Privacy Policy

Privacy Policy

Fat As Funk Audio Ltd
Registered in England and Wales, company number 17547973
Registered office: 3 Marco Polo House, Cook Way, Taunton TA2 6BJ

Covers: fatasfunk.com (our mastering studio website), fatasfunkaudio.com (our audio plugin and software website), our software, and the support we give you.

Version 1.0. Effective date: 5 November 2026.

---

1. About this policy

1.1 This policy applies to personal data we handle through:

• fatasfunk.com, our mastering studio website and shop;
• fatasfunkaudio.com, the website where we sell our audio plugins and other software;
• our software, including our plugins (in VST3 and AU formats, and AAX where available), Masterform and any web app version we launch later (section 4.4);
• our mailing list, our ebooks, and email support.

It does not cover other websites we link to. They have their own privacy policies.

1.2 We follow the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR), which cover cookies and marketing emails.

1.3 “Personal data” means any information about a person who can be identified. “We“, “us” and “our” mean Fat As Funk Audio Ltd. Other defined terms, such as Software, Licence, Activation, Your account and Moonbase, mean the same as in our End User Licence Agreement (the EULA), which is at https://fatasfunkaudio.com/software-licence-agreement/.

---

2. Who is responsible for your data

2.1 Fat As Funk Audio Ltd is the “controller” of your personal data. That means we decide why and how it is used. Our details are:

• Company: Fat As Funk Audio Ltd, registered in England and Wales, company number 17547973
• Registered office: 3 Marco Polo House, Cook Way, Taunton TA2 6BJ, England
• Email: support@fatasfunk.com

2.2 We have not appointed a Data Protection Officer. Send every privacy question to support@fatasfunk.com.

2.3 Some other companies are controllers too. For some of what happens when you buy from us, another company decides how your data is used, for example Moonbase for your order and payment (section 4.1), Gumroad for its payments (section 4.5), and PayPal and Stripe for card and PayPal payments (section 4.9). We say so wherever it applies. Each of them has its own privacy policy.

---

3. Summary: what we do with your data

---

4. The detail

We collect data from you (when you buy, sign up, email us, upload files or use the Software) and from the services that handle payments, licences and email for us. For example, they tell us that you have paid. We never receive your full card number.

4.1 Buying our software, and your account (Moonbase)

4.1.1 We sell our software through Moonbase AS (company number 931 730 258, Utsikten 6, 3718 Skien, Norway; privacy contact privacy@moonbase.sh). Moonbase is the merchant of record. Moonbase has two roles, and so do we:

• Moonbase as seller (an independent controller). For your order, your payment, tax, chargebacks and fraud checks, Moonbase decides how your data is used. This includes your name, email address, billing address, business and VAT number if you buy as a business, what you bought, your payment details (its payment partners handle your full card details), and the IP address and approximate location of the device you bought from. Moonbase keeps this for tax and fraud purposes. For some sales in the United States, its subsidiary Moonbase LLC is the seller. Moonbase’s privacy policy for buyers explains this: help.moonbase.sh/articles/2002025-privacy-policy-for-buyers.
• Moonbase as our processor. For everything else it holds about our customers, Moonbase acts on our behalf, and we are the controller. That covers your customer account, your Licences and Activations, trials, downloads, the emails the shop sends you in our name (including whether you opened them and which links you clicked), customer groups, and analytics about your activity in the shop. Moonbase also uses some of this data for a few purposes of its own, as a controller, to keep its service secure, to prevent fraud and to work out its fees. It does not use it to market to you.

4.1.2 We receive from Moonbase: the details of your purchase (name, email address, country, what you bought, price, the licence), so we can support you and keep our records.

4.1.3 Lawful basis: contract (to sell and deliver the Software and run Your account); legal obligation (tax and accounting records); legitimate interests (preventing fraud and keeping the shop secure).

4.1.4 Cookies on the shop: Moonbase’s storefront uses cookies and browser storage to keep you signed in, to keep your basket, and, if you accept marketing cookies, to track which advert led to a sale. Payment providers set their own cookies at checkout to prevent fraud. See Moonbase’s buyer policy for the full list.

4.2 Free versions and trials

4.2.1 To download a free version or start a trial, you give us your email address (and your name if the form asks for it). Moonbase creates an account for you and records the download or trial. A trial is tied to your account and to the computer you start it on (EULA clause 12.2). Free versions do not need activation but may still check in as described in section 4.3 (EULA clause 7.2).

4.2.2 Lawful basis: contract (to give you the free version or trial you asked for). We use the email only to provide the version or trial and to tell you about it and about important changes to it. We send you marketing only as section 4.6 explains.

4.2.3 Education licences: if you ask for an education licence, we ask you for proof that you are a current student or educator (EULA clause 11.2). We use the proof only to check your status.

4.3 Licence activation, and the machine identifier

4.3.1 What the Software may send. When you activate or deactivate a computer, or when it checks your Licence, the Software may send to Moonbase’s licensing server:

• your email address, Licence key and purchase or order ID;
• a machine identifier (also called a computer identifier or device identifier). This is a code made from details of your computer. It identifies the computer, not you, and not what is on it. It is not your audio or your files;
• the computer’s name (often the name you gave it) and its operating system;
• the Software version;
• the time of the check, and whether the Activation was online or offline; and
• your IP address, which gives Moonbase the approximate location (country or region) of the check. Moonbase keeps only the IP address and location of the most recent check.

We have written this list to match what Moonbase’s licensing system records.

4.3.2 What it does not send. The Software does not send your audio, your projects, your sample or preset libraries, your DAW settings or what you do inside the Software. It does not include crash reporting, usage statistics or advertising tools (section 5).

4.3.3 Why we do this, and our lawful basis. Contract: checking and recording your Licence and Activations is how we deliver the licence you bought, including moving it between computers, free updates, and subscription and payment-plan checks. Legitimate interests: we have a genuine interest in protecting our work from piracy and licence sharing, and in keeping the licensing system secure. We have weighed this against your privacy. We collect only what licensing needs, and the identifier only identifies a computer. If you disagree, you can object (section 9).

4.3.4 Cookies and similar technologies on your computer. The licence check reads details about your computer, and it stores your Licence details on it, so the Software can run. This is strictly necessary to provide the Software you asked for, so PECR does not require us to ask for consent first.

4.3.5 Limits are applied automatically. The licensing system enforces your computer limit automatically. For example, a new Activation can release an old one (EULA clause 5.3). A person looks at the case before we refuse a reset, suspend a Licence or end it because we suspect misuse (EULA clause 5.5). If you disagree with a decision, tell us and we will review it (section 9).

4.3.6 Who sees it. Moonbase runs the licensing system as our processor (section 4.1.1) and uses the sub-processors listed in its Data Processing Addendum (section 7).

4.3.7 How long. Section 8. Moonbase keeps the identifiers of revoked, deleted or expired Licences and Activations so that valid Licences keep working.

4.3.8 Offline activation. If you activate offline, the same details are put into a file you send us or upload, and Moonbase’s system records it. We use it only for the Activation.

4.4 A possible future web app (software as a service)

4.4.1 We may in future offer a web app version of our software, which you would use in your browser and sign in to with your Moonbase account. It does not exist yet. Nothing in this section applies until we launch it.

4.4.2 If we launch it, we expect to process: your sign-in details (through Moonbase, as in section 4.1), your subscription status, basic technical data (IP address, browser, session records) to run and secure the service, and any settings and projects you save in it. A web app may need to handle your audio on our servers or a hosting provider’s servers. That would be a change from our current position that audio stays on your computer. Before launch we will:

• update this policy to say exactly what is processed, why, where it is stored, who our hosting providers are, and how long we keep it;
• tell you, and ask for your consent where the law needs it, before your audio is uploaded; and
• carry out a data protection risk assessment, and update the EULA and our third-party notices to match.

4.5 Ebooks (Gumroad)

4.5.1 We sell ebooks through Gumroad (Gumroad, Inc., United States). When you buy, Gumroad takes your payment and gives us your name, email address, country and what you bought. We use these to deliver the ebook, give you support and keep our tax records (contract and legal obligation).

4.5.2 Gumroad has two roles. For payments, tax, fraud prevention and its own platform purposes, it is an independent controller under its own privacy policy (gumroad.com/privacy). For the buyer details it holds for us, it acts as our processor under its data processing addendum (gumroad.com/dpa).

4.5.3 We add you to our mailing list only if you tick a box or otherwise agree when you buy (section 4.6).

4.5.4 Gumroad is in the United States. See section 7 for how we deal with that.

4.6 Mailing list and marketing emails (Sender)

4.6.1 What: your email address, your name if you give it, which list you joined (for example our general list or our software list), when and how you signed up, and whether you open or click our emails. For abandoned-basket reminders on fatasfunk.com, the items you left in your basket.

4.6.2 Who: we use Sender (UAB Sender.lt, Lithuania) to send our emails. Sender acts as our processor (sender.net/privacy-policy) and says it stores subscriber data in the European Union. We use double opt-in: you confirm your sign-up by clicking a link in an email.

4.6.3 Lawful basis: consent. You choose to join, and you can leave whenever you like. If you have bought from us, we may also email you about similar products of ours, relying on the PECR “soft opt-in” (we tell you when we collect your email address, and you can opt out in every message). If we email you about something you did not sign up for, it will be on the soft opt-in basis only.

4.6.4 Tracking in emails: Sender records opens and clicks, so we can see what is useful. You can stop this by blocking images in your email app, or by unsubscribing.

4.6.5 Unsubscribing: click “unsubscribe” in any email, or email support@fatasfunk.com. We keep your email address on a “do not email” list so we do not contact you by mistake.

4.6.6 We never sell or rent our list.

4.7 Our websites: hosting, analytics and cookies

4.7.1 Hosting. fatasfunk.com is built on WordPress.com, run by Automattic. It hosts the site, our shop software (WooCommerce) and our site statistics (Jetpack and WordPress.com Stats). Automattic acts as our processor for the data on our site. For some visitor data it is a controller in its own right (see automattic.com/privacy).

4.7.2 What our hosting records. When you visit, our hosting and security tools record your IP address, browser and device type, the pages you view and when. We use this to deliver the site, keep it secure, and see which pages people use (legitimate interests).

4.7.3 Cookies and similar technologies. Cookies are small files or pieces of code that a website puts on your device. Our websites and the services that run them may use these types:

4.7.4 Your choices. You can block or delete cookies at any time in your browser settings. Some parts of the shop will not work without the necessary ones.

4.7.5 Others who may receive this data. If their tools are active on our websites, Google, Meta and Sender may receive data about your visit. Google and Meta may use it for their own purposes as independent controllers, under their own privacy policies.

4.8 Support email

4.8.1 If you email support@fatasfunk.com, we receive your name, email address, the content of your message, and anything you attach, plus our replies. We use it to answer you, fix problems, reset activations and keep a record of what we agreed (contract; legitimate interests in running our business and giving support). For a question before you buy, we rely on taking steps you ask for before a contract.

4.8.2 It is handled by our email provider as our processor. We may look up your order or Licence in Moonbase to help you. We do not use support emails for marketing.

4.8.3 Kept: up to 3 years after our last contact. If the email relates to an order or a job, it is kept with that record (section 8).

4.9 Mastering clients and shop orders (fatasfunk.com)

4.9.1 What: your name, email, billing details, the audio files and stems you send us, your notes and references, our emails about the job, and the finished masters we send back. Audio may sometimes include other people’s voices. If you send us other people’s personal data, you must have the right to do so.

4.9.2 Why and lawful basis: to do the work you ask for (contract); to keep invoices and payment records (legal obligation); to handle revisions, queries and disputes for a limited time (legitimate interests).

4.9.3 Confidentiality. We use your music only for the job. We do not share it, publish it, or use it to develop our software or train AI tools unless you have clearly agreed. We do not use clients’ audio for these purposes unless the client has said yes first.

4.9.4 How files reach us: by a private link on DISCO (a music sharing platform, run by S Wave International Corp, United States), or by a link you send from another service (such as Google Drive, OneDrive or WeTransfer). Those services have their own policies.

4.9.5 Shop orders and payments on fatasfunk.com: the details you give at checkout (name, email, billing address, what you bought) are held in WooCommerce on WordPress.com. Card payments are taken through WooPayments, which uses Stripe, and PayPal payments through PayPal. We never see or store your full card number. Stripe processes the payment for us, and is also an independent controller for fraud prevention and its legal duties. PayPal is an independent controller, and we receive confirmation of payment and your PayPal name and email address.

4.9.6 Free mastering demo: if you send a track for a free demo, we use the file and your email address to make and send the demo. We delete the file within 3 months unless you become a client.

4.9.7 Recordings used to develop our software: we use recordings of a person’s voice or playing to develop or train our software only if that person has clearly agreed, in writing. They can withdraw that agreement at any time by emailing us, and we will delete their recordings and stop using them (consent).

---

5. What our software does not do

5.1 Our plugins and Masterform do not send crash reports, usage statistics, analytics or telemetry. Apart from the licence check in section 4.3, they do not send data anywhere.

5.2 They do not upload your audio, unless a feature clearly tells you it will and asks you first (EULA clause 16.3).

5.3 Some links in the Software (for example “Join our mailing list” or “Visit fatasfunk.com”) open in your web browser. If you use them, sections 4.6 and 4.7 apply.

5.4 If this ever changes, we will update this policy first, and ask for your consent where the law requires it.

---

6. Who we share your data with

6.1 We never sell your data. We share it only with the companies that help us run the business, and only as much as they need.

6.2 We may also share data where the law requires it (for example a court order), to establish or defend legal claims, or with a buyer if we sell or transfer all or part of our business (and the buyer must respect this policy).

---

7. Sending data outside the UK

7.1 Some of the companies above use servers or staff outside the UK. When your data leaves the UK, we make sure it has proper protection, in one of these ways:

• UK adequacy regulations. The UK treats the European Economic Area, which includes Norway, as providing adequate protection. This covers Moonbase AS, whose main hosting is with Amazon Web Services in Ireland (with a data warehouse in Belgium), and Sender, which says it stores subscriber data in the EU. Moonbase also uses some sub-processors in the United States, for example Gravatar, and some of its tools are provided from there. Moonbase’s own Data Processing Addendum and buyer policy list them and the safeguards it uses.
• The UK–US data bridge, where a US company is certified under it.
• The UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU standard contractual clauses. These contracts give your data UK-level protection. We rely on them where there is no adequacy regulation or certification, for example with Gumroad and DISCO.

7.2 To ask for details of the safeguards for any transfer, email support@fatasfunk.com.

---

8. How long we keep your data

After these periods we delete or anonymise your data. We may keep data for longer if the law requires, or if we need it for a legal claim.

---

9. Your rights

9.1 Under UK data protection law you have the right to:

• be told how we use your data (this policy);
• access the personal data we hold about you;
• correct data that is wrong or incomplete;
• erase your data, in some cases;
• restrict how we use your data, in some cases;
• data portability: receive the data you gave us in a common format, where we use it under contract or consent;
• withdraw your consent at any time, where we rely on consent (this does not affect what we did before);
• ask for a person to review an automated decision about you; and
• object to our use of your data, which gets its own paragraph below.

9.2 You can object. You can object at any time to us using your data for our legitimate interests (for example, our anti-piracy checks in section 4.3). We will stop unless we can show a compelling reason that outweighs your interests, or we need the data for a legal claim. You can also object at any time to direct marketing, and we must always stop.

9.3 How to use your rights. Email support@fatasfunk.com. It is free. We will reply within one month, and we may extend this by up to two more months for complex requests (we will tell you why). We may ask you to prove who you are, and for details that help us find your data, and we will carry out reasonable and proportionate searches. We may refuse a request that is manifestly unfounded or excessive, or where the law lets us, and we will explain why.

9.4 Some rights have limits. For example, we cannot delete invoices we are legally required to keep. Where Moonbase or Gumroad is the independent controller of data (for example your order and payment), you can use your rights with them directly. For data Moonbase holds as our processor, it will pass your request to us.

---

10. Complaints

10.1 Complaining to us. If you are unhappy with how we have handled your data, email support@fatasfunk.com with “Privacy complaint” in the subject line (or write to us at our registered office). We will acknowledge your complaint within 30 days, and we aim to do it much sooner. We will look into it without undue delay, keep you updated, and tell you the outcome.

10.2 Complaining to the regulator. You can complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator: ico.org.uk/make-a-complaint. You can do this at any time. We would welcome the chance to put things right first.

---

11. Children

Our websites, services and Software are for adults and are not aimed at children. We do not knowingly collect personal data from anyone under 16. Moonbase’s terms also do not allow it to be used for data about children under 16. If you think a child has given us their data, email support@fatasfunk.com and we will delete it.

---

12. Keeping your data secure

12.1 We take reasonable steps to protect your data, including: encrypted (HTTPS) connections on our websites; antivirus, firewalls and a VPN on the computers we work on; limiting access to your files to the people who need them; and choosing reputable providers who protect data in line with the law. Moonbase encrypts data in transit and at rest and limits staff access, as it explains in its Data Processing Addendum.

12.2 No system is perfectly secure, and we cannot guarantee the security of data sent over the internet. If a personal data breach puts you at risk, we will tell you and the ICO, as the law requires.

---

13. Automated decisions and profiling

We do not make decisions about you based only on automated processing that have a legal or similarly significant effect. Computer limits are applied automatically, but a person reviews any decision to refuse a reset, suspend a Licence or end it (section 4.3.5). Payment providers may screen payments for fraud automatically, and may decline a payment they think is risky. That is their decision, under their own policies. We do not build marketing profiles about you beyond the cookie and email tracking described in sections 4.6 and 4.7, which depends on your choices.

---

14. Changes to this policy

14.1 We will update this policy when our services, our use of data or the law changes (for example, when we launch a web app, or add a new supplier). The version and date are at the top. We will post the new version on this page, and for significant changes we will tell you by email or on our websites. We will not use your data for a new purpose without telling you first.

14.2 Previous versions are available on request.

---

15. Contact us

Email: support@fatasfunk.com
Post: Fat As Funk Audio Ltd, 3 Marco Polo House, Cook Way, Taunton TA2 6BJ, England
Company number: 17547973 (England and Wales)