Legal
Privacy statement
Last updated 5 October 2026
Short version: this website sets no cookies and does no tracking. Our software processes your audio on your own computer and never uploads it. We only handle the personal data we need to run this website, to sell and activate licences, and to answer you when you write to us.
1. Who is responsible
The controller for the processing described here is:
Evolving Audio
Kraijenhoffstraat 137a
1018 RG Amsterdam
The Netherlands
hello@evolving-audio.com
For any question about your data, or to use your rights, write to that address. We have not appointed a data protection officer, as the law does not require one for a business of our size and kind.
2. Visiting this website
What: when you open a page, the server receives your IP address, the date and time, the page requested, the referring page, and your browser and operating system.
Why and legal basis: to deliver the website and to keep it secure and available. This is our legitimate interest (art. 6(1)(f) GDPR).
Who receives it: the website is hosted by Vercel Inc. (USA), which processes this data on our behalf under a data processing agreement.
How long: server logs are kept by the host for a short period and then deleted. We do not combine them with other data about you.
3. Cookies and tracking
This website sets no cookies and uses no analytics, advertising or social media trackers, so no cookie banner is needed. Fonts and scripts are served from our own domain.
When sales are open, the checkout is provided by Polar and opens in a frame on our page. It is loaded only when you click a buy button. Polar may then set cookies that are strictly necessary for the payment.
4. Buying a licence
What: name, email address, billing address, country, payment details, and what you bought.
Why and legal basis: to conclude and perform the purchase and deliver your licence key (art. 6(1)(b) GDPR), and to meet legal obligations on invoicing and tax (art. 6(1)(c) GDPR).
Who receives it: the sale is carried out by Polar Software, Inc. (USA) as reseller and merchant of record. Polar is a controller of its own for the payment and invoice data, and its privacy policy applies to that. Payment details go to Polar and its payment processor only; we never see your card number. We receive your name, email address, country and order details from Polar so that we can provide support and manage licences.
How long: we keep order records for seven years, the retention period Dutch tax law sets for business records.
You are not obliged to give this data, but without it a purchase is not possible.
5. Licence activation in our software
What: when you activate, check or deactivate a licence, the software sends your licence key and activation ID, your computer's name, a device ID, your operating system and the software version to our licence server at api.build.westharbour-audio.com. The server passes the request on to Polar, which manages the licence keys.
Why and legal basis: to check that a licence is valid and to limit it to the permitted number of computers. This is necessary to perform the licence agreement (art. 6(1)(b) GDPR).
How long: our licence server does not keep its own copy of this data. Polar keeps the activation for as long as the licence is active on that computer.
Offline activation: for a computer without internet you can use the form at evolving-audio.com/offline. You enter your licence key and the request code the software shows; the code identifies that computer and the product. The form sends both to our licence server, which performs the same activation as described above and returns a licence file signed for that computer. The website itself stores nothing you enter.
6. Demo versions
What: this applies to demos that run for a limited time, such as Skeleton's. When you start such a demo, the software sends a hashed device ID to our licence server. The hash is calculated on your computer; the server cannot turn it back into a hardware ID. The server stores it with the date the demo started and the number of demo exports used.
Why and legal basis: to run the demo period and to prevent it from being restarted. This is our legitimate interest (art. 6(1)(f) GDPR). No name, email address or audio is involved.
Who receives it: the entry is stored in a database operated for us by Upstash, Inc. through Vercel.
How long: for as long as it is needed to prevent a demo from being restarted on the same computer.
7. Updates and new templates
Our software checks updates.westharbour-audio.com for new versions. The request contains the software version and your operating system version; the host (Vercel) sees your IP address as with any web request. The legal basis is our legitimate interest in keeping the software secure and working (art. 6(1)(f) GDPR).
New templates: Skeleton also asks our licence server at api.build.westharbour-audio.com at each start whether new templates (genres, styles, reference templates) are available. To show that it may receive them, it sends the signed licence confirmation the server issued when you activated, which contains your licence key, the name and email address of the licence holder and the device ID; a demo sends its signed demo confirmation with the hashed device ID instead. The server checks the signature, answers, and stores nothing from this request. The legal basis is the performance of the licence agreement (art. 6(1)(b) GDPR) and, for demos, our legitimate interest in giving templates only to users of the software (art. 6(1)(f) GDPR).
8. Your audio and projects
Loops, stems and projects are analysed, arranged and rendered on your own computer. They are never sent to us or to anyone else.
9. Writing to us
If you email us, we process your email address and whatever you tell us, in order to answer you (art. 6(1)(b) or (f) GDPR, depending on what you ask). We keep the conversation for as long as it takes to deal with your request and for a reasonable time afterwards in case of follow-up questions, unless the law requires us to keep it longer.
10. Recipients outside the EU
Vercel, Polar and Upstash are companies in the United States, so personal data can be processed there. These transfers are covered by the EU–US Data Privacy Framework where the provider is certified under it, and otherwise by the European Commission's standard contractual clauses. You can ask us for more information about these safeguards.
We do not sell personal data, and we share it with others only as described in this statement or where the law obliges us to.
11. No automated decisions
We do not use your personal data for profiling or for decisions made solely by automated means.
12. Your rights
Under the GDPR you have the right to:
- see which personal data we hold about you and receive a copy (access);
- have incorrect data corrected;
- have data erased when we no longer need it or have no ground to keep it;
- have processing restricted in certain cases;
- object to processing that is based on our legitimate interest;
- receive the data you gave us in a common, machine-readable format (portability);
- withdraw a consent you have given, at any time.
Write to hello@evolving-audio.com. We answer within one month. We may ask you to show who you are, so that we do not hand your data to someone else. Using these rights costs nothing.
13. Complaints
If you think we are handling your data wrongly, please tell us first so we can put it right. You also have the right to lodge a complaint with the Dutch data protection authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or with the authority in the EU country where you live.
14. Security
This website and our servers are reached over encrypted connections (HTTPS) only. Licence keys are stored in your operating system's own secure store (Keychain on macOS, Credential Manager on Windows).
15. Changes
We update this statement when our software or the way we work changes. The date at the top shows the latest version.