Who is responsible
Fractal Sounds is responsible for personal information under its control. Francis Bousquet is the Privacy Officer. Questions, access requests, corrections and complaints can be sent to francis@fractalsounds.ca.
Information we collect
We may collect your name, email address, billing address, country, order history, purchased products, licenses, download and activation records, account information, support messages, form submissions and the technical information needed to secure the service. Passwords are stored as cryptographic hashes. Fractal Sounds does not store your complete payment card number.
Free download requests can include the email address you submit, the requested pack, consent records and an irreversible hash derived from the request IP address for abuse prevention. We also preserve relevant historical Squarespace order records so previous customers can access purchases through the Fractal Sounds Portal.
Why we use it
We use personal information to complete purchases, calculate applicable taxes, deliver files, create and manage licenses, provide Portal access, send transactional messages, answer support requests, prevent fraud, maintain security, meet accounting obligations and improve the reliability of our products and services.
Promotional messages are separate from necessary order, security, license and download communications. When marketing consent is required, you can refuse it or withdraw it without losing access to a product you already own.
Service providers and transfers
We use specialized providers to operate the store: Stripe for checkout and payment processing, Render for application and database hosting, Cloudflare R2 for protected file storage, Resend for transactional email, and the Fractal Sounds Portal licensing service for plugin licenses and activations. Some demos or learning material can also be delivered through Google or YouTube. These providers process only the information needed for their role and may process it outside Quebec or Canada under their own safeguards and terms.
We do not sell personal information. We may disclose information when required by law, to protect the service against fraud or abuse, or as part of a business reorganization where appropriate confidentiality safeguards apply.
Cookies and analytics
A separate public-page counter saves only combined daily totals for up to 13 months. Its fixed request contains no page URL, visitor identifier, cookie or referrer; no individual events, IP addresses or browser fingerprints are stored in that counter. It is not sent to Google or joined to customer or order records. It may run before an optional analytics choice, but respects browser privacy signals and explicit refusals. You can disable it, or allow only these anonymous totals, through “Cookie choices.” Ordinary hosting and security processing is separate. See the Cookie Policy for the scope, limitations and controls.
The Portal uses a strictly necessary session cookie so signed-in customers can securely access their products. Stripe may set cookies on its hosted checkout. The standalone storefront loads Google Analytics only after an explicit analytics choice. When allowed, it measures page and commerce events without sending email addresses, payment details or form contents. Consented source attribution may be kept in your browser for up to 30 days and associated with a confirmed purchase. Advertising measurement requires a separate, optional choice; Google personalized advertising remains disabled. Confirmed, consented purchase events may also be sent from our server using Analytics identifiers. The Cookie Policy explains how to allow or withdraw these choices without affecting your ability to buy or access products.
Retention and safeguards
Meta (Instagram/Facebook) measurement requires its own optional consent in addition to analytics. When enabled and allowed, public product visits, browser/ad identifiers and browser user agent may be shared with Meta. Confirmed purchase details can be shared through our server when that connection is configured. We do not supply names, emails, payment details or private checkout URLs, and we disable automatic form matching in this integration. Meta may use these signals for advertising measurement and optimization. Browser click context lasts up to 30 days; the Cookie Policy explains withdrawal and the limits for checkout events already submitted. No purchase is inferred from opening a confirmation page.
Reddit advertising measurement, when enabled, requires its own optional consent in Cookie choices. With analytics and Reddit consent, a Reddit click ID may be retained for up to 30 days and sent with a confirmed purchase, products, value, currency, billing country and opaque conversion ID. We request Reddit Limited Data Use. We do not send checkout contact details or payment credentials to Reddit. The Cookie Policy describes withdrawal and its limits for purchases already queued or sent.
We retain information only as long as it is reasonably needed for the purposes above, including access to owned products, accounting, tax, dispute and security obligations. Retention can differ by record type. Access controls, hashed credentials, signed download links, encrypted connections and restricted service credentials are used to protect information. No system can guarantee absolute security.
Your choices and rights
Subject to applicable law, you can ask whether we hold personal information about you, request access or a correction, withdraw optional consent, unsubscribe from promotional email, or raise a complaint. We may need to verify your identity before completing a request. Certain transaction, licensing or security records may need to be retained when required by law or necessary to preserve your purchased access.
Changes to this policy
Material changes will be posted here with a new update date. When appropriate, affected customers will also be notified directly.