Who is responsible
Peter Hradecký operates this project and is the controller responsible for the personal information described in this notice. Vault84Lab is the project’s brand name.
- Project operator and data controller
- Peter Hradecký, Libčice nad Vltavou, CZ
- Privacy contact
- Send a privacy request
Use our protected support form to contact Peter about your data. Select Support and begin your message with “Privacy request”. We use this form to keep contact details protected from automated spam.
What we collect
- Downloads: your email address and one summary per platform containing the latest requested VST version, latest request timestamp, total request count, and the latest terms version you accepted and when you accepted it. We also keep daily totals by platform and installer version, without email addresses in those totals. This records installer requests, not completed downloads or installations.
- Optional news: if you tick the separate marketing box, we also record that choice and when it was made. Marketing is never required to download MaxVRS.
- Support: if you contact us, we receive your email address and the message you choose to send. Please do not include passwords, payment information, health information, or other sensitive data.
Like nearly every hosted website, Microsoft Azure and Cloudflare may process an IP address and standard request or browser information to deliver the page, prevent abuse, and diagnose faults. Our application uses an IP address transiently for rate limiting but does not save it in the download or support database. Cloudflare’s short-lived verification token is not stored there either.
Why we use it
We use your email and download record to provide the requested release, measure adoption by platform and version, and support MaxVRS. Under the GDPR and UK GDPR, the legal basis is taking steps at your request and our legitimate interest in distributing, measuring, and supporting MaxVRS (Article 6(1)(b) and 6(1)(f)).
We use support information to answer you and improve the product on the same legal bases. Security information is processed under our legitimate interest in keeping the service reliable and preventing abuse.
We send product news only when you separately consent (Article 6(1)(a)). The privacy checkbox confirms that you received this notice; it is not marketing consent. Accepting the Terms & Audio Safety is a separate requirement for a download and does not subscribe you to marketing. You can withdraw marketing consent at any time, and every marketing email will include an unsubscribe method.
You are not legally required to provide an email address, but we require one for the download and support flows. Marketing remains optional. We do not make decisions about you based solely on automated processing that produces legal or similarly significant effects.
Service providers and international transfers
We do not sell or rent your email address. We disclose only the information needed for these providers to run and protect the service:
- Microsoft: Azure hosts the website, database, API, and installer files. Microsoft Entra provides administrator authentication.
- Cloudflare: Turnstile processes technical signals to help protect the download and support forms from bots. Cloudflare acts on our behalf to provide that protection and also processes signals for its own bot-detection improvements, as explained in its Turnstile Privacy Addendum.
Our application API, database, and installer storage are hosted in Azure’s North Europe region. Website delivery and our providers’ processing may involve other countries, including the United States. Where European law requires it, international transfers must be covered by an applicable adequacy decision or appropriate safeguards, such as European Commission Standard Contractual Clauses. See the Microsoft DPA and Cloudflare DPA.
Links to services such as Spotify open those services only when you choose to follow the link. Their own privacy notices then apply.
How long we keep information
- Download email addresses and their per-platform latest version, latest request time, and total request count: up to 24 months after the most recent request associated with that address.
- Support and feedback messages: up to 24 months after the last activity on the request.
- Marketing subscription information: until consent is withdrawn or the mailing list ends. A minimal suppression and consent record may be kept for up to three years where necessary to demonstrate and respect your choice.
- Routine technical and security logs under our control: normally up to 30 days, or longer when reasonably necessary to investigate a security incident.
We may retain specific information longer when required by law or reasonably necessary for a legal claim. When a period ends, information is deleted or irreversibly anonymized, subject to normal backup rotation.
Your European privacy rights
If the GDPR or UK GDPR applies, you may request access, correction, erasure, restriction, or portability of your personal data; object to processing based on legitimate interests or for direct marketing; and withdraw consent at any time. These rights can be subject to legal exceptions.
Submit a request through our protected contact form. Select Support and write “Privacy request” at the start of the message. We may request limited information to verify your identity and will normally respond within one month. You may also complain to the data-protection authority where you live, work, or believe an infringement occurred. The European Data Protection Board lists EEA authorities.
We do not use personal information for decisions based solely on automated processing that produce legal or similarly significant effects.
United States privacy disclosures
Where a U.S. state privacy law applies, you may have rights to access, correct, delete, or obtain a copy of your personal information and to appeal a denied request. We will not discriminate against you for exercising a privacy right.
For California notice-at-collection purposes, we collect identifiers (email address and technical online identifiers), download activity (platform, latest requested VST version, latest request time, and total request count), and customer records (a support message, if submitted) for the purposes and periods stated above. We do not sell personal information, share it for cross-context behavioral advertising, use it for targeted advertising, or offer financial incentives for it. We have not done so during the preceding 12 months, and we do not knowingly collect sensitive personal information as defined by California law.
Submit a request through our protected contact form. We may verify that the email belongs to you or ask an authorized agent for proof of authority.
Security and changes
We use encrypted connections, short-lived private download links, rate limiting, and restricted administration. No internet service is completely secure, but we maintain safeguards appropriate to the limited information we hold.
We may update this notice when the service or law changes. We will post the revised date here and provide additional notice when a change materially affects how we use information.