# Privacy policy Last updated 11 November 2026. This page explains what personal information sOURnd collects, why, who sees it and what you can ask us to do with it. ## Who is responsible James Harold Gordon Cartwright, trading as [Box Of Rules](https://boxofrules.com), C/O Brennan Herriott & Co, 1 Blatchington Road, Hove, England, BN3 3YP, is the data controller. Contact [hello@sournd.com](mailto:hello@sournd.com). ## What we collect and why | What | Why | Lawful basis | |---|---|---| | Your email address, and the engines and plans you buy | To sell you engines, send receipts and sign-in links, and let you download | Contract | | Your country, the country your connection comes from, and your VAT number if you give one | To charge the right VAT and keep the evidence HMRC requires | Legal obligation | | Your PayPal payer email, country and payment references | To confirm and, if needed, refund payments | Contract, legal obligation | | Invoices and credit notes | UK tax records | Legal obligation | | Plugins registered and revenue reported before 10 November 2026, when the royalty ended | To run the commercial licence we had then | Contract | | Messages you send through the contact form, with your browser type and the page you came from | To answer you and sort out problems with the site | Legitimate interest | | Your email if you join the newsletter, with the time and IP address you signed up from | To send occasional news about engines, and to show you asked for it | Consent (unsubscribe any time) | | Whether our emails are opened and which links in them are clicked | To know receipts and sign-in links arrive and work | Legitimate interest | | Ask sOURnd conversations: your questions and the answers, the page you asked from, any rating you give, the country your connection comes from (not your IP address) and, if you are signed in, your email | To answer you, and to improve sOURnd and its answers. Anything that looks like a password, key or card number is removed before we store it | Legitimate interest | | Audio you upload to hear an engine | Only to make that preview (see below). It is not kept | Legitimate interest | | The browser that signed in, and when (remembered sign-in) | To keep you signed in and let you sign out everywhere | Contract | | How the site is used (see Analytics below) | To see which pages help people and fix what does not | Legitimate interest, or consent for Google Analytics and Microsoft Clarity | | Server and security logs | To keep the site running and safe from abuse | Legitimate interest | We do not sell personal information and do not use it for advertising. We never make decisions about you by automated means alone. ## Previews on our server Paid engines and synths play on our server, so their code never reaches your browser. - **Your own audio on an effect page.** The file you pick is sent to our server, which uses only its first 10 seconds (30 seconds if you own the engine or your plan covers it) to make the preview. The upload and its decoded copy are deleted straight after, whether the preview works or not. They are never cached, kept or used for anything else. - **Synth pages.** Only note timings and dial settings are sent. A MIDI file you choose is read in your browser and never uploaded. - **What we keep.** Previews of our built-in test sounds and of synth note lists are cached on the server so the same request is fast next time. Your uploads are not. - **Fair use limits.** To stop abuse, preview requests are counted per IP address and per session cookie. Only the counts are kept, for up to a day. ## Analytics - **Matomo, for everyone, without cookies.** We run our own Matomo at stats.boxofrules.com. It records the pages you view (with sign-in links and other private parts of addresses removed), how long you stay, the site that sent you, your IP address, browser, device type and approximate location, and actions such as adding to the cart, starting a checkout, claiming a free engine or signing in. It sets no cookies, respects Do Not Track, and the data stays with us. - **Google Analytics, only if you allow it.** It records the same kind of information plus purchases (what was bought and the amount, never your email), with your IP address shortened. It never runs when your browser sends Global Privacy Control. Change your choice on the [cookie policy](https://sournd.com/cookies/). - **Microsoft Clarity, only if you allow it.** Clarity shows us how pages are used: where people click, tap and scroll, how the pointer moves, and a replay of the visit built from those, along with your browser, device type, approximate location and the pages you came from and viewed. What you type into a form is hidden before it leaves your browser. Clarity does not run on Your engines, sign-in links, checkout or any other signed-in page, so it never sees your email, your purchases or your keys. It never runs when your browser sends Global Privacy Control. We use it only to improve the site, with advertising use switched off. Microsoft keeps recordings for up to 30 days and the other Clarity data for up to 13 months. ## Who we share it with Only the services that run sOURnd for us, each under contract: - **PayPal** takes payments. PayPal is also a controller of the payment data you give it. - **Postmark** sends our emails and tells us when they are opened and which links are clicked. - **DigitalOcean** hosts the site and database, in London. - **Cloudflare** protects and delivers the site, checks Ask sOURnd is used by a person (Turnstile), and stores download files. - **Anthropic** writes answers to Ask sOURnd questions from our own documentation. We send the question, never your email. - **Google** runs Google Analytics, only if you allow it. - **Microsoft** runs Clarity, only if you allow it. Microsoft also uses Clarity data for its own purposes, as its [privacy statement](https://privacy.microsoft.com/privacystatement) describes. Matomo runs on our own server, so that information is not shared. Some of these are based outside the UK, mainly in the United States. Where your information leaves the UK, it is protected by the safeguards UK law requires, such as the UK extension to the EU-US Data Privacy Framework or the UK international data transfer agreement. We may also disclose information if the law requires it. ## How long we keep it - Orders, invoices, credit notes and VAT evidence: 6 years after the end of the tax year, as HMRC requires. - Licences: for as long as the licence exists. - Sign-in links: 30 minutes. Remembered sign-ins: 30 days from last use, or until you sign out. - Newsletter: until you unsubscribe. - Contact messages: up to 2 years after the conversation ends. - Plugin registrations and royalty reports from before 10 November 2026: 6 years from that date. - Ask sOURnd conversations: 12 months, then deleted. - Analytics: Matomo visit logs 13 months; Google Analytics 14 months; Microsoft Clarity recordings 30 days and its other data 13 months. - Uploaded audio: not kept after the preview is made. ## Your rights You can ask us for a copy of your information, to correct it, to delete it, to restrict or object to how we use it, or to receive it in a portable format. Where we rely on consent, you can withdraw it at any time. Email [hello@sournd.com](mailto:hello@sournd.com); we reply within one month. We may need to keep some records, such as invoices, for as long as the law requires. If you are unhappy with how we handle your information, please tell us first. You can also complain to the Information Commissioner's Office at [ico.org.uk](https://ico.org.uk) or on 0303 123 1113. ## Children sOURnd is not meant for children under 13, and we do not knowingly collect their information. ## Cookies See the [cookie policy](https://sournd.com/cookies/).