What is collected, why, and what never leaves your machine.
Legal review is pending.
Amit Levy of Yeshuron 1 is the data controller for the information described here. This policy covers three separate things: the website, the checkout, and the plugin itself.
1. The short version
- Measurement only with your permission. With your consent we use Google Analytics and Microsoft Clarity to see how the site is used, and the Meta Pixel to measure our Facebook and Instagram ads. None of them load until you choose “Accept all” or switch them on in Cookie settings. “Reject all” is always one click, and the “Cookie settings” link at the bottom of every page lets you change your mind.
- The plugin never sends us your audio, your projects, or anything about what you are working on. It talks to the licensing server about your licence, and nothing else.
- We never see your card details. Moonbase handles payment as Merchant of Record.
- We do not sell your data, and we do not share it with anyone except the processors listed below.
2. The website
If you just visit
Our server keeps standard request logs: IP address, the page requested, timestamp, user agent. These exist to keep the service running and to detect abuse. Legal basis: our legitimate interest in operating and securing the site. Retained for up to 30 days.
Your choice comes first
The first time you visit, a banner asks whether you allow Analytics and Marketing. Both are off until you say yes, and nothing from Google, Meta or Microsoft loads before that. Your answer is kept in a cookie called neap_consent for 6 months, then we ask again. We also ask again if this policy changes in a way that affects your choice. You can reopen your choice from Cookie settings at the bottom of every page; switching a category off deletes its cookies on this site and reloads the page.
Necessary cookies and browser storage (always on)
These keep the site working and do not need consent. Some use local storage or session storage, technologies that save information in your browser.
| What is stored | Why | How long |
|---|---|---|
neap_consent cookie | Remembers your cookie choice | 6 months |
| Encrypted HttpOnly cookie | Renews your Moonbase account session; Moonbase manages website sign-in and account recovery | Until you sign out or it expires |
| Short sign-in token, basic account details and the last session-check time | To keep you signed in and check that your session is valid | Until you sign out, the site removes an invalid session, or you clear site data in your browser |
| A pending purchase or plugin activation | To continue the action you requested after sign-in or email verification | Used for up to 30 minutes; the record may remain in your browser until the flow clears it or you clear site data |
| Whether you dismissed a sale banner or dismissed or used the signup offer | To remember your choice and avoid repeatedly showing the same offer | Until you clear site data; sale-banner choices apply to the particular sale |
Campaign labels from the link you arrived on (for example utm_source=instagram), in session storage | Passed to our checkout provider so we know which campaign led to a sale. They are labels, not identifiers | Until you close the tab |
You can remove these using your browser’s controls for site data. Clearing or blocking them may sign you out, interrupt a pending purchase or activation, or cause offers to appear again.
Analytics (only with your permission)
| Tool | What it collects | Cookies and how long |
|---|---|---|
| Google Analytics 4 (Google Ireland Ltd and Google LLC) | Pages viewed, how you arrived (campaign, referring site), device and browser type, approximate location from your IP address (Google does not store the IP address itself), and these actions: product views, A/B audio plays, video plays, download clicks, newsletter sign-up, account creation, trial start, Buy clicks and checkout starts | _ga and _ga_*, 2 years. Event data is kept for 14 months in Google Analytics |
| Microsoft Clarity (Microsoft Corporation) | How pages are used: clicks, scrolling, and session recordings with form fields and text masked. It is not used on the sign-in, account, activation, password, confirmation and unsubscribe pages | _clck up to 1 year, _clsk 1 day. Recordings are kept for 30 days; a favourited or randomly sampled recording for up to 9 months |
Google Analytics never receives the parts of a web address that can carry personal data, such as email confirmation codes or activation details; our code removes them first.
Marketing (only with your permission)
| Tool | What it collects | Cookies and how long |
|---|---|---|
| Meta Pixel (Meta Platforms Ireland Ltd) | That you visited after seeing one of our ads, the pages you viewed, and these actions: product views, Buy clicks, checkout starts, newsletter sign-up, account creation, audio and video plays, download clicks | _fbp and _fbc, 90 days |
| Meta Conversions API (Meta Platforms Ireland Ltd) | Sent from our server, not your browser: newsletter sign-up, account creation, trial start, checkout start and purchase. With them we send your email address hashed (SHA-256, so Meta can match it to a Meta account without receiving it in readable form), a hashed account number, your IP address and browser user agent, and the _fbp and _fbc values | No cookie. Meta keeps the data under its own policy |
The Meta Pixel does not load on the sign-in, activation, password, confirmation or unsubscribe pages. For the data the Meta Pixel and Conversions API collect and send to Meta, Neap and Meta Platforms Ireland Ltd are joint controllers for that collection and transmission; Meta is responsible for what it does with the data afterwards, under Meta’s privacy policy. We never upload our customer or newsletter lists to Meta. Meta may also receive the events the Meta Pixel sends through its own server connection (Conversions API with Meta), which works alongside the Pixel; like the Pixel, it only applies after you allow Marketing.
Events our server reports
Some steps happen where our website code cannot see them: payment happens on Moonbase’s checkout page, and a trial starts when the plugin activates. For those, our server tells Google Analytics (purchase and refund only) and Meta (newsletter sign-up, account creation, trial start, checkout start and purchase) what happened, but only if you gave the matching permission in the banner at the time. If you rejected Marketing, nothing is sent to Meta from our server either. If you rejected Analytics, nothing is sent to Google.
To do this, we keep a small record with your order: your banner choice, the campaign labels and, only with your permission, the Meta browser identifiers, your IP address and user agent, and the Google Analytics client identifier. After 13 months we delete everything in that record except your banner choice and the campaign labels.
Legal basis for Analytics and Marketing: your consent. You can withdraw it at any time from Cookie settings; withdrawing does not affect what was already processed.
When you use the Moonbase checkout, Moonbase and its payment providers may use their own cookies or similar technologies. Those are covered by Moonbase’s checkout privacy policy and any privacy choices shown there.
If you create a Neap account
| What | Why |
|---|---|
| Email address | To identify your account, send verification and password resets, and answer support |
| Name | To address you properly |
| Password | Managed by Moonbase for website sign-in and plugin activation. Passwords submitted through our forms are forwarded securely to Moonbase. They are never logged or stored as new Neap password hashes |
| Which products your account holds | To show your downloads on My Products |
Legal basis: performance of a contract with you. Retained while your account exists, and deleted within 30 days of you asking us to close it.
3. Buying
Checkout runs on Moonbase, who are the Merchant of Record and an independent controller of your payment data. They collect your name, email, billing address and payment details, and are required to keep transaction records for tax purposes. We never receive your card number. We do receive your name, email and the country you bought from, so that we can support you and match your licence to your account. Please read Moonbase’s privacy policy as well, since they are the Merchant of Record for the payment itself.
4. The plugin
What the plugin sends, and only when it checks your licence:
- Which licence or trial the activation belongs to
- A machine identifier, a value derived from your computer’s hardware, used to identify activated computers. It is not tied to your identity beyond your licence, and it does not tell us your name, location or what else is on the machine.
- The product name and version, and the operating system
What it never sends: your audio. Your project files. Track names, session names, file paths. What plugins you have. What you are working on. There is no analytics or telemetry in the plugin at all.
Licence checks happen on activation and periodically afterwards. Legal basis: performance of the licence contract, and our legitimate interest in preventing unlicensed use. Win Win 1.4.0 uses Moonbase for plugin licence activation and validation. Licensing data is processed by Moonbase as well as Neap.
5. Email
Our email provider delivers account verification, password resets, licence updates and support replies. Newsletter subscriptions are optional and separate from account registration or purchases. Subscribers receive Neap updates and can unsubscribe at any time.
When you join the newsletter or create an account and you allowed Marketing, we tell Meta that a sign-up happened, with your email hashed as described above, so we can see which ads bring subscribers.
6. Processors
| Who | What they do | Where |
|---|---|---|
| Moonbase | Website authentication, account recovery, payments, invoicing, tax, plugin licence activation and validation, and campaign revenue reports | See their policy |
| Hetzner | Hosts this website and its database | Germany (EU) |
| Supabase | Account database and file storage: your account, your orders (including the measurement record above), your trials, and the computers your licences are activated on | EU region |
| Resend | Transactional email delivery | EU / US |
| Google (Analytics) | Website analytics, only with your consent | EU / US |
| Microsoft (Clarity) | Usage analytics and session recordings, only with your consent | US |
| Meta (Pixel and Conversions API) | Ad measurement, only with your consent | EU / US |
Where a transfer outside the EEA happens, it relies on the EU-US Data Privacy Framework, the recipient’s standard contractual clauses or an adequacy decision.
7. Your rights
Depending on where you live you may have the right to access a copy of your data, correct it, delete it, restrict or object to processing, port it elsewhere, and complain to a supervisory authority. To exercise any of these, email support@neap.cloud. We answer within 30 days and do not charge for it.
You can withdraw consent for Analytics or Marketing at any time from Cookie settings at the bottom of every page. To have the measurement record about your orders removed, email support@neap.cloud.
Deleting your account removes your account data. It does not delete the purchase records Moonbase is legally required to keep for tax, and it does not revoke a licence you paid for.
8. Security
The site is HTTPS only. Moonbase handles password authentication and email verification. Our short website session tokens are stored only as hashes. Moonbase refresh credentials are kept in an encrypted, HttpOnly cookie and are unavailable to website JavaScript. Database access is restricted to the application.
9. Children
This is not directed at children under 16 and we do not knowingly collect their data.
10. Changes
Material changes will be announced on this page with a new date at the top. If a change affects how we use data you have already given us, we will email you.
11. Contact
Amit Levy, Yeshuron 1
Privacy questions: support@neap.cloud
For questions about this policy, email support@neap.cloud.
support@neap.cloud