Who we are
Talea Audio Ltd, established in England, provides audio plugins, Talea Manager and the Talea website and account services. We are responsible for how Talea uses your personal data.
Our postal address is 124 City Road, London, EC1V 2NX, United Kingdom. For privacy questions or requests, email privacy@talea.audio. For product support, email support@talea.audio.
This notice explains our use of personal data. Reading it does not give permission for marketing or optional analytics.
The information we use
The information involved depends on which features you use:
- Accounts and sign-in: your email address, names, optional profile information, time zone, email-verification status, sign-in history and account identifiers. Passwords are stored as hashes. If you choose Google sign-in, we receive the identity information needed to connect that sign-in to your account.
- Purchases and licences: products, order and transaction identifiers, amounts, currency, tax and payment-method information, invoices, refunds, disputes, licence ownership and activation status. Paddle handles payment details in its checkout; Talea receives transaction information and limited payment metadata, such as card brand and the last four digits. Billing event messages may contain additional customer or billing information.
- Devices and software: device labels, operating-system and software information, hardware identifiers and their hashes, pairing and activation records, and access/update requests. These allow us to recognise a paired machine and provide the software you own. Talea plugins and Talea Manager never collect, upload or store your audio, MIDI or project files — your music stays on your computer.
- Service and security information: IP addresses, browser/user-agent information, approximate location derived from an IP address, session activity and technical error or request records.
- Email choices: selected marketing topics, contact details, withdrawals and the consent statement, notice version, time and account/session information recorded when a choice is saved.
- Optional website measurement: if you accept Analytics, Google Analytics measures public-page visits and Talea records generic campaign information with a browser identifier. Talea can associate that campaign with your signed-in account and confirmed paid purchases. Talea does not send its campaign-to-account or campaign-to-order links to Google.
- Support and invitations: information you send us in correspondence and records needed to issue and manage invitations.
We obtain this information from you, your browser or software, your chosen sign-in provider, and Paddle. Device identifiers and hashed identifiers can still be personal data when linked to an account.
Why we use it
| Purpose | Legal basis under UK and EU data-protection law |
|---|---|
| Provide your account, software, licences, downloads and requested purchase-related support | Perform our contract with you, or take steps you request before entering one |
| Maintain the service, protect accounts, investigate misuse and resolve other enquiries | Our legitimate interests in operating a reliable, secure service and responding to enquiries, balanced against your rights |
| Keep required accounting and tax records, and respond to lawful obligations | Compliance with legal obligations |
| Send optional marketing about your selected topics | Your consent |
| Run optional website analytics and campaign attribution | Your consent |
| Keep proportionate evidence of choices and handle legal claims | Our legitimate interests in demonstrating compliance and establishing, exercising or defending claims |
We need certain account, transaction and device information to provide the features you request. You can decline marketing and optional Analytics without losing browsing, checkout, licences or downloads. Licence and security checks can make automated access decisions using ownership and device status; contact support if you believe a result is wrong.
Marketing and website storage
Marketing topics are Product updates, Tips and tutorials, and Offers and promotions. They start off unless you choose them. Change your choices in account Notifications or through the preferences/unsubscribe links in our emails. Withdrawing permission stops future marketing for the affected topics; it does not remove necessary purchase, account or security messages.
Website Analytics is a separate browser choice. You can change it through Cookie settings. Necessary storage supports sign-in, carts, security and remembering your choice. See our Cookie policy for the storage inventory and measurement details. Refusal or withdrawal does not affect your purchases or licences.
Who receives information
We use service providers for hosting, storage, delivery, sign-in and measurement:
- Hetzner hosts Talea's application services.
- PlanetScale provides our database.
- Cloudflare provides network/security services and file storage.
- Resend provides email delivery.
- Google provides optional sign-in, our business email services and Google Analytics when you consent to Analytics.
Paddle is the Merchant of Record: you buy from Paddle, and Talea supplies the products. Paddle processes checkout, payments, tax and refunds under its own privacy notice. We exchange the information needed to fulfil and support your purchase.
Starling is Talea's business bank for Paddle payouts and business expenses. Customer checkout and refunds are handled through Paddle.
We may also disclose relevant information to professional advisers or authorities where necessary for legal obligations or claims. We limit access to information needed for the relevant purpose.
Where information is processed
Our application hosting is in Germany. Our database is configured for the European central region and our application file-storage buckets use the EU jurisdiction. Those storage settings do not mean all provider processing takes place only in Europe: global providers may process information in other countries, including the United States.
Where a transfer requires safeguards, we use the applicable adequacy arrangements or appropriate contractual safeguards, including standard contractual clauses and the UK addendum where required. Contact privacy@talea.audio for information about safeguards relevant to your data.
How long we keep information
We retain personal data for the purpose that needs it and review account-data necessity annually:
- Account information: while needed to provide your account and services. Within 30 days of account closure, we remove unnecessary profile information, subject to justified legal exceptions.
- Licence ownership: we retain the minimum ownership and entitlement evidence for as long as needed to honour your licence, potentially indefinitely for a perpetual licence. This does not require retaining your entire profile or every billing message indefinitely.
- Accounting records: normally six years from the end of the company financial year they relate to, with longer retention where law or a specific unresolved matter requires it.
- Routine support correspondence: two years after the enquiry is closed.
- Ended session and deactivated-device history: 90 days after the session ends or device is deactivated.
- Successfully processed raw billing event messages: 90 days after successful processing. We retain minimal event identifiers needed to prevent duplicate processing; required accounting and licence records have their own retention rules.
- Routine diagnostic logs: no more than 30 days. Information needed for a specific security incident or legal matter may be retained separately for that purpose.
- Marketing consent evidence: generally six years after the consent ends. We keep the minimal information needed to honour an opt-out for as long as it remains necessary to prevent unwanted marketing.
- Optional website measurement: Talea's browser choice lasts up to six calendar months. Campaign identifiers and account/order associations expire by the earlier of six calendar months from capture and the authorising consent's expiry, and are removed on withdrawal or account-attribution erasure. Talea's decision evidence is retained for six calendar months after the decision ends. Google's event/user-level retention is two months, separate from its aggregate reports.
Our routine database backup snapshots rotate after six days. Deleted information may remain in backups until the applicable backup expires; backups are restricted to recovery and deletions are reapplied when restoring. Providers may have separate retention obligations under their own terms.
We may retain relevant information longer for a documented legal obligation, security incident or dispute. We do not extend all records merely because one record needs longer retention.
Your rights
Depending on the applicable law and circumstances, you can request access, correction, deletion, restriction or portability of your personal data. You can object to processing based on legitimate interests and object to direct marketing at any time. Where we rely on consent, you can withdraw it; withdrawal does not change the lawfulness of earlier processing.
Email privacy@talea.audio to make a request. We may ask for proportionate information to verify your identity and protect other people's data. We explain any lawful reason that prevents us from fulfilling part of a request.
You can complain to the UK Information Commissioner's Office or the relevant data-protection authority where you live or work.
Younger users
Talea is a general music-production service whose audience can include teenagers. We provide protective privacy defaults for everyone. If you are under 18, ask a parent or guardian for help understanding this notice and making a purchase where their involvement is required. Optional consent and purchasing requirements can depend on your age and country.
Parents and guardians can contact privacy@talea.audio with questions about a child's information.
Changes to this notice
Each published version has a version identifier and effective date. Previous published versions remain available in the notice history. We explain material changes when required; a new privacy notice does not by itself opt you into marketing, change your Analytics choice or require you to accept the notice as a contract.