

Legal basis: performance of a contract (Art. 6(1)(b)) and our legitimate interest in keeping the Site secure (Art. 6(1)(f)).

If you sign up for our newsletter, we use your email address (and name, if you give it) to send you news about our products. Legal basis: consent (Art. 6(1)(a)). We use a confirmation email (double opt-in).
If you bought from us, we may email you about similar Altered Labs products, where the law allows this without consent. You can refuse this when you buy and in every email.
You can unsubscribe at any time with the link in every email.
We keep the subscriber list on our own server and send newsletters through our email provider, Infomaniak Network SA (Switzerland). We do not track whether you open our emails or click their links.

2.6 Server-side conversion events

If you consented to advertising and analytics, we may also send purchase and sign-up events directly from our server to Meta (Conversions API) and Google (GA4 Measurement Protocol). This makes ad measurement more accurate when browsers block scripts.

We send these events only for users who consented.
Email addresses and other direct identifiers are hashed (SHA-256) before they are sent.
Events may also include: event type (for example, purchase), product, value, currency, order ID, cookie and click IDs (such as _fbp, _fbc, GA client ID, gclid), IP address and browser user agent.
Legal basis: consent (Art. 6(1)(a)). If you withdraw consent, we stop sending new events about you.

2.7 Automated decisions

We do not make decisions about you based only on automated processing that have legal or similarly significant effects. Lemon Squeezy and its payment partners may run automated fraud checks on orders under their own policies.

We share data only as needed. Our providers:

Recipient	Role	What they do
Lemon Squeezy LLC (USA)	Independent controller (Merchant of Record) for sales; processor for our license service	Checkout, payment, tax, invoices and order emails. It also runs our license service: it issues license keys and records each activation (license key, computer name, activation ID, IP address)
Cloudflare, Inc. (USA)	Processor	Hosting delivery, content delivery network, security and DDoS protection
Google Ireland Ltd / Google LLC	Processor (Analytics); independent controller (Ads)	Analytics and advertising, only after consent
Meta Platforms Ireland Ltd / Meta Platforms, Inc.	Joint controller for collecting and sending Pixel and Conversions API data; Meta is a separate controller for its later processing	Advertising measurement and audiences, only after consent
Infomaniak Network SA (Switzerland)	Processor	Our email (hello@ and support@), and the sign-in, contact and newsletter emails
Our email and hosting providers	Processors	Running our email, the Site and our infrastructure
Professional advisers and authorities	As required	Accountants, lawyers, tax authorities, courts, when needed or required by law

For Meta, we act as joint controllers under the Meta Controller Addendum. We are responsible for collecting the data on our Site and for getting your consent. Meta is responsible for its processing after it receives the data. You can exercise your rights with either of us.

If we sell or merge our business, data may move to the new owner, who must respect this policy.

We use one strictly necessary browser storage item to remember your theme, cart and consent choices.
Analytics and advertising (Google Analytics 4, Google Ads, Meta Pixel) are off until you opt in if you are in the EU, EEA, UK or Switzerland. We use Google Consent Mode v2. Before you consent, these tags do not load and no analytics or advertising cookies are set.
In other regions, we may enable these tools by default and you can turn them off at any time.
You can change or withdraw your consent at any time with the “Cookie settings” link in the Site footer. Withdrawing is as easy as giving consent.

Full details are in our Cookie Policy.

5. International transfers

Some of our providers are in the USA or other countries outside the EU/EEA and UK. When we transfer data there, we use a legal safeguard:

the EU-US Data Privacy Framework (and the UK Extension), where the provider is certified (for example, Google, Meta and Cloudflare); or
the European Commission’s Standard Contractual Clauses (and the UK Addendum), plus extra measures where needed.

Switzerland, where our email provider is based, has an adequacy decision from the European Commission and the UK.

You can ask us for a copy of the safeguards at [email protected].

6. How long we keep data

Data	How long
Order and license records (email, license key, products)	As long as your license exists, so you can recover and use it, and at least as long as tax and accounting law requires (generally 6 years from purchase)
Activation and device records	While the activation is active, then up to 12 months after deactivation or revocation
Revoked license keys	Kept permanently in a blocklist (key only), so a revoked key cannot be reused
Security logs (Cloudflare)	Short periods, as set by Cloudflare, normally days to weeks
Analytics data (GA4)	14 months, then deleted automatically
Support emails	3 years after our last contact
Newsletter subscription	Until you unsubscribe; then we keep only your email on a suppression list so we never email you again
Consent records	As long as needed to prove consent, up to 3 years after your last visit

7. Your rights (EU, EEA, UK and Switzerland)

You have the right to:

access the personal data we hold about you;
correct wrong or incomplete data;
delete your data (“right to be forgotten”), where the law allows;
restrict how we use your data;
data portability: get your data in a common machine-readable format;
object to processing based on legitimate interests, and to direct marketing at any time;
withdraw consent at any time. This does not affect processing done before you withdraw;
complain to a data protection authority, in particular in the country where you live or work, or where an alleged breach happened. In the UK, it is the Information Commissioner’s Office (ico.org.uk).

To use your rights, email [email protected]. We reply within one month. We may ask you to confirm your identity, for example by writing from the email address used for your order. For payment data, you can also contact Lemon Squeezy.

If you ask us to delete your data, we may need to keep some records for legal reasons (for example, tax records), and deleting your order data means we can no longer help you recover your license.

8. California and other US states

This section applies to California residents under the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA). We give the same rights to residents of other US states with similar laws.

8.1 What we collect (last 12 months)

Category (CCPA)	Examples	Source	Purpose	Disclosed to
Identifiers	Name, email, IP address, cookie IDs, license key, computer name	You, your device, Lemon Squeezy	Orders, licensing, support, security, analytics, advertising	Lemon Squeezy, Cloudflare, Google, Meta, email providers
Commercial information	Products bought, price, coupons	Lemon Squeezy	Orders, support, accounting, ad measurement	Lemon Squeezy, Google, Meta, advisers
Internet or network activity	Pages viewed, clicks, referrer	Your browser	Analytics, advertising, security	Cloudflare, Google, Meta
Approximate geolocation	Country or city from IP address	Your device	Tax, pricing, analytics, security	Lemon Squeezy, Cloudflare, Google

We do not collect sensitive personal information as defined by the CCPA, and we do not use any personal information to infer characteristics about you.

Retention periods are listed in section 6.

We do not sell personal information for money. However, when advertising cookies are on, sharing identifiers and browsing data with Google and Meta for targeted advertising may count as “sharing” (and possibly “selling”) under the CCPA.

You can opt out at any time:

click “Do Not Sell or Share My Personal Information” in the Site footer; or
use a Global Privacy Control (GPC) signal in your browser. We treat GPC as a valid opt-out of sale and sharing for that browser. Learn more at globalprivacycontrol.org.

We do not knowingly sell or share personal information of consumers under 16.

8.3 Your rights

You have the right to:

know what personal information we collect, use, disclose, sell or share;
delete your personal information;
correct inaccurate personal information;
opt out of the sale or sharing of your personal information;
non-discrimination: we will not treat you differently for using your rights.

We do not use sensitive personal information, so the right to limit its use does not apply.

To make a request, email [email protected]. We will confirm your identity by matching information you give with information we hold. You can use an authorised agent. We may ask the agent for proof of your signed permission. We reply within 45 days. If you are in a state that offers appeals, you can appeal our decision by replying to our answer.

9. Children

The Site and Software are not aimed at children. We do not knowingly collect data from children under 16 (or the lower age set by your country’s law). If you think a child has given us data, contact [email protected] and we will delete it.

10. Security

We use HTTPS everywhere, a security-focused hosting setup behind Cloudflare, limited access to data, and providers with strong security. Card data is handled only by Lemon Squeezy and its payment processors. No system is perfectly secure. If a data breach is likely to put your rights at risk, we will tell you and the authorities as the law requires.

11. Changes to this policy

We may update this policy. The date at the top shows the latest version. If a change is significant, we will show a notice on the Site or email customers.

12. Contact

Privacy questions and requests: [email protected]