Privacy Policy

This website and the Trim-Series and Trim-Suite plugins are provided by Oasis Creative Labs LLC (“Oasis”, “we”). We are the controller of the personal data described here. For anything in this policy, write to info@oasiscreativelabs.com.

• There are no customer accounts. You browse, buy and activate without signing in to anything.
• This site sets no advertising or tracking cookies.
• Checkout runs on Shopify. Your card details never reach us.
• Your licence key and installer are sent to the email address you give at checkout.
• A plugin contacts our licence server once, to activate. It sends your key and a scrambled computer ID, never hardware serial numbers, your projects or your audio.
• We do not sell your data or use it for advertising.

Website visits. Our hosting provider, Cloudflare, records technical data with each request: IP address, browser type, the page requested, time and date, and the referring page. We use it to keep the site running, secure and available, and it is deleted according to Cloudflare’s retention periods.

Your cookie choice. A single entry in your browser’s local storage (oasis-consent-v1) remembers whether you accepted optional analytics. It contains no identifier. We do not currently run any analytics; if we add a service, it will load only after you choose “Accept all”, and we will name it here first.

Your cart. The plugins you add to the cart are kept only in your browser (oasis-cart-v1 in local storage). They are never sent to us, and the list is cleared when you check out or clear your site data. This storage is strictly necessary for the cart to work and needs no consent.

The launch announcement. A third entry (oasis-announce-v1) remembers that you have seen the TrimMachine announcement, or signed up through it, so it does not open again. It holds only the time, no identifier.

Promotion-code sign-up. If you leave your email address in the announcement, we first send that address one confirmation email, from our own domain through Resend, an email delivery service, which processes the address to deliver it and keeps its own delivery log of that email under its privacy policy (currently 30 days). The link carries the address encrypted and works for 48 hours; we ourselves store the address nowhere until you press Confirm on that page. What we do keep are hashed fingerprints, from which no address can be read back: one of the address for a day, so no inbox receives more than one such email a day; one of your network address for two days, with a count, so no single source can send many; a daily count of emails sent, for two days; and one of each used link for three days, so a link works once. Once you confirm, we add the address to our customer list in Shopify, marked as subscribed to email marketing with confirmed opt-in and tagged for the TrimMachine release, and Shopify stores it under its privacy policy. We use it to send you the promotion code when TrimMachine is released, and for our own product announcements. Every email carries an unsubscribe link, and you can ask us to remove the address at any time at the contact below. We never pass it to anyone else.

Purchases. Checkout is run by Shopify, which collects your payment details under its own privacy policy. From each order we receive your name, email address, country and the billing details needed for tax, plus what you bought. We never see full card numbers. Shopify keeps the order record as the store of record for your purchase.

Key and installer delivery. Sky Pilot, an app that runs inside our Shopify store, emails you the licence key and the download link for each plugin you buy. To do that it holds your email address, your order, which key was assigned to it, and a record of your downloads, so we can resend a key or a link if you lose the email. Sky Pilot keeps those delivery records under its own privacy policy.

Licence activation. When you enter your key, the plugin contacts our licence server at api.oasiscreativelabs.com once. It sends the key, a device ID and the product name; the server records the time. The device ID is a short one-way code (16 characters) worked out from identifiers your computer already has; the original identifiers never leave your computer and cannot be recovered from the code. On our side we store:

• a one-way hash of your key, salted with a secret kept only on our licence server and the computer we create keys on, so the key itself is never stored;
• the device ID, the product and when it was activated;
• the IP address of the request, kept for up to about two days only to limit repeated requests from one address. Cloudflare’s own request logs for the licence server, which include the IP address, are kept for a few days.

TrimMachine, TrimVerb and TrimDelay copies sold before this site launched activate against our earlier licence server, hosted for us by Lovable on Supabase. It stores the licence key, the product, a device identifier derived from the computer and the activation time; for TrimMachine it also stores the plugin version and the IP address of the activation. It also holds a log of activation attempts with their IP address, purchase records with the buyer’s email address and order, and the email addresses left on our earlier website. It does not store payment details. These records are kept for as long as the licence exists and deleted on request by email, except where we must keep them to prevent abuse of a refunded or revoked key.

Studio recordings. The studio’s vocal booth is switched off at the moment. When it is on, it uses your browser’s microphone: your browser asks for permission each time, the recording lives only in the page’s memory and is discarded when you close the booth or leave the page, and no audio is sent to us or anyone else.

Support email. If you write to us, we keep the correspondence so we can help you and see the history if you write again.

Hardware serial numbers or raw hardware identifiers; your projects, sessions, presets or audio; which music software you use or how you use it; your browsing outside this site. The plugins contain no analytics. Beyond the activation request described above, they make no network connections.

• Contract: your order, delivery of your key and installer, and activation, which we need to provide what you bought.
• Legal obligation: order and tax records.
• Legitimate interests: website logs and the short-lived IP records on the licence server, for security and to prevent abuse of licences, and support correspondence.
• Consent: the email list you can join through the launch announcement, and optional analytics, if we ever add any. You can withdraw consent at any time without affecting what came before: every email carries an unsubscribe link.

Only the service providers that run Oasis for us, under their contracts and privacy policies:

• Shopify: checkout, payment processing, the order record and the email list for announcements and promotion codes. Shopify also acts as an independent controller for some payment data.
• Sky Pilot (an app in our Shopify store): sends your key and installer by email and keeps the delivery record.
• Cloudflare: website hosting, the licence server, and the hashed send-limit records for the sign-up.
• Resend: delivers the sign-up confirmation email.
• Supabase: the licence server’s database.
• Lovable: hosting of the earlier licence server used by TrimMachine, TrimVerb and TrimDelay, and of the records it holds.

We may disclose data if the law requires it, or to a buyer of our business, who would be bound by this policy. We do not sell personal information and do not share it for cross-context behavioural advertising.

• Order and tax records: as long as tax law requires.
• Key delivery records: kept by Sky Pilot under its own privacy policy.
• Activation records (hashed key, device ID, product, time), and the records on the earlier server: for as long as the licence exists. Deleted on request by email, except where we must keep them to prevent abuse of a refunded or revoked key.
• IP records on the licence server: up to about two days. Cloudflare’s request logs for it: a few days.
• Support email: 3 years after the last message.
• Email list (the launch announcement sign-up): kept in Shopify. Once you unsubscribe we stop emailing you, and we delete the address if you ask us at the contact below.
• Sign-up fingerprints (hashed address, network address, used links, daily counts): one to three days, as described above. The confirmation email itself: in Resend’s delivery log for about 30 days.

Everything is sent over encrypted connections. There are no accounts, so we hold no passwords. On our current licence server, keys are stored only as salted one-way hashes, so a copy of its database would not reveal them. The secret used for hashing is kept only on our licence server and the computer we create keys on.

Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict certain processing, to withdraw consent, and to complain to your data protection authority. Residents of California and other US states with privacy laws have similar rights, including the right not to be discriminated against for using them.

To use them, email info@oasiscreativelabs.com from the address you used at checkout, so we can find your records. We reply within one month. Because there are no accounts, there is nothing to download or delete from a settings page; we handle every request by email.

This site and our products are not directed at children under 16, and we do not knowingly collect their data. If you believe a child has given us personal information, contact us and we will delete it.

Our providers may process data outside your country. Transfers out of the EEA or UK rely on recognised safeguards such as the European Commission’s standard contractual clauses or an adequacy decision.

We will update this page when our practices change and revise the date at the top. Because we hold no account to notify, this page is where changes are announced. Read with our Terms of Service.