Privacy Policy

1. Introduction

Umami Audio (“we,” “us,” or “our”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your information when you use Perfect Soup and related services, including the Calibration Wizard, Calibration Loader, and our website.

2. Information We Collect

• Account information: Your email address and display name when you create an account.
• License and activation data: Computer name, a hashed computer identifier, and operating system information, used to manage license activations and enforce concurrent-use limits.
• Calibration data: Room measurement data you create using the Calibration Wizard. This data is stored on our servers so the Calibration Loader can retrieve it.
• Payment information: Payments are processed by Creem as our Merchant of Record. We do not store your credit card details. We receive only transaction confirmations and subscription status from Creem.
• Usage data: Basic telemetry such as license heartbeats (to verify activation status) and error reports that help us diagnose issues.
• Marketing attribution identifiers: If you reach our website by clicking one of our ads or an email link, we store campaign tags (UTM parameters) and advertising click identifiers on your account — Google's click IDs (“gclid,” “gbraid,” or “wbraid”) and Meta's click and browser-pixel identifiers (“fbc” and “fbp”). We use these to measure which campaigns lead to signups and purchases.
• Support chat: Messages you send to the in-app support assistant, along with a session identifier and — if you are signed in — your email address, so we can answer follow-up questions and improve our support. The assistant runs on a model hosted on our own servers; your messages are not sent to a third-party AI provider.

3. How We Use Your Information

Your data is used solely to provide and improve our services. Specifically, we use your information to:

• Create and manage your account and licenses.
• Deliver calibration files to your Calibration Loader plugin.
• Verify license validity and manage device activations.
• Process purchases and manage subscriptions through Creem.
• Provide customer support.
• Measure and improve the effectiveness of our advertising campaigns, including which campaigns lead to signups and product usage.
• Improve the reliability and performance of our software.

4. Legal Basis for Processing (GDPR)

We process your personal data under the following legal bases:

• Contract performance: processing your account, license, and calibration data is necessary to deliver the services you purchased.
• Consent: if you are in the EEA, the United Kingdom, or Switzerland, analytics and advertising cookies (Google Analytics, Meta Pixel, Google Ads) are only set after you provide explicit consent via our cookie banner. Until (or unless) you consent, Google tools operate in a cookieless mode (Google Consent Mode) that sends only anonymous, aggregate signals not linked to you. In other regions these cookies are set by default under our legitimate interest in measuring our services and advertising, and the banner lets you opt out.
• Legitimate interest: we use basic error reporting and license heartbeats to maintain service reliability and prevent abuse, and we measure the effectiveness of our advertising campaigns using hashed or anonymized identifiers when you create a measurement in the Calibration Wizard — a product-usage event that does not involve a browser or cookie.
• Legal obligation: we may retain transaction records as required by tax and accounting regulations.

5. Third-Party Services

We do not sell, rent, or trade your personal information. We share limited information with the service providers and advertising partners below, solely to operate and improve the services you use, including measuring the effectiveness of our advertising:

• Creem (payment processor): receives the minimum information necessary to process your transactions.
• Google Analytics (GA4) (website analytics): collects anonymous, aggregated usage data such as pages visited and session duration. IP addresses are anonymized. In the EEA, UK, and Switzerland, analytics cookies are only set if you accept them via our consent banner (without consent, only anonymous cookieless signals are sent — see Section 4); elsewhere they are set by default and you may opt out at any time via the banner.
• Meta Pixel (Meta Platforms, Inc. — advertising measurement): loaded only after you accept cookies via our consent banner if you are in the EEA, UK, or Switzerland; loaded by default elsewhere, with an opt-out in the banner. It tracks page visits and conversion events (such as purchases and signups) so we can measure advertising performance. The Meta Pixel also uses Meta’s Automatic Advanced Matching feature, which recognizes fields such as email address, phone number, or name in on-site forms (for example, login and signup) and sends Meta a cryptographically hashed (SHA-256) version of that information to improve ad-matching accuracy. We never send this information to Meta in plain text. We also use the events the Pixel collects to build advertising and remarketing audiences on Meta (for example, recent website visitors or past customers) so we can show relevant ads to people who have already engaged with us. You can control how Meta uses your data for ads in your Meta account's ad preferences.
• Google Ads (Google LLC — advertising measurement): a conversion tag that sets cookies only under the same regional consent rules as Google Analytics above. When you complete a purchase, it sends Google a cryptographically hashed (SHA-256) version of your account email alongside the purchase event — a feature called Enhanced Conversions — to improve ad-matching accuracy. We never send this information to Google in plain text.
• Google reCAPTCHA (spam protection): used on login and registration forms to prevent automated abuse.
• SMTP2GO (email delivery): sends our transactional and marketing emails on our behalf and therefore processes your email address and message content.
• Cloudflare (content delivery and security) and GitHub Pages (website hosting): serve our website and route traffic to our servers, and in doing so process technical connection data such as your IP address to deliver pages and block abuse.

Separately, when you create a measurement using the desktop Calibration Wizard application, our server (not your browser) sends a cryptographically hashed (SHA-256) version of your account email — together with the Meta click and browser-pixel identifiers (“fbc”/“fbp”) when available — to Meta’s Conversions API, an anonymized account identifier to Google Analytics’ Measurement Protocol, and — if you originally reached our website by clicking one of our Google ads — the Google Ads click identifier (the “gclid,” “gbraid,” or “wbraid” from that visit) to Google Ads. No email address is sent to Google Ads. This is done solely to measure whether our advertising led to product usage — for example, whether a signup driven by an ad campaign went on to create a measurement, and to credit the ad click that brought you. Because this exchange happens between our server and the ad platforms and does not involve a browser cookie, it is not covered by the cookie consent banner described above; it is instead tied to your use of the product under the legal basis described in Section 4.

International transfers. Several of the providers above (including Google, Meta, Creem, SMTP2GO, Cloudflare, and GitHub) are based in the United States or operate global networks, so your information may be processed outside your country, including in the United States. Where required, these transfers rely on the providers’ standard contractual clauses or equivalent safeguards.

6. Data Storage and Security

• Your data is stored on secure servers with encrypted connections (TLS).
• Passwords are hashed and never stored in plain text.
• We implement reasonable technical and organizational measures to protect your information against unauthorized access, alteration, or destruction.

7. Data Retention

We retain your account, calibration, attribution, and support-chat data for as long as your account is active. When you delete your account (or ask us to at [email protected]), it is deactivated immediately and your personal information and calibration data are permanently erased automatically 30 days later. If the deletion was a mistake, simply log back in within those 30 days to restore your account and cancel the erasure. License transaction records may be retained for legal and accounting purposes.

8. Your Rights

You have the right to:

• Access the personal data we hold about you.
• Rectification: request correction of inaccurate information.
• Erasure: request deletion of your account and associated data.
• Data portability: export your calibration data in a machine-readable format.
• Restrict processing: request that we limit how we use your data.
• Object: object to processing of your data for specific purposes.
• Withdraw consent: withdraw your consent for analytics and advertising cookies at any time by clearing your browser’s local storage or declining cookies on your next visit.
• Lodge a complaint: file a complaint with your local data protection authority if you believe your rights have been violated.

To exercise any of these rights, contact us at [email protected].

9. Cookies

Our website uses the following types of cookies:

• Essential cookies: Required for authentication, session management, the in-app support chat, and abuse prevention (including Google reCAPTCHA). These cannot be disabled.
• Analytics and advertising cookies: Used by Google Analytics, Meta Pixel, and Google Ads to collect anonymous usage data and measure advertising performance. In the EEA, UK, and Switzerland these are only set if you accept cookies via the consent banner shown on your first visit; in other regions they are set by default and the banner offers an opt-out instead. You can change your preference at any time by clearing your browser’s local storage, which brings the banner back on your next visit.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated revision date. Continued use of our services after changes constitutes acceptance of the updated policy.

11. Contact

If you have any questions about this Privacy Policy, please contact us at [email protected].