Data Processing Addendum

This Data Processing Addendum (“Addendum”) governs the personal data that Pook Audio processes about your customers — the people who buy, download or activate a plugin you release through the platform. It forms part of the Publisher Terms and is accepted when you accept those terms. No separate signature is required.

“Pook Audio” is a trading name of Ayal Yishay, sole proprietor, registered and operating under the laws of the State of Israel. In this Addendum, “publisher,” “you” and “your” mean the account that releases a plugin, and “customer data” means the personal data described in Section 2.

In respect of customer data, you are the controller and Pook Audio is your processor, within the meaning of Article 28 of the General Data Protection Regulation (GDPR), the UK GDPR, and the Israeli Privacy Protection Law 5741-1981, as each applies. You decide why customer data is collected and for what purpose; Pook Audio processes it only on your behalf.

For everything else — your own account, your publisher account, and the data of people who buy from Pook Audio directly — Pook Audio is the controller, and our Privacy Policy applies instead.

Customer data is limited to what the purposes in Section 3 require:

• The customer’s email address.
• A machine identifier for each machine the customer activates on, together with a name for that machine, the name of its operating system, and when it was last seen.
• The version of each of your plugins that a machine reports when it checks in, with the name of the music software (DAW) it runs in and the plugin format it was loaded as — one record per machine and product, overwritten on every check-in, so it is what is currently running rather than a history.
• A record that a machine ran one of your plugins during a given hour: one row per machine, product and hour, holding nothing else, deleted 400 days after that hour.
• If you offer a free trial, a trial record for each trial started: a one-way, keyed hash of the customer’s email address, salted with your publisher identity, together with the product. It holds no readable email address and exists only to stop the same address from starting the same trial twice.
• One-time passcode records used to confirm the customer’s email address at activation.
• The session record a redeemed passcode mints — the credential later actions authenticate against, when it expires, and when it was last used. The credential itself is stored only as a hash.
• The license type and its status.
• Activation records — which machines hold an activation, when it was taken and when it was released, and the machine name as it stood at that moment.
• The IP address and browser details sent when a customer opens your plugin’s download link, used to pick the right installer for their system and to limit abuse. A download is counted per version and platform, with no customer address stored alongside the count.
• Abuse-prevention counters for requests to send a passcode, wrong passcode guesses, activations, or requests for a download link, keyed on a normalized email address, an IP address, or a one-way hash of a machine’s identifiers. Each holds nothing but that key, a count and the window it belongs to, and counters are swept within a few days of their window closing.

Pook Audio does not scan a customer's machine and does not collect information about the files, software or other content on it. Payment card and bank details are never received: you sell to your customers yourself, and Pook Audio issues licenses rather than invoices.

Processing is limited to issuing, checking, transferring and revoking licenses for the plugins you release, and to sending the emails those actions require — an activation passcode, a notice that a machine has been activated or released, and a notice that a license has been issued or disabled. It also covers delivering your plugin's installers through its download link, showing you how often each version has been downloaded, showing you, in the publisher console, which version of each of your plugins your customers are currently running, counting how many machines use each of your plugins, understanding which music software (DAW) and plugin formats your customers use so that Pook Audio can support them, and, if you offer a free trial, making sure each address can start it only once.

Pook Audio acts only on your documented instructions. This Addendum, the Publisher Terms, and the settings and actions available to you in the publisher console together constitute those instructions.

Customer data is not used to train models, to build profiles, or for marketing. It is not sold, and it is not used for any purpose of Pook Audio's own, with one exception: Pook Audio may compute aggregated, de-identified counts across all publishers, such as how many licenses were issued or how many machines used a product on a given day, and use those counts, never individual records, to operate, secure and measure the platform. If Pook Audio is required by law to process customer data beyond your instructions, you will be informed before that processing takes place, unless the law forbids telling you.

Anyone authorised to process customer data is bound by an obligation of confidentiality. Access is limited to what operating the platform actually requires.

Pook Audio maintains appropriate technical and organisational measures to protect customer data, including encryption in transit and encryption at rest, access controls and authentication on the systems that hold it, and regular review of that infrastructure. The Security section of the Privacy Policy describes the same measures in more detail.

If a personal data breach affects your customers' data, Pook Audio will notify you without undue delay and give you the information you need in order to meet your own notification obligations. Pook Audio will also assist you, taking into account the nature of the processing and the information available to it, with your obligations to keep the processing secure and to carry out any assessment or consultation the law requires of you.

You authorise Pook Audio to engage the following subprocessors to process customer data:

• Google — Cloud Run (application hosting), Cloud SQL (database), Cloud Storage (file storage), and Cloud KMS (key management and signing).
• Resend — delivery of the emails that licensing actions require, such as activation passcodes and license notices.
• Cloudflare R2 — storage and delivery of plugin downloads.
• Vercel — hosting of the website, including the download page your customers open to get your plugin, which receives their IP address and browser details.

Each subprocessor is bound by data protection obligations no less protective than those in this Addendum, and Pook Audio remains responsible to you for their performance.

Pook Audio will give you notice before adding a new subprocessor or replacing an existing one. You may object to the change on reasonable data protection grounds. If an objection cannot be resolved, you remain free to cancel your Publishing Plan as described in the Publisher Terms; Section 10 of this Addendum then applies to your customers' licenses.

Customer data is stored and processed on cloud infrastructure primarily located in the United States, operated by the subprocessors listed in Section 5. It may also be accessed from Israel, where Pook Audio is based, and from other countries in which those subprocessors operate.

Where customer data leaves the European Economic Area or the United Kingdom to a country that has not received an adequacy decision, the transfer is made under the European Commission's standard contractual clauses, the equivalent clauses approved by the UK Information Commissioner's Office, or another legally recognised transfer mechanism.

Your customers exercise their rights against you, as the controller of their data. Pook Audio assists you in responding to those requests, taking into account the nature of the processing and by appropriate technical and organisational measures.

If a customer sends a request directly to Pook Audio, it is forwarded to you rather than answered. Pook Audio does not decide the outcome of a request about customer data.

Pook Audio makes available to you the information necessary to demonstrate compliance with Article 28 of the GDPR and with this Addendum, and permits and contributes to audits and inspections carried out by you or by an auditor you mandate.

Pook Audio first meets an audit request by providing written answers and documentation, including its subprocessors' security certifications and audit reports. An inspection takes place only if that information is not enough to demonstrate compliance, or if a supervisory authority requires it.

An audit takes place on reasonable prior written notice, during normal business hours, and in a manner that does not unreasonably disrupt Pook Audio's operations. Anyone conducting it is bound by confidentiality as to everything they see, and you bear its cost.

An audit is carried out no more than once in any twelve-month period, unless a personal data breach has affected your customers' data or a supervisory authority requires an audit of you.

On termination of the Publisher Terms, customer data is deleted or returned to you, at your choice, once processing on your behalf has ended.

Pook Audio may retain customer data where the law requires it to, and retains the record described in Section 10. If you offered a free trial, the trial records described in Section 2 are also kept, both when a customer's other data is deleted and after termination, and are used only to stop the same address starting the same trial again. Anything retained remains protected by this Addendum for as long as it is held.

There is one exception to the previous section, and it exists so that ending a plan never takes anything away from the people who already bought your plugin:

Customers keep what they bought. When a publisher's plan ends or their account closes, Pook retains the minimum record needed to keep existing licenses working — the customer's email address, the product, and the license status — and from that point acts as an independent controller of that record rather than as the publisher's processor. The basis is the customers' own interest in continuing to use software they obtained. Apart from the trial records described in Section 9, nothing else is retained, and the record is never used for any other purpose.

This is the data-protection side of what the Publisher Terms promise when a plan ends: within a reasonable time, each existing customer is given a way to keep using the plugins they licensed indefinitely. The retained record is what makes that possible, and it is used only for that.

As the controller of your customers' data, you are responsible for the following.

A privacy policy of your own. You must maintain a privacy policy covering your relationship with your customers, and keep it accurate and reachable. If you do not have one, you may adopt the standard customer notice Pook Audio provides, which then becomes yours.

A lawful basis. You must have a lawful basis for the customer data you collect and for instructing Pook Audio to process it.

The notices the law requires. You must give your customers the information their local data protection law entitles them to, including who you are, what is collected and why, and how they exercise their rights.

Customer-facing surfaces — including the plugin's activation screen — link to your privacy policy, never to Pook Audio's.

Pook Audio's liability arising out of or in connection with this Addendum, however it arises, is subject to the Limitation of Liability section of the Terms of Service, and counts toward the same overall cap as its liability under the Publisher Terms and the Terms of Service. The disclaimers of warranty in the Terms of Service apply here in full.

Nothing in this section limits any liability that cannot be limited under applicable data protection law, including liability to your customers as data subjects.

If you have any questions about this Addendum, please contact us at:

support@pookaudio.com

Pook Audio (a trading name of Ayal Yishay)
Israel