Privacy Policy

This Privacy Policy (“Policy”) explains what personal data Pook Audio collects, why we collect it, how it is used, who it is shared with, and how it is protected. We are committed to being transparent about our data practices and to respecting your privacy rights.

“Pook Audio” (also referred to as “we,” “us,” or “our”) is a trading name of Ayal Yishay, sole proprietor, registered and operating under the laws of the State of Israel.

This Policy applies to all personal data collected through the Pook software (audio plugin and standalone application), the workspace and build tools, the backend and API, the website at pookaudio.com, and all related features and services (collectively, the “Service”).

For almost everything described here, Pook Audio is the data controller responsible for your personal data. There is one exception: where we handle the data of people who buy a plugin published by someone using Pook, the publisher is the controller and we act only as their processor. Section 3 explains that arrangement.

By creating an account, installing the Software, or otherwise using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our data practices as described herein, you should not use the Service.

This Policy should be read in conjunction with our Terms of Service, which govern your use of the Service.

We collect different categories of personal data depending on how you interact with the Service. Below is a detailed breakdown of the data we collect, organized by category.

2.1 Account Data (from sign-in)

When you create an account using a third-party identity provider (such as Google or Apple), we receive and store the following information from your identity provider:

• Email address
• Full name
• Profile picture (if available from the identity provider)
• Unique identifier from the identity provider

We do not receive or store your password from any identity provider. Authentication is handled entirely by the third-party provider.

2.2 Account Profile Data (you provide)

Your account carries a few fields you fill in yourself and can change or clear at any time:

• Display name
• Short description of yourself
• Website address
• Links to your social accounts
• An avatar image — taken from your identity provider unless you replace it

All of these are optional. Please do not put sensitive personal information in them; see Section 2.15.

2.3 Machine Data

When you activate the Software on a machine, we collect a set of machine identifiers so that the same machine can be recognized on later checks. These include the hardware addresses of the machine's network interfaces and identifiers derived from its storage and system configuration. They are used solely for activation and for enforcing the machine limits described in our Terms of Service. The Software may also send a name for the machine, so that you can tell your own activations apart when you manage them. We do not scan your machine, and we do not collect information about the files or other content on it. The one exception is the short, fixed list of coding assistants described in Section 2.10 — we record whether each of those is installed, and nothing else about the software on your machine.

2.4 Usage Data

When you use the Service, we collect information about which features of the Service you use and how frequently.

2.5 Technical Data

We automatically collect certain technical information when you use the Service:

• IP address, which reaches our servers with every request
• Browser type and version (when using the website)
• When an activated machine checks in: the name of its operating system as the system reports it (which can include its version), the name of the music software (DAW) it is running in, the plugin format it was loaded as (such as VST3, AU or AAX), and the product and version of the plugin that is running (see Section 2.10)
• When the Software requests a free trial: the name of its operating system, the name of the DAW it is running in, and the plugin format it was loaded as (see Section 2.10)

We do not work out your location ourselves: an approximate location (city or country level) is derived from your IP address only by Google Analytics, and only if you consent to analytics cookies (Section 9).

2.6 Publisher Account Data

If you publish plugins with Pook, we additionally store data about your publisher account:

• The publisher record — your publisher name and handle, support email address, description, website and social links, and the limits of your current plan.
• Team members — the Pook accounts that have access to your publisher account and the role each of them holds.
• Key metadata — the name, identifier and public half of each key issued to your account, along with when it was last used and whether it has been revoked. Secret API keys are stored only as hashes. The private half of a signing key is created inside a managed key service and never leaves it, so we never hold a copy of it.
• Administrative history — a log of administrative actions taken on your publisher account, recording which team member did what and when.

2.7 Plugin Submissions

When you submit a plugin to be released, we store:

• The details you enter — the plugin's name, version and description, whether it is an effect or an instrument, and its categories; the publisher name it goes out under, your website and an optional support email address; your legal name (your own full name, or your company's registered name), the country you are based in, and the name of the person we should write to; the manufacturer code your earlier plugins already use, if you tell us one; and your choice of privacy notice for your customers, with the address of your own policy if you choose that. We keep them exactly as you entered them, as a record of what was asked for.
• The files you upload — the plugin file, which holds your plugin's full source in readable form, and any sound packs that go with it.
• What we make from them — our review notes and report, the plugin as we rebuilt it for review, and, once a release is approved, the signed installers we build from it.
• The status of the submission — when you sent it, and whether it was approved, declined, or sent back for changes.
• Your Giveaways — a record of each Giveaway on your account and how it came to you: bought, with the Paddle transaction ID of the purchase; from a release code, with the code you used; or given by us, with which of our administrators gave it. For each one we also keep its status (unused, used by a submission, closed, or due a refund), and whether its purchase was refunded or charged back and when.

Submitted files are kept in a private storage bucket that is not publicly accessible, and are copied to the machines we use to review and build them. We use them only to review, build, sign, host, support, and defend the release, and we keep them as a record of what was submitted — including submissions we decline. The publisher name, website and support email address you enter are built into the released plugin and its installer, and the publisher name is shown on its download page, so anyone who downloads the plugin can see them. If you give us the address of your own privacy policy, the download page links to it, so anyone who visits that page can see it too. If we stop hosting a released plugin, its download page links to the website you entered instead. Leave the support email address out if you do not want it there.

2.8 Terms Acceptance Records

We record your acceptance of our terms in three places:

• When you submit a plugin — you tick a box to agree to the Publisher Terms and the Terms of Service, and we record with that submission the versions of the Publisher Terms, the Data Processing Addendum and the Terms of Service that were shown to you, the time, the IP address the submission came from, and your browser's user agent (the short text a browser sends to identify its make and version).
• When you sign in to the website — we record which version of our Terms of Service was in force and when you accepted it.
• When you activate a Pook product in the plugin — when you activate with your email address and the code we send you, we record which version of our Terms of Service was in force and when you accepted it.

We keep these records as evidence of what was agreed, and to which version, in case that is ever questioned.

2.9 Download Pages

A plugin released through Pook is downloaded from a page at pookaudio.com/get. When someone opens that page, the website, which is hosted by Vercel, passes their IP address to our server. We use it to limit how many download links one address can request (see Section 2.13), and we use the browser's user agent to offer the right installer for the visitor's computer. For each download we count one click for that version and platform; we store no address or other detail about who downloaded it. For these pages we act as the publisher's processor, not as a controller: the publisher decides how their plugin is delivered, and Section 3 and our Data Processing Addendum apply. The counts are shown to the plugin's publisher.

Downloads of Pook itself from pookaudio.com are our own, and for them we are the controller. They are counted in a similar way. To tell separate visitors apart without keeping a list of them, we store a one-way, keyed hash of the visitor's IP address and user agent, which changes every day, so the record cannot be turned back into an IP address or used to follow one visitor from one day to the next.

2.10 Version Telemetry

When an activated machine checks in, it reports the version of each plugin it is running, the name of the music software (DAW) it is running in, the plugin format it was loaded as (such as VST3, AU or AAX), and the name of its operating system. We keep only the current reported values for each machine and plugin — they are overwritten on each check-in, not accumulated as a history — and they are used to serve update notices and to decide which music software and formats to support. A trial request also sends the operating system, DAW and plugin format, which are used to tell Pook about the new trial and are not stored beyond what the check-in stores.

Each check-in also records that the machine ran that plugin during that hour: one row per machine, product and hour, holding nothing but those three and no detail of what you did. A machine that opens a plugin ten times in one hour writes one row. We use these rows only to count how many machines use each product, and delete them after 400 days.

Pook also records which of the coding assistants it can open are installed on your machine, and which one you opened from Pook. This is a fixed list of the assistants Pook knows how to launch — Pook does not scan your machine for other software, and it records no version numbers or file locations for them. We keep the first answer and the current one per machine, and use it to decide which assistants to support and document.

Pook records one action alongside this: when you copy the setup message instead of opening an assistant, we record that you did and which screen you were on. We do not record the message, what you paste it into, or anything else you copy — only that the button was used, so we can tell an author who took the work elsewhere from one who got stuck.

2.11 Support Reports

When you send us a support report from the plugin or the website, we store the contents of that report — your message, the type of report, your name and email address, and any files you attach, such as screenshots, logs or a plugin file. A report sent from within the plugin also carries technical context about the session it came from: the Pook version, operating system, DAW, sample rate, plugin format, and the plugin the report is about. Attachments are stored in a private bucket that is not publicly accessible.

2.12 Mailing List

If you join our waitlist or subscribe to updates, we store your email address, which lists you asked to be on, and the times you confirmed the subscription and unsubscribed. If you ask us to email you the download link, we store your address on a download-link list until you unsubscribe. We also store how you reached the site when you signed up — the campaign tags on the link you followed, the site that linked you, and the page you landed on — so we know which of our own posts and emails people find us through. We keep the record of an unsubscribe so that we do not email you again after you opt out. You can unsubscribe at any time using the link in any of those emails.

2.13 Abuse-Prevention Records

To stop mail-bombing, passcode guessing, and floods of automated requests, we count recent attempts within short, fixed time windows. Each counter is keyed on the thing being limited — a normalized email address, an IP address, an account or key identifier, or a one-way hash of a machine's identifiers — and holds nothing but that key, a count, and the window it belongs to. Counters are swept within a few days of their window closing.

2.14 Purchases, Licenses & Trials

When you buy Pook, start a free trial of it, or are given a license to it, we store:

• Who the license is for — your email address and, where you bought while signed in, the Pook account it belongs to.
• The order — the store it came from (Paddle) and Paddle's transaction ID for it, and the name and price reference of what you bought as they stood at that moment.
• The license — its type, which products it covers, how many machines it allows, when it was issued, when a trial started and when it ends or ended, whether a subscription was cancelled, and whether the license was disabled and why (for example a refund or a chargeback).
• Activations — which of your machines hold the license, when each was activated and released, and the machine name at that moment (see Section 2.3).
• Trial emails — which of the emails we send near the end of a trial have already gone out, so you are not sent one twice.
• A trial record — when a trial starts, we also store a one-way, keyed hash of your email address together with the product. It holds no readable email address, and it is kept after your other data is deleted, so that the same address cannot start the same free trial again.
• Publishing Plans — if you buy a Publishing Plan, the plan, the amounts paid and the tax on them, the currency, when you were billed, and the Paddle transaction and subscription IDs, linked to your publisher account. We keep this to account for the plan and to report plan revenue to the licensors of our runtime as our license with them requires.

Payment details stay with Paddle (see Section 6). Data about people who buy a plugin from another publisher is covered by Section 3 instead.

2.15 Sensitive Personal Information

Pook Audio does not intentionally collect sensitive personal information, including but not limited to racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, health data, or data concerning sexual orientation. Please do not submit sensitive personal information through the Service, including in support reports, account fields, or plugin metadata. If you do submit such information, you consent to its processing in accordance with this Policy.

When you buy a plugin published by someone using Pook, that publisher decides why your data is collected and is the controller of it; Pook only processes it on their instructions, as their processor. This covers your email address; the machine identifiers described in Section 2.3, together with a name for each machine you activate on, the name of its operating system, and when it was last seen; the version of the publisher's plugin that each of your machines reports when it checks in, with the name of the music software (DAW) it runs in and the plugin format it was loaded as, kept as one record per machine and plugin and overwritten on every check-in, so the publisher can see which version their customers are currently running; a record that a machine ran one of the publisher's plugins during a given hour, one row per machine, product and hour, deleted after 400 days; if the publisher offers a free trial, the trial record described in Section 2.14, a one-way, keyed hash of your email address that is kept after the rest of your data is deleted so the same trial cannot be started twice; the IP address and browser details sent when you open the plugin's download page (Section 2.9); the one-time passcodes that confirm your email address at activation, and the sign-in session a redeemed passcode creates — when it expires and when it was last used, with the credential itself stored only as a hash; your license type and status; your activation records; and the abuse-prevention counters described in Section 2.13. It is used to issue, check, transfer and revoke your license, to show the publisher which version of their plugin your machines are running, and to send the emails those actions require — your activation passcode, and notices that a machine was activated or released or that a license was issued or disabled. The publisher's own privacy policy governs that relationship, and the plugin's activation screen links to it. Terms are in our Data Processing Addendum.

Separately, we count across all publishers, for example how many licenses were issued and how many machines used each product on a given day, to operate, secure and measure the platform. We use only these aggregated, de-identified totals for that, never your individual records.

We use the personal data we collect for the following purposes:

• Provide and operate the Service — authenticate your identity, maintain your account, activate the Software on your machines, review, build, sign and host the plugins you submit for release, deliver updates, and respond to support reports you send us.
• Enforce terms and limits — manage machine activation, enforce the machine limits described in our Terms of Service, apply rate limits, and detect and prevent violations of those terms.
• Improve and develop the Service — analyze usage patterns and trends, conduct internal research, and develop new features. Where possible, we use anonymized or aggregated data that cannot reasonably be used to identify individual Users.
• Communicate with you — send service notifications, account-related alerts, security warnings, subscription and billing updates, and information about changes to our Terms or this Privacy Policy. With your consent, we may also send promotional communications about new features or offers.
• Security and fraud prevention — detect, investigate, and prevent unauthorized access, abuse, fraud, and other harmful or illegal activity. Protect the rights, property, and safety of Pook Audio, our Users, and the public.
• Legal compliance — comply with applicable laws, regulations, legal processes, or enforceable governmental requests. Establish, exercise, or defend legal claims.

If you are located in the European Economic Area (EEA), the United Kingdom (UK), or Israel, we process your personal data on the following legal bases under the General Data Protection Regulation (GDPR), UK GDPR, and the Israeli Privacy Protection Law 5741-1981, as applicable:

• Performance of a contract — processing necessary to provide the Service to you, including account creation and authentication, machine activation, building and signing the plugins you submit, issuing and checking licenses, and operating a publisher account. This is the primary legal basis for most of our data processing.
• Legitimate interests — processing necessary for our legitimate business interests, provided those interests are not overridden by your rights and freedoms. This includes improving and developing the Service using aggregated analytics, detecting fraud and abuse, ensuring network and information security, and internal administrative purposes. It also covers keeping records we may need to establish, exercise, or defend legal claims — the terms acceptance records in Section 2.8 and the plugin submissions in Section 2.7 — counting downloads of Pook itself as described in Section 2.9, keeping the trial record in Section 2.14 so that one free trial cannot be claimed again and again, counting how many machines use each product (Section 2.10), and keeping a buyer's license working after the publisher who sold it has left Pook, as described in Section 8. We carefully balance our interests against your privacy in each case.
• Legal obligation — processing necessary to comply with legal or regulatory requirements to which Pook Audio is subject, including tax and accounting obligations, responding to lawful requests from public authorities, and data retention requirements.
• Consent — where required by applicable law, we rely on your consent for specific processing activities, including sending promotional or marketing communications, setting non-essential cookies, and sharing data with third parties for purposes not covered by the other legal bases. You may withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

If we intend to use your personal data for a purpose not described in this Policy, we will notify you and, where required by law, obtain your consent before doing so.

We share your personal data with the following service providers, solely to the extent necessary for the purposes described below. We require all third-party providers to respect the security and confidentiality of your personal data and to process it only in accordance with our instructions and applicable data protection laws.

• Google — Cloud Run (application hosting), Cloud SQL (database), Cloud Storage (file storage), Cloud KMS (key management and signing), Firebase Authentication (sign-in), and Google Analytics (website analytics).
• Resend — transactional email, such as sign-in links, activation codes, and account notifications.
• Paddle — Paddle.com Market Limited is our merchant of record for purchases from Pook, and handles payment processing, billing, invoicing, tax calculation, and refunds. Pook Audio does not directly process, store, or have access to your payment card information, bank account details, or other financial data. Paddle's collection and use of your payment data is governed by Paddle's Privacy Policy.
• Vercel — hosting for the website at pookaudio.com, including the download pages described in Section 2.9. Vercel receives the IP address and browser details of everyone who visits the website.
• Anthropic — we use Claude, Anthropic's AI model, to help us read and check plugins submitted for release, so the submitted files and the details entered with them, described in Section 2.7, are processed by Anthropic for that purpose.
• Cloudflare R2 — storage and delivery of plugin downloads, including the installers of plugins released through Pook. Cloudflare receives the IP address of each download it serves.

If you publish plugins with Pook, building and releasing them also passes some of your publisher details to the following:

• GitHub — the record of every released plugin is kept in our private source repository, hosted by GitHub. It holds your publisher name, website and support email address, and the names of your plugins.
• Apple — every Mac installer we build is sent to Apple for notarization, Apple's malware check. The installer contains your plugin and its license text, which carry your publisher name, website and support email address.
• PACE Anti-Piracy — the AAX version of your plugin, which runs in Avid Pro Tools and carries your publisher and plugin names, is signed with PACE's signing tools and account. A plugin's own AAX signing setup is requested from PACE and Avid under the plugin's name.
• Raw Material Software Limited — the maker of the JUCE framework that Pook is built on. Where our license with them requires it, we may report your publisher name, the names of the plugins you release, your Publishing Plan and what was paid for it, as the Publisher Terms say.

We use Google Analytics to see how visitors use pookaudio.com. It loads from the root layout that wraps every page of the site, including sign-in and account pages, but it does not send anything to Google until you consent through our cookie banner — see Section 9 (Cookies & Tracking Technologies). Once you consent, if you are signed in, we also attach your account's internal ID to your analytics activity, so we can tell how signed-in Users use the Service.

Pook Audio does not sell your personal data to third parties. We do not share your personal data with third parties for their own direct marketing purposes.

We may also disclose your personal data if required to do so by law, regulation, legal process, or governmental request, or where we believe in good faith that disclosure is necessary to protect our rights, your safety, the safety of others, investigate fraud, or respond to a government request.

In the event of a merger, acquisition, reorganization, bankruptcy, or other similar event, your personal data may be transferred to a successor entity as part of that transaction. We will notify you of any such change and the choices you may have regarding your personal data.

Pook Audio is based in Israel. Your personal data is stored and processed on cloud infrastructure primarily located in the United States, and may also be accessed from Israel and other countries where our service providers operate. These countries may have different data protection laws than your country of residence.

Israel has been recognized by the European Commission as providing an adequate level of data protection. For transfers of personal data from the EEA or UK to countries that have not received an adequacy decision (such as the United States), we rely on appropriate safeguards, including Standard Contractual Clauses (SCCs) approved by the European Commission and/or the UK Information Commissioner's Office (ICO), or other legally recognized transfer mechanisms.

If you have questions about the safeguards we use for international data transfers, please contact us at support@pookaudio.com.

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, as described in this Policy, or as required by applicable law. The specific retention periods depend on the nature of the data and the purpose of processing:

• Account data — retained until you ask us to delete your account. We handle deletion by hand, on request: email support@pookaudio.com and we will delete your account data, your machine identifiers and your support reports within 30 days, except where retention is required by law or another item below says the data is kept for longer. The trial record described below is one such item: it is not deleted with your account. If your account holds a perpetual license, we keep only your email address and the license record, so that the license keeps working; our lawful basis for keeping them is the performance of our contract with you and our legitimate interest in honoring the licenses we issue.
• Publisher account data — the publisher record, its team members, and key metadata are retained for as long as the publisher account exists. Records of administrative actions are retained afterwards where they are needed as an audit trail or to resolve a dispute.
• Plugin submissions — the details, files, review report and rebuilt plugin of every submission, including declined ones, are kept as a record of what was submitted. For a released plugin we keep them, and the installers built from it, for as long as the release is available and afterwards for as long as we may need them to support customers who already have it or to establish, exercise, or defend legal claims. For a submission that was never released we keep them for as long as we may need them for those claims. You may ask us to delete a submission; we will do so unless we still need it for one of these reasons.
• Terms acceptance records — kept with the account or submission they belong to, and afterwards for as long as we may need them to show what was agreed, including after the account is deleted. This is longer than the 90 days for technical logs below, because the record is evidence.
• Download counts — the per-version click counts for a released plugin store no personal data and are kept with the release. The daily hashed records for downloads of Pook itself are kept as download statistics with no set deletion date; they cannot be turned back into an IP address.
• Trial records — the keyed hash of an email address and the product, described in Section 2.14, is kept with no set deletion date, including after the account or customer record it came from is deleted, because its only job is to stop the same free trial being started again.
• Hourly activity records — the rows recording that a machine ran a product during a given hour (Section 2.10) are deleted 400 days after that hour.
• Coding assistant records — the record of which coding assistants a machine has and which one was opened (Section 2.10) is kept for as long as that machine's record exists, and is deleted with it.
• Purchase and transaction records — retained for as long as required for accounting, tax, and legal compliance purposes (typically 7 years under Israeli tax law).
• Support reports — the report and its attachments are retained so that we can resolve the issue and investigate related reports. We delete them on request, within 30 days, as described under Account data above.
• Mailing list — retained until you unsubscribe. After that we keep only the record that you unsubscribed, so that we do not email you again.
• Version telemetry — only the current reported version, DAW and plugin format per machine and plugin are stored; each check-in overwrites the previous values, and the record is deleted with the machine it belongs to.
• Technical logs — IP addresses, access logs, and similar technical data are retained for up to 90 days for security and debugging purposes, after which they are deleted or anonymized.
• Abuse-prevention counters — kept only as long as the time window they belong to is relevant, and swept within a few days of that window closing.
• Machine identifiers — retained until you ask us to delete them or your account, and then deleted within 30 days, as described under Account data above.
• Data we process for publishers — retained in accordance with the publisher's instructions for as long as their account is active, and returned or deleted once that processing ends, as described in Section 9 of our Data Processing Addendum, except that trial records (see Section 3 above) are kept, as that Section 9 also says. One other record survives that: if a publisher's account closes, we keep the minimum needed to keep your existing license working — your email address, the product, and your license status — and from that point we hold it as an independent controller rather than as the publisher's processor, as described in the Addendum's Section 10. Our lawful basis for keeping it is legitimate interests: yours, in continuing to use a plugin you paid for, and ours, in honoring the licenses issued through Pook. We keep it for as long as the license can still be used, and you may object to it under Section 10 below.

Apart from the fixed periods stated above, deletion is not automatic. When you ask us to delete personal data and there is no legal requirement or other reason in this Section to keep it, we securely delete or irreversibly anonymize it within 30 days of your request.

9.1 What Are Cookies

Cookies are small text files placed on your device by websites you visit. They are widely used to make websites work efficiently, provide reporting information, and assist with personalization. Cookies may be “session” cookies (deleted when you close your browser) or “persistent” cookies (remaining on your device for a set period or until you delete them).

9.2 Cookies We Use on pookaudio.com

The website uses the following categories of cookies:

• Essential cookies — required for the website to function correctly. These include cookies for authentication, session management, and security. You cannot opt out of essential cookies as they are strictly necessary for the website to operate.
• Analytics and performance cookies — we use Google Analytics to collect information about how visitors use the website, including which pages are visited most frequently, how long visitors spend on pages, and how they arrived at the site. Google Analytics loads from the root layout that wraps every page of pookaudio.com — including sign-in, activation, and account pages — but no analytics cookie is set and no data reaches Google until you provide consent through our cookie banner. If you are signed in when you consent, we attach your account's internal ID to your analytics activity, so it is tied to your account rather than fully anonymous; it is never tied to your email address, name, or other profile data.

9.3 The Pook Plugin

The Pook plugin communicates with our servers for authentication, activation and license checks, update notices, and support reports. These communications use standard HTTPS requests and authentication tokens — no tracking cookies, advertising pixels, or third-party tracking technologies are used within the plugin itself.

9.4 Managing Cookies

You can control and manage cookies through your browser settings. Most browsers allow you to refuse cookies, delete existing cookies, or be notified before a cookie is set. Please note that disabling essential cookies may affect the functionality of the website.

For more information about cookies and how to manage them, visit:

• www.allaboutcookies.org
• www.youronlinechoices.eu (for EU residents)

9.5 Do Not Track

Some browsers transmit “Do Not Track” (DNT) signals to the websites you visit. There is currently no universally accepted standard for how websites should respond to DNT signals. At this time, pookaudio.com does not respond to DNT signals, but we limit our use of tracking technologies as described in this section.

Depending on your location and applicable law, you may have the following rights with respect to your personal data:

• Right of access — you have the right to request a copy of the personal data we hold about you, together with information about how we process it.
• Right to rectification — you have the right to request that we correct any inaccurate or incomplete personal data we hold about you.
• Right to erasure (“right to be forgotten”) — you have the right to request that we delete your personal data, subject to certain legal exceptions (for example, where we are required to retain data for legal or accounting purposes). We handle each request by hand and complete it within 30 days, as described in Section 8.
• Right to data portability — you have the right to request your personal data in a structured, commonly used, machine-readable format. This includes your account information, your publisher account details, and your purchase, license and activation records. The source of a plugin you author is held on your own machine and is already in your possession.
• Right to restrict processing — you have the right to request that we restrict the processing of your personal data in certain circumstances, such as when you contest the accuracy of the data or object to our processing.
• Right to object — you have the right to object to our processing of your personal data where we rely on legitimate interests as a legal basis, including objecting to the use of your data for Service improvement and analytics.
• Right to withdraw consent — where we rely on your consent to process personal data, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent prior to its withdrawal.
• Right to lodge a complaint — you have the right to lodge a complaint with your local data protection authority if you believe that our processing of your personal data violates applicable law.

How to Exercise Your Rights

To exercise any of these rights, please contact us at support@pookaudio.com. We will respond to your request within 30 days (or within the timeframe required by applicable law). We may need to verify your identity before processing your request. If your request is complex or you have made multiple requests, we may extend the response period by an additional 60 days, in which case we will notify you of the extension and the reasons for it.

If your request concerns data we process on a publisher's behalf, as described in Section 3, please address it to that publisher. We will forward any such request we receive and assist the publisher in answering it.

These rights are provided under the General Data Protection Regulation (GDPR) for EU/EEA residents, the UK GDPR and UK Data Protection Act 2018 for UK residents, the Israeli Privacy Protection Law 5741-1981 for Israeli residents, and similar data protection regulations worldwide. Some rights may be limited where we have a legal obligation to retain data, a legitimate overriding interest, or where the exercise of rights would adversely affect the rights and freedoms of others.

You also have the right to delete your account at any time. To do so, email support@pookaudio.com from the address on your account. We delete your account data, machine identifiers and support reports by hand within 30 days of your request, or within the extended period described above where a request is complex. If your account holds a perpetual license, we keep only your email address and the license record so that the license keeps working, as described in Section 8 (Data Retention).

Pook Audio does not make decisions about you based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. We do not profile you for advertising, and we do not build behavioral profiles of you.

Some checks are automated because they have to be: activation is checked against your machine limit, licenses are validated, rate limits are applied, and suspected fraud or abuse is flagged. If an automated check blocks something you believe it should not have blocked, contact us at support@pookaudio.com and a person will review it.

Pook Audio implements and maintains appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, destruction, or accidental loss. These measures include but are not limited to:

• Encrypted connections (HTTPS/TLS) for all data transmitted between your device and our servers.
• Encryption of personal data at rest on our cloud infrastructure.
• Access controls and authentication mechanisms to limit access to personal data to authorized personnel only.
• Secure credential storage — authentication tokens on your device are stored using the operating system's native credential storage (e.g., macOS Keychain, Windows Credential Manager).
• Regular security reviews and updates to our infrastructure and software.

Despite our efforts, no method of transmission over the internet or method of electronic storage is completely secure. We cannot guarantee absolute security of your personal data. In the event of a data breach that is likely to result in a high risk to your rights and freedoms, we will notify affected Users and the relevant data protection authorities in accordance with applicable law, without undue delay.

The Service is not directed at, intended for, or designed to be used by individuals under the age of 18. Pook Audio does not knowingly collect, solicit, or process personal data from children under the age of 18.

If we become aware that we have collected personal data from a child under 18 without verifiable parental consent, we will take steps to delete such data promptly. If you believe that a child under 18 has provided personal data to us, please contact us immediately at support@pookaudio.com so that we can take appropriate action.

Pook Audio may update this Privacy Policy from time to time to reflect changes in our data practices, legal requirements, or operational needs. When we make changes, we will update the “Last updated” date at the top of this page and publish the revised Policy at pookaudio.com/legal/privacy.

For material changes that significantly affect how we collect, use, or share your personal data, we will provide additional notice via email (to the address associated with your account) or through a prominent in-app notification at least 30 days before the changes take effect.

Your continued use of the Service after any changes to this Policy constitutes your acceptance of the updated Policy. If you do not agree with the revised Policy, you should stop using the Service and delete your account.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your personal data.

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), provides you with specific rights regarding your personal information. This section supplements the rest of this Privacy Policy with information required under California law.

15.1 Categories of Personal Information

In the preceding 12 months, we have collected the following categories of personal information as defined by the CCPA:

• Identifiers (name, email address, unique account ID, machine identifier, IP address)
• Internet or other electronic network activity information (browsing history on our website, interaction with the Service, feature usage)
• Geolocation data (approximate location derived from IP address)
• Commercial information (purchase and transaction history, license and activation records, plan status)
• Professional or employment-related information (only where you voluntarily provide it, such as details you add to your profile or publisher contact details)

The sources, purposes, and third-party disclosures for each category are described in Sections 2, 4, and 6 of this Privacy Policy.

15.2 Your California Rights

As a California resident, you have the right to:

• Right to know — request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources, the business purposes for collection, and the categories of third parties with whom we share your personal information.
• Right to delete — request that we delete the personal information we have collected about you, subject to certain exceptions permitted by law (such as data retained for legal or accounting purposes).
• Right to correct — request that we correct inaccurate personal information we maintain about you.
• Right to opt-out of sale or sharing — Pook Audio does not sell your personal information and does not share your personal information for cross-context behavioral advertising purposes. Therefore, there is no need to opt out.
• Right to non-discrimination — we will not discriminate against you for exercising any of your CCPA rights. We will not deny you the Service, charge you different prices, provide a different quality of service, or retaliate against you for exercising your rights.

15.3 Exercising Your Rights

To exercise your California privacy rights, please contact us at support@pookaudio.com. We will verify your identity before processing your request by matching information you provide with information we have on file. We will respond to verifiable consumer requests within 45 days. If we need more time (up to an additional 45 days), we will notify you of the reason and the extension period in writing.

You may designate an authorized agent to submit requests on your behalf. If you use an authorized agent, we may require proof that you have authorized the agent to act on your behalf and may still require you to verify your identity directly with us.

If you have any questions, concerns, or requests regarding this Privacy Policy, your personal data, or our data practices, please contact us at:

Email: support@pookaudio.com

Data Controller:
Pook Audio (a trading name of Ayal Yishay)
Israel

We are committed to resolving any complaints about your privacy and our collection or use of your personal data. If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority. For Israeli residents, this is the Israeli Privacy Protection Authority (PPA). For EU/EEA residents, you may contact the supervisory authority in your country of residence.