Privacy Policy

1. Controller and contact details

1.1 Null Point Audio Ltd. („Нул Пойнт Аудио“ ООД), registered in Bulgaria under UIC 208903430, is the controller of the personal data described in this policy. For privacy questions or to exercise your rights, contact inbox@nullpoint-audio.com.

2. Personal data, purposes and legal bases

2.1 Browsing and security

Requests to our website and service providers include connection information such as IP address, browser information, requested pages and request times. Service logs may also record errors. We use this information to deliver and secure the website, relying on our legitimate interests in operating a reliable service and preventing misuse.

2.2 Accounts

Supabase provides authentication and stores account information, including your email, account identifier, credentials managed by Supabase Auth, session information and account creation or update times. Our account profile also stores your Stripe customer reference when one exists. We use this information to provide the account you request, secure it and connect it to your purchases, based on contract performance and our legitimate interests in security.

2.3 Purchases and payments

Stripe Checkout collects contact and billing details, including email, name, billing address, telephone number and payment information. Our Supabase database stores product and purchase identifiers, customer email, amount, currency, purchase status and time, Stripe customer, checkout and payment references, and order-email delivery status. It also records product access, promotional-code redemptions and processed payment-event references.

We use these records to take payment, supply plugins and included future updates, handle order problems, prevent fraud and meet accounting or tax duties. The legal bases are contract performance, legal obligations and legitimate interests in preventing fraud and resolving disputes. We do not store full card numbers or card security codes in our application database.

2.4 Downloads

We store product and file access permissions, purchase references, protected download-token hashes, link expiry times, permitted download counts and download times. These provide authorised access and help prevent misuse, based on contract performance and our legitimate interests in protecting downloads. Expiry of a download link does not end your licence.

2.5 Support and correspondence

If you contact us, we receive your contact details, message, order reference and technical information you choose to provide. We use these to answer your request and resolve problems, based on contract performance, pre-contract steps you request, or our legitimate interest in answering general enquiries.

2.6 Product feedback

A product-feedback vote stores your email, selected option and submission or update time. We use it to record the vote and limit duplicate submissions, relying on our legitimate interests in meaningful product feedback. Voting does not subscribe you to marketing.

2.7 Newsletter subscriptions

When you submit the dedicated Subscribe form, we store your email, signup source, the wording shown on the form and the subscription time in Supabase. These entries form our mailing list for future product news and updates, based on your consent. Buying, creating an account, downloading or voting does not by itself subscribe you. Section 8 explains how to unsubscribe.

3. Required and optional information

3.1 You can browse public product information without an account. An accessible email and relevant payment details are necessary to fulfil an order. Authentication details are necessary for an account, and an email is necessary to deliver a newsletter. Without the information required for a particular service, we may be unable to provide that service.

3.2 Newsletter subscriptions and product-feedback votes are optional. You can buy and use our plugins without subscribing to marketing. Product-specific technical requirements are described on the relevant product page; any additional personal-data processing will be explained in an applicable privacy notice.

4. Service providers and recipients

4.1 We use the following service providers to operate the website and fulfil requests:

• Supabase: account authentication, database and protected download storage. See Supabase’s Privacy Policy.
• Stripe: payment processing, checkout, transaction security and related regulatory obligations. Stripe also acts as a controller for its own payment, security and compliance purposes. See Stripe’s Privacy Policy.
• Vercel: website and API hosting and delivery. See Vercel’s Privacy Policy.
• Email service providers: delivery and handling of order emails and correspondence. The recipient email, message and relevant order information pass through the provider used for that communication.
• Google Fonts and jsDelivr: delivery of website fonts and the Supabase browser library. Your browser sends the connection information needed to request these files.

4.2 Authorised staff and professional advisers may access information where necessary to support you, administer the business, meet legal duties or handle claims. We may disclose relevant information to authorities where legally required. Social links take you to external platforms with their own privacy practices.

5. Browser storage and external services

5.1 Our account service keeps authentication-session information in your browser’s local storage so you can remain signed in. Signing out removes the active local session; clearing site storage may require you to sign in again.

5.2 Stripe’s hosted checkout can use cookies and similar technologies for payment functionality and fraud prevention, as described in Stripe’s cookie information. Our website also requests fonts and libraries from the services identified in section 4.

5.3 If we introduce optional analytics, advertising or other storage that requires consent, we will describe it and provide the required choice before activating it. Newsletter consent is separate from any such choice.

6. International data transfers

6.1 Our providers operate internationally. Data may be processed outside Bulgaria or the European Economic Area, including in the United States, depending on the service and its subprocessors. The primary database region does not determine every location used for support, delivery or payment processing.

6.2 Where a transfer requires safeguards, the applicable provider arrangements provide mechanisms such as an adequacy decision or the European Commission’s Standard Contractual Clauses. Details are available in the Supabase data-processing terms, Stripe Privacy Center and Vercel data-processing terms. Contact us for information about the safeguards applicable to your data or a copy of the relevant safeguards.

7. Retention

7.1 We retain personal data according to its purpose, applicable legal duties and the following criteria:

• Accounts and licence access: while needed to operate your account and preserve purchased access, including lifetime access to future updates for your purchased plugins. If you request account deletion, we explain which purchase records must remain for legal duties or to support your continuing licence.
• Orders and accounting: for the statutory period applicable to the record and any unresolved claim. Bulgarian accounting registers, financial statements and documents for tax control generally have a ten-year retention period, counted from 1 January following the relevant reporting period; other accounting records may have different periods.
• Newsletter: while your subscription is active. After you unsubscribe, any minimal evidence needed to handle a complaint or honour your opt-out is restricted to that purpose and is not used for further marketing.
• Support, feedback and security: while needed to resolve a request, administer a poll, investigate misuse or establish or defend a claim. Records no longer needed for these purposes are deleted or anonymised, subject to legal duties.
• Download links: access permission expires at the stated time. Expiry does not itself erase the record; download records remain only as needed to administer access, investigate misuse or handle a claim.

7.2 Deletion from active systems may precede removal from backups, which follows the relevant backup rotation. Data retained solely for a legal duty, claim or recovery is not used for unrelated marketing.

8. Your rights and newsletter choices

8.1 You can withdraw newsletter consent at any time by emailing inbox@nullpoint-audio.com with “Unsubscribe” and the subscribed email address. Withdrawal does not affect the lawfulness of earlier processing. Service messages necessary to fulfil a purchase are separate from optional marketing.

8.2 Where the GDPR applies, you may request access, correction, erasure, restriction or portability when the legal conditions are met. You may object to processing based on legitimate interests and to direct marketing. Applicable privacy rights under the law of your place of residence also remain available.

8.3 Send requests to inbox@nullpoint-audio.com. We may request proportionate information to verify your identity. We normally respond within one month. If a lawful extension is necessary, we will explain it within that first month.

8.4 You may complain to the Bulgarian Commission for Personal Data Protection or another competent supervisory authority, including in the country where you live or work.

9. Automated processing

9.1 Our systems automatically match purchases to download access and check payment status. Payment providers may perform fraud and regulatory checks under their own privacy notices. If an automated access or payment result appears incorrect, contact us so we can review the information available to us and help resolve the issue.

10. Changes to this policy

10.1 We will update this policy when our processing changes and show the revised date. Where required, we will provide additional notice or obtain fresh consent before a new use. Releasing another plugin does not itself authorise unrelated uses of your personal data.