Privacy policy

Photon Consulting Limited, trading as SquareWave Studio ("we," "us," "our," or "Company"), is committed to protecting your privacy and ensuring you have a positive experience on our website and with our products, including SquareWave Studio software. This Privacy Policy explains our information practices, your rights and how to exercise them.

1. Information we collect

Information you provide directly:

• Account information (email, name, company)
• Purchase and payment information (processed through Lemon Squeezy)
• Support requests and communications
• Product feedback and survey responses

Information collected automatically:

• Website usage data (pages visited, time spent, referring site)
• Device information (browser type, operating system, device type)
• IP address and approximate location
• Cookies and similar tracking technologies

2. Legal basis for processing (GDPR)

We process your personal data based on one or more of the following legal grounds:

• Contractual Necessity: To fulfil our obligations under your purchase agreement and provide the software service
• Legitimate Interests: To improve our service, prevent fraud and maintain security
• Legal Compliance: To comply with applicable laws, regulations and legal processes
• Consent: Where you have explicitly opted in to marketing communications, or to app analytics (EP-PatchStudio 1.6 and later, OP-PatchStudio 0.21 and later, and PO-PatchStudio)

2A. App analytics

EP-PatchStudio 1.5 and earlier and OP-PatchStudio 0.20 and earlier collect usage analytics by default, based on our legitimate interest. From EP-PatchStudio 1.6 and OP-PatchStudio 0.21, analytics stay off until you choose to share them, based on your consent.

PO-PatchStudio is different: its analytics are opt-in. They are off until you turn them on in Settings, and you can turn them off again at any time. When on, PO-PatchStudio collects the data described below (feature usage, app version, operating system, error reports, approximate location and the install ID; not platform architecture), based on your consent (GDPR Article 6(1)(a)).

What we collect:

• Which features you use (e.g., "opened sample editor", "created backup")
• Button clicks and tool interactions within the app
• Basic device information (operating system, platform architecture)
• App version and performance metrics (crash reports, error logs)
• Approximate location: your country, worked out from your IP address when the data arrives. The IP address itself is not stored. Until 26 September 2026 the city and city-level coordinates were stored as well
• A pseudonymous ID for the app install: a random ID the app creates the first time it runs, so data from one install can be grouped together. We don't link it to your name, email address or licence
• From EP-PatchStudio 1.7, which tip option you chose and how the tip attempt ended, never a custom amount (see section 2D)

What we never collect:

• Your name (except as part of a file path, below), email address or licence key, and we don't store your IP address
• File contents or audio data. File names are not collected either, except that an error report can currently include a file path if one appears in the error message. A path can include your computer's user name, which is often your name. We're removing this in upcoming versions
• Device serial numbers
• Your precise location

Update checks and downloads:

When an app checks for updates, or an app or our website downloads an installer, our download server counts it. An update check records the app, the version you have, the latest version, whether an update is available, and the platform and processor architecture. A download records the app, the version, the platform, the file's name and type, where the link came from (for example our website or the app) and whether it's a fresh install or an update, with the version you're updating from. This happens whether or not you share analytics, based on our legitimate interest in knowing how many people use and update each app. These counts carry no location and are not sent with your IP address. They carry no identifier either, except that a download can carry an analytics ID when analytics are on: a website's own visitor ID if you started it there after accepting cookies, or the app's install ID described above if the app opened the link.

Legal basis for EP-PatchStudio 1.5 and earlier and OP-PatchStudio 0.20 and earlier: Legitimate Interest (GDPR Article 6(1)(f)):

For those versions, we process this usage data based on our legitimate interest to improve our software products and fix bugs. Later EP-PatchStudio and OP-PatchStudio versions, and PO-PatchStudio, rely on your consent (GDPR Article 6(1)(a)) instead. Our assessment:

• Purpose: Understand which features are used, identify bugs and prioritise improvements
• Necessity: Essential for maintaining software quality and user satisfaction
• Balancing Test: The data is pseudonymous and minimal: no name, email address or licence, no stored IP address and only an approximate location, so the privacy impact is low
• User Rights: You can opt out any time in Settings → Preferences → Privacy & Updates

2B. Model downloads from Hugging Face

Some features need a model file on your machine: stem separation in EP-PatchStudio, and the speech packs for Memos in OP-PatchStudio. When you choose to download one, the app downloads it directly from Hugging Face (huggingface.co and its content delivery network). Hugging Face sees your IP address and the details of that request, as any website does, under its ownprivacy policy. The request carries no account, cookies or app identifiers.

• Nothing downloads until you choose a model (for stem separation, after you accept its licence). You can also import a model file you already have, and then nothing is downloaded.
• Stem separation and transcription run entirely on your machine. No audio, recordings or transcripts are ever sent to Hugging Face, to us or to anyone else.

2C. Feedback and testimonials

When you send feedback at squarewave.studio/feedback, or from an app's "enjoying it?" prompt, we store what you wrote (up to 280 characters), the first name or handle you gave (optional), and which app and version it came from. We do not ask for your email address, and we do not store your IP address or device details with it.

• Why: to learn what works in our apps, based on our legitimate interest in improving them (GDPR Article 6(1)(f)).
• Quotes: we only quote your feedback if you tick the separate box that says so, based on your consent (GDPR Article 6(1)(a)). We record the wording you agreed to. Quotes appear on squarewave.studio and in SquareWave Studio's posts and emails, with the first name or handle you gave, or as "a [app] user" if you gave none. We never add your surname, photo or anything else.
• Withdrawing: you can withdraw your consent to be quoted at any time. We will take the quote off squarewave.studio and stop using it in new posts and emails within one month. We cannot recall emails or posts that have already gone out.
• Keeping and deleting: we keep feedback for 2 years, then delete it. A quote we are still using is kept until you withdraw it. To have your feedback deleted sooner, email support@squarewave.studio with the words you sent (we have no email address to find it by). We will delete it within one month and confirm.

2D. Tips and Superfan credits

You can tip from our apps. Tips unlock nothing. Lemon Squeezy, as the seller, handles the payment and your email address under its own privacy policy. We record the amount, the date and which app the tip came from, and we don't store your email with it. If you tip from a desktop or Android app with a Pro licence activated, the app sends your licence key once so we can check it, and we link the tip to your licence by Lemon Squeezy's numeric licence id (not the key). That is how tips count towards Superfan.

• Superfan totals: to work out what a licence has paid, we look up its purchase and any Superfan upgrades in Lemon Squeezy when you ask the app, and keep the licence's own price and date so we don't have to ask again. This is part of providing the licence you bought (GDPR Article 6(1)(b)).
• Superfan across apps: if you buy more than one of our apps with the same email, we check those orders in Lemon Squeezy so Superfan status carries across apps. We compare the email Lemon Squeezy holds for each purchase and don't store it. We keep only the result (which app's licence counts) with a reference to your licence, but not its key or your email. We use that result for up to an hour, replace it at the next check after that and clear it whenever an order is refunded. This is part of providing the licence you bought (GDPR Article 6(1)(b)).
• Credits: as a Superfan you can ask to be credited in the apps and on squarewave.studio, under a name you choose and an optional link, by ticking a separate box (GDPR Article 6(1)(a)). We record the wording you agreed to and your licence's numeric id, and show the name only after we have approved it. Links open with no referral or tracking added. Credits need a Pro licence key. An App Store or Google Play build sends the store's transaction ID or purchase token in its place, with the name and link; we can't check store purchases yet, so that request is refused and nothing from it is stored, the ID or token included.
• Changing or removing a credit: send the form again with a new name or link. You can see your entry and remove it yourself in the app, even after a refund, or emailsupport@squarewave.studio and we will remove it within one month. A removed name leaves the site within a few minutes; apps that are already installed may show the old list until they next go online. We keep only a note that a removal happened (a one-way hash of the licence key and the date), with no name or link.
• Tips in app analytics: from EP-PatchStudio 1.7, if you have turned on usage data (section 2A), the app sends one "tip_outcome" event per tip attempt. It says which tip option you chose (small, big, Superfan or a custom amount) and how the attempt ended (checkout opened, purchased, pending, cancelled or error). It doesn't include the amount of a custom tip, your licence key, your email or the error message.

3. How we use your information

We use collected information to:

• Provide, maintain and improve the SquareWave Studio software and services
• Process transactions and send transactional emails
• Send marketing communications (only with your consent)
• Respond to support requests and provide customer service
• Detect, prevent and address technical issues and fraud
• Analyse usage patterns and optimise our website and product
• Comply with legal obligations and enforce our terms

4. Who we share your data with

We do not sell your personal data. We may share information with:

• Lemon Squeezy: Payment processor for handling licence purchases and validation
• Cloudflare: Infrastructure and hosting provider
• PostHog (EU Cloud): Website analytics after cookie consent, and app analytics as described in section 2A
• Brevo: Newsletter and product update emails
• Legal Authorities: When required by law or legal process
• Service Providers: Third parties who assist us in operating our website and services (under data processing agreements)

See our subprocessors for the current list.

5. Data retention

We retain your personal data only as long as necessary:

• Account Data: Until you request deletion or for 3 years of inactivity
• Transaction Data: For the duration required by applicable tax and financial regulations (typically 7 years)
• Support Communications: For 2 years or until the support case is resolved
• Feedback: For 2 years, or while we are using it as a quote you agreed to (see section 2C)
• Tips and Superfan totals: For the duration required by tax and financial regulations, as for transactions (see section 2D)
• Superfan credits: Until you ask us to remove them
• Cookies: As specified in our Cookies section below

6. Your privacy rights (GDPR)

You have the following rights under the General Data Protection Regulation (GDPR):

Right to Access:

You can request a copy of the personal data we hold about you at any time.

Right to Rectification:

You can request correction of inaccurate or incomplete personal data.

Right to Erasure ("Right to be Forgotten"):

You can request deletion of your personal data, subject to legal retention requirements.

Right to Restrict Processing:

You can request that we limit how we use your personal data.

Right to Data Portability:

You can request your personal data in a portable format to transfer to another service.

Right to Object:

You can object to processing of your data for direct marketing or legitimate interests.

Right to Withdraw Consent:

If we process data based on consent, you can withdraw it at any time.

To exercise any of these rights, contact us at:support@squarewave.studio

6A. Deleting your SquareWave account

EP-PatchStudio, OP-PatchStudio and PO-PatchStudio include an optional sign-in to a SquareWave account, used to browse and publish community patches and kits. It is not yet generally available. If you have a SquareWave account, you can delete it and its data at any time.

How to delete your account:

1. Sign in at squarewave.network/settings.
2. Under Delete account, choose Delete my account and confirm.

If you can't sign in, email support@squarewave.studio from the address on your account and ask for it to be deleted. We will delete it within one month and confirm by email.

What is deleted and what is kept:

• Your profile, sessions, sign-in credentials, app tokens, likes, follows and collections are erased.
• You choose what happens to your uploads: keep them published, relicensed to CC0 and shown as "Deleted user", or remove them and purge their files.
• Comments you posted are kept for thread continuity but shown as "Deleted user".
• Security and request logs are kept for up to 90 days.

7. Cookies & tracking technologies

Our website uses cookies and similar technologies:

• Essential Cookies: Required for website functionality (authentication, security)
• Analytics Cookies: To understand how users interact with our site
• Marketing Cookies: To deliver targeted content (only with consent)
• Referral cookie: If you arrive from a creator's link and agree, Lemon Squeezy stores a referral identifier for up to 90 days so the creator is credited if you buy. Its script also sends a browser fingerprint to Lemon Squeezy to recognise the visit. If you do not agree, nothing is stored; a creator code you type at checkout is only recorded on your order.

For the full detail of what is set and when, see our cookie notice. Most browsers allow you to control cookies through settings. You can also opt-out of tracking by contacting us.

8. International data transfers

Our websites and apps run on Cloudflare's global network (Cloudflare, Inc., a US company), so requests are served from the data centre nearest you. Our licensing database is stored in the EU. PostHog (EU Cloud) and Brevo (France) hold their data in the EU. Lemon Squeezy, our payment provider, is based in the USA. Where personal data is transferred outside the EU/EEA, we rely on appropriate safeguards such as the EU Standard Contractual Clauses or the EU-US Data Privacy Framework. The current list of providers and where they process data is on oursubprocessors page.

9. Data security

We implement technical and organisational measures to protect your personal data:

• Encryption of data in transit (HTTPS/TLS)
• Secure authentication mechanisms
• Regular security audits and updates
• Access controls and employee training
• Incident response procedures

No system is 100% secure. We cannot guarantee absolute security of your data.

10. Third-party links & services

Our website may contain links to third-party websites and services. We are not responsible for their privacy practices. We encourage you to review their privacy policies before providing any personal information.

11. Children's privacy

SquareWave Studio software is not intended for children under 16. We do not knowingly collect personal data from children. If we learn we have collected data from a child under 16, we will delete it promptly. Parents or guardians with concerns should contact us immediately.

12. Data protection contact

We are committed to data protection and have established processes to ensure compliance with the GDPR. We have not formally appointed a Data Protection Officer. For data protection inquiries, contact: support@squarewave.studio

13. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on our website and updating the "Last updated" date. Your continued use of our service constitutes acceptance of the updated policy.

14. Contact us

For privacy-related questions or to exercise your rights:

Email: support@squarewave.studio

If you are not satisfied with our response to a privacy inquiry, you have the right to lodge a complaint with the Irish Data Protection Commission (dataprotection.ie), the supervisory authority for our company; if you are in another EU country you may also contact your local authority.