For personal data processing carried out under the responsibility of Wav.farm, the data controller is:
Clément Maurin EI, trading under the business name Wav.farm, SIREN 107 740 961, RCS Caen, SIRET 107 740 961 00019
2 Avenue du 6 Juin, 14114 Ver-sur-Mer, France
Email: support@pictowave.com
The purchase of PictoWave is entered into with Sold through Link, LLC f/k/a Lemon Squeezy LLC ("Lemon Squeezy"), which acts as authorized reseller and Merchant of Record. Lemon Squeezy processes, under its own responsibility and in accordance with its own privacy policy, the data required for the purchase transaction, including payment, billing, taxes, refunds and fraud prevention. Wav.farm does not act as the seller for that transaction.
Wav.farm does not collect or store full payment card data. Such data is processed through Lemon Squeezy's payment system and its service providers. For processing carried out by Lemon Squeezy in its capacity as Merchant of Record, please refer to Lemon Squeezy's own privacy policy.
In order to be able to prove, as required by French law (Articles L. 221-7 and L. 221-28 13° of the French Consumer Code), that a consumer buyer has expressly consented to immediate performance and waived their right of withdrawal, Wav.farm keeps for each order a record containing the order references (number, store, product), the buyer's email address and the timestamp of the consent given at the time of ordering, or a note of its absence. The retention period of this record is set out in Section 7.
Independently of the purchase, the application communicates with Wav.farm and/or Lemon Squeezy services for activation, license verification, trial management, update checks and, only at the User's initiative, technical diagnostics.
On activation and periodically thereafter, the application transmits to Lemon Squeezy the data required to verify the license, including the license key and a machine identifier. An occasional Internet connection is required for these checks. The machine name may also be transmitted where it is used to display and manage activations.
When you remotely release the seat held by your license (the application's "Release" feature), our server logs the date of the operation, the license identifier and the name of the released Mac. This log is kept for 90 days, then deleted automatically.
At each launch, the application may automatically check whether a new version is available. This check transmits the following technical information:
Because that identifier can be used to recognize the same installation over time, Wav.farm treats it as pseudonymous data rather than strictly anonymous data. Deleting the application's preferences on the Mac produces a new one. Update-check data is used to inform the User of available versions, maintain Software security and compatibility, and produce aggregate technical statistics; it is not used for advertising or commercial profiling.
The contact form on the Site collects the name, email address and message the User chooses to provide. This data is used for the sole purpose of answering the request. The legal basis is Wav.farm's legitimate interest in responding to people who contact it and, where the request concerns activation, the license or technical support, performance of the EULA.
The message is delivered to the support mailbox through Brevo, which acts here as a processor for transactional email, and is then kept in that mailbox for as long as needed to handle the exchange and any follow-up, and for no more than three years from the last contact. The Site's server also keeps a pseudonymised log of the submission: the date, a truncated hash of the email address and a technical outcome, never the message itself. That log is kept for one year.
The free trial is limited to 14 days. To count that period and prevent the same device from repeatedly restarting a new trial, the application sends Wav.farm's infrastructure the relevant product (PictoWave or PictoWave Pro) and a second, distinct pseudonymous device identifier, computed locally by salted SHA-256 hashing of an internal hardware identifier. For this purpose, the server stores the identifier and the trial start date.
The identifier is produced by one-way hashing of a hardware identifier that remains on the Mac. It does not allow Wav.farm to recover the raw hardware identifier. It nevertheless remains pseudonymized personal data for GDPR purposes because it can distinguish a device over time.
The User can view the relevant identifier in the application under Help > Debug, on the "Trial identifier" line. Wav.farm does not use this identifier to track the User's browsing activity or create an advertising profile.
After a crash, the application may offer to send the diagnostic report generated by macOS. The report is never transmitted automatically: for each incident, the User chooses whether or not to send it. It is intended to contain technical diagnostic information rather than project audio or video files; depending on the content generated by macOS, certain system or device information may nevertheless constitute personal data. Wav.farm processes the report only for diagnostics and support.
The application includes a local diagnostic panel (Help > Debug). If diagnostic logging is enabled, the User may generate on the Mac a file containing technical information such as timestamps, connection events, license status or playback information. This information is not automatically transmitted to Wav.farm; it is transmitted only if the User chooses to attach it to a support request.
Wav.farm uses Plausible Analytics, provided by Plausible Insights OÜ (Estonia), solely to measure Website traffic and performance in aggregate. Plausible does not use cookies, local storage or persistent identifiers that allow a visitor to be tracked from one day to another or across different websites.
To produce statistics, Plausible processes information including the page URL, referrer, browser, operating system, device type and approximate location derived from the IP address. Raw IP addresses and User-Agent data are not stored; they are used transiently to generate a salted daily identifier that is deleted after 24 hours. Plausible visitor data is processed and hosted in the European Union.
Newsletter subscription is optional and based on consent. Wav.farm uses Brevo, a service provided in particular by Sendinblue SAS, to manage subscriptions and mailings. Subscription uses a double opt-in process: the email address is transmitted to Brevo when the form is submitted, because it is Brevo that sends the confirmation email, and the address is added to the mailing list only after the User clicks the link in that email. An unconfirmed address is retained by Brevo only for the technical period necessary to manage confirmation and is then deleted if the subscription is not confirmed. Every newsletter provides a way to unsubscribe at any time.
As provided for by Article 13(2) of Directive 2002/58/EC (transposed in France at Article L.34-5 of the Code des postes et des communications électroniques), when a User purchases a license, Wav.farm may use the email address provided for that purchase to send a limited number of marketing emails about Wav.farm's own products or services similar to the one purchased, including updates or new major versions of the purchased product as well as other current or future Wav.farm products or services in the same field. Wav.farm may use Brevo to send these emails.
Where Wav.farm relies on consent, including for the newsletter and voluntary submission of a crash report, consent may be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal.
Data is accessible only to persons and service providers that need it for the purposes described in this Policy, within the limits of their responsibilities.
Plausible visitor data is hosted in the European Union. Brevo is provided in particular by Sendinblue SAS, established in France. Lemon Squeezy is established in the United States. Where a provider processes data on Wav.farm's behalf and a transfer outside the European Economic Area is required, the transfer must rely on a valid mechanism under Chapter V of the GDPR, including an adequacy decision or, where applicable, European Commission Standard Contractual Clauses. Processing carried out by Lemon Squeezy as an independent controller is governed by its own privacy policy.
Wav.farm does not sell personal data or disclose it to third parties for behavioral advertising.
Data required to manage a license is retained for as long as the license remains valid and needs to be administered. When it is no longer required in active systems, certain data may be archived for as long as necessary to establish, exercise or defend legal claims. Accounting records that Wav.farm is legally required to keep are retained for the applicable statutory period, including ten years where required by French law.
The email address used to send these marketing emails is retained for as long as it may serve that purpose or until the User objects, whichever happens first.
Technical data relating to update checks and compatibility statistics is retained for a maximum of 12 months before deletion or aggregation. Crash reports and support logs voluntarily submitted are retained for as long as needed to diagnose and process the request, and are then deleted or anonymized no later than 12 months after the matter is closed, unless a specific security or litigation need requires longer retention.
The log of remote seat releases (the "Release" feature) is kept for 90 days, then deleted automatically.
The record of express consent to immediate performance and waiver of the right of withdrawal, described in Section 2, is kept for ten years from the date of the order, a period aligned with that of the accounting records it relates to, and is then deleted.
Messages sent through the contact form are kept in the support mailbox for as long as needed to handle the exchange and any follow-up, and for no more than three years from the last contact. The pseudonymised submission log kept on the Site's server is deleted after one year.
The trial-period record (pseudonymous identifier and start date) is retained for five years from the trial start date on the relevant device in order to prevent repeated trial resets; this period is reviewed periodically. Newsletter data is retained until consent is withdrawn or the User unsubscribes. Information strictly necessary to evidence consent or honor an objection may be archived for as long as necessary to defend Wav.farm's rights.
Under the conditions set out in the GDPR, you may exercise the rights applicable to the processing concerned. Certain rights depend on the legal basis for processing.
To exercise your rights, contact support@pictowave.com. Wav.farm may request information reasonably necessary to verify your identity and will respond within the periods required by law. You may also lodge a complaint with the CNIL (Commission Nationale de l'Informatique et des Libertés), the French supervisory authority.
For records linked to the pseudonymous device identifier, you may provide Wav.farm with the value displayed under Help > Debug, on the "Trial identifier" line, so that the relevant record can be located. If Wav.farm is unable to associate pseudonymous data with an individual without additional information, it is not required to collect additional identifying data solely in order to identify that individual.
An objection to processing based on legitimate interests, including prevention of trial-period abuse, is assessed individually. Wav.farm will continue processing despite an objection only where permitted by the GDPR, including where compelling legitimate grounds override the interests, rights and freedoms of the data subject or where processing is required for the establishment, exercise or defense of legal claims.
The Wav.farm Website does not use advertising or marketing cookies. Plausible Analytics is configured without cookies, local storage or persistent identifiers. When the User opens the checkout hosted by Lemon Squeezy, Lemon Squeezy may use its own cookies or trackers in accordance with its own policy. If Wav.farm later introduces non-essential trackers requiring consent, they will not be activated until valid consent has been obtained.
Wav.farm implements technical and organizational measures proportionate to the risks, including HTTPS encryption of communications, access controls, pseudonymization of technical identifiers where appropriate and use of service providers maintaining suitable security measures. As no electronic transmission or storage system can be guaranteed to be absolutely secure, these measures are reassessed in light of the risks and the state of the art. Wav.farm does not make solely automated decisions that produce legal effects or similarly significantly affect the User. The trial mechanism automatically recognizes a device only to determine eligibility for the free trial and does not affect a purchased license.
For any question about this Policy or your personal data: support@pictowave.com. This Policy may be updated to reflect changes to the Software, service providers or applicable law; the date of the latest update appears at the top of the document.
In the event of any discrepancy between the French and English versions, the French version prevails.