Last updated: 10 August 2026
At MONKEY MASTERING we take privacy seriously. This Privacy Policy explains what personal data we collect, the purposes for which we process it, your rights, and how you can exercise them, pursuant to Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD).
| Item | Value |
|---|---|
| Controller | Javier J. Redondo (hereinafter, “MONKEY MASTERING”) |
| Tax ID (NIF) | 78503120A |
| Address | Avenida Alcalde Ramírez Bethencourt 32, 35004 Las Palmas de Gran Canaria, Spain |
| Privacy contact | legal@monkeymastering.com |
| General legal contact | legal@monkeymastering.com |
We have not appointed a Data Protection Officer (DPO) as it is not legally required given the volume and nature of our processing. For any personal data matter, please contact legal@monkeymastering.com directly.
We process the following personal data depending on how you interact with us:
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Email address | Deliver license key, provide support, notify security updates | Contract performance (Art. 6.1.b GDPR) | Duration of active license + 6 years (Art. 30 Spanish Commercial Code) |
| Name | Invoice issuance (invoice is issued by Lemon Squeezy, Inc. as Merchant of Record) | Legal obligation (Art. 6.1.c GDPR) | 6 years (Art. 30 CCom) / 4 years (Spanish General Tax Law) — the longer applies |
| Country | Apply the applicable taxes (handled by Lemon Squeezy, Inc.) | Legal obligation (Art. 6.1.c GDPR) | 6 years |
Important: the payment process is handled entirely by Lemon Squeezy, Inc. acting as Merchant of Record. We do not receive or store any credit/debit card or other payment instrument data. See Lemon Squeezy, Inc.'s privacy policy on their website.
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Hardware fingerprint (SHA-256 hash derived solely from the machine's hardware identifier — no computer name, no user name, no operating-system version) | Validate license, limit simultaneous activations (max. 2) and allow deactivation on migration | Contract performance (Art. 6.1.b GDPR) | Duration of active license |
| IP address | Initial online license check and fraud detection (retention handled by Lemon Squeezy, Inc. per its own policy; the Licensor does not store IP on its own servers) | Legitimate interest in protecting the Software from fraudulent use (Art. 6.1.f GDPR) | Per Lemon Squeezy, Inc. policy |
| License key | Unique identification of the right of use | Contract performance (Art. 6.1.b GDPR) | Duration of active license |
The Software does not collect or transmit any audio, projects, or user-produced content. All audio processing happens locally on the user's computer and is not sent to any server. Art. 22 GDPR (automated decisions / profiling) does not apply as no significant profiling of the user is performed.
BETA phase: during the private BETA (v1.2 BETA), BETA license keys are validated entirely locally, with no network calls. No data is transmitted to the Licensor or third parties during activation or use.
The Software stores technical files on the User's device needed for license control and basic anti-tampering. These files are not transmitted to any server.
| File | Approximate location | Content | Purpose |
|---|---|---|---|
.mm_license.json |
OS user folder (e.g. ~/.mm_license.json on macOS; %APPDATA% on Windows) |
License key + activation timestamps | License control |
.mm_install |
User folder | Install UUID (anonymous) | Identify the install for activation/deactivation |
.mm_core |
System folder (on Windows, C:\ProgramData; on macOS, a shared path) |
Integrity marker | Local tamper detection |
.mm_seen |
User folder | First-launch / welcome-shown flags | Avoid repeating onboarding |
The User may delete these files at any time (doing so deactivates that system, which can be re-activated with their key). They contain no audio, projects, or sensitive personal data.
Security note: on Windows,
.mm_corelives underC:\ProgramData, which is readable by any user of the machine. It contains no personal data.
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Email address, message content, and any data you voluntarily include (DAW version, OS, error logs, screenshots) | Handle your support request | Contract performance (Art. 6.1.b GDPR) | 2 years from case closure |
We kindly ask you not to send full sessions, projects, original audio, or sensitive material when contacting support. Only what is strictly necessary to reproduce the issue.
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Email, name (if provided), message content | Respond to your enquiry | Consent (Art. 6.1.a GDPR) | 2 years from last contact or until consent is withdrawn |
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Send news, updates, offers | Consent (Art. 6.1.a GDPR) | Until you withdraw consent via the "Unsubscribe" link in each email |
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Technical data (IP, browser, OS, visited pages, duration, referrer) | Site security and aggregated analytics | Legitimate interest (Art. 6.1.f GDPR) or consent where analytics cookies apply | See Cookies Policy |
We share your personal data only with the following third parties, and only when strictly necessary:
| Recipient | Purpose | Location | Safeguards |
|---|---|---|---|
| Lemon Squeezy, Inc. | Process payment and issue invoice as Merchant of Record | United States | EU Standard Contractual Clauses (SCCs). See their privacy policy. |
| Email provider (currently Google / Cloudflare Email Routing, or applicable) | Email sending/receiving (activations, support, contact) | United States / EU | SCCs and equivalent measures |
| Hosting provider (currently Cloudflare / Vercel / applicable) | Site hosting and license validation API | United States / EU | SCCs and equivalent measures |
| Tax / accounting advisor (if applicable) | Compliance with tax obligations | Spain | Data processing agreement (Art. 28 GDPR) |
| Competent authorities | Only when required by law | Spain / EU | Legal obligation (Art. 6.1.c GDPR) |
We do not sell, rent, or transfer your personal data to third parties for commercial purposes.
Some of our providers (e.g. Lemon Squeezy, Inc., Google) are located in the United States. Transfers are covered by:
Under the GDPR and the LOPDGDD, you have the right to:
| Right | Meaning |
|---|---|
| Access | Know what data we process about you and obtain a copy |
| Rectification | Correct inaccurate or incomplete data |
| Erasure ("right to be forgotten") | Request deletion of your data when no longer necessary |
| Objection | Object to processing based on legitimate interest |
| Restriction | Request that we suspend processing pending resolution of a request |
| Portability | Receive your data in a structured, machine-readable format |
| Withdraw consent | Revoke consent at any time, without retroactive effect |
| Not be subject to automated decisions | Applies if there is significant profiling; not our case |
Email us at legal@monkeymastering.com stating: - The right you want to exercise. - Your contact email (the one used at purchase, if applicable). - A copy of identification document if we need to verify your identity.
We will respond within a maximum of one (1) month (extendable to two months in complex cases, upon notification).
If you believe your right to data protection has not been respected, you can file a complaint with the Spanish Data Protection Agency (AEPD):
Users in other EU Member States may also contact their local supervisory authority.
We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, alteration, or disclosure:
In case of a data breach affecting your data, we will notify the AEPD within the legal 72-hour period and, if the risk is high, we will also notify affected users.
The Software and the Site are not directed at users under 18. We do not knowingly collect data from minors under 14 years of age (minimum age of consent in Spain under Art. 8 GDPR and LOPDGDD). If we learn that we have collected data from a minor without verifiable parental consent, we will delete it immediately.
The Licensor does not use: - Individualized analytics or cross-site tracking in the Software. - Machine-learning models to make decisions about the User. - Automated profiling within the meaning of Art. 22 GDPR.
If analytics cookies or pixels are added to the website in the future, the Cookies Policy will be updated and prior consent will be requested. See also AIUseDisclosure.en.html.
We may update this Policy to reflect legal or operational changes. The "last updated" date at the top reflects the current version. Material changes will be notified by email to users with active licenses at least 30 days in advance.
This Privacy Policy is governed by Spanish and European Union law.
Privacy contact: legal@monkeymastering.com Controller: MONKEY MASTERING (full controller identification in §1)
This document is published in Spanish and in other languages to make it easier to understand. The Spanish version is the only authentic one: in the event of any discrepancy between versions, the Spanish text prevails.
This preference does not deprive the consumer of the rights granted by the law of their country of habitual residence, in accordance with Article 6 of Regulation (EU) 593/2008 (Rome I).