Privacy Policy

1. Data Controller

The data controller is GiaNet Media di Giannetta Francesco, based in Italy. For privacy requests, contact [email protected].

2. Data Collected

GNM-23 collects: registration data (name, email, encrypted password), anonymous usage data (DAW version, OS, hardware), payment data (via Stripe), and technical cookies.

3. Audio Processing

GNM-23 performs all DSP processing locally. No audio data is ever sent to our servers.

4. Purpose and Legal Basis

Data is processed for: license agreement execution (Art. 6(1)(b) GDPR), legal/tax obligations (Art. 6(1)(c) GDPR), and legitimate interest (Art. 6(1)(f) GDPR).

5. Data Subject Rights

Under GDPR, you have rights to access, rectify, delete, port, restrict, and object. Contact [email protected].

6. Data Retention

Data is retained for the duration of the active account and 10 years for tax purposes.

7. Data Transfer

Payments are processed by Stripe (USA), under EU-US standard contractual clauses.

Affiliate programme

If you arrive at this site via an affiliate link — a link that a person or a business has shared to refer you to our services — and you consent to the "Marketing" category in the cookie banner, we record the visit so that we can credit a commission to whoever referred you.

In that case we process: the link code and the visit identifier, the referring site and programme, the page you arrive from and the one you land on, the time of the click and your IP address. We need the IP address to identify self-referrals and artificially generated clicks: without it, the programme could be manipulated to the detriment of honest affiliates.

The legal basis is your consent (Article 6(1)(a) of the GDPR and Article 122 of the Italian Privacy Code) for storing and reading the cookie, and our legitimate interest (Article 6(1)(f)) solely for anti-fraud checks on data already collected with consent. Without consent we record nothing, and the referral is not registered with us. We retain this data for 90 days; after that period, clicks that have not resulted in a purchase are automatically deleted.

If you register after arriving via an affiliate link, your sign-up is associated with that affiliate so that they can be remunerated. We do not show the affiliate any of your data: they see only counts. And you do not see them.

If you are the affiliate

If you take part in the programme, we process your personal and tax details (name, address, tax code or VAT number, country of residence), the data needed to pay you — the identifier of the connected Stripe account or the PayPal address you provide us — the statistics of your links and your commission history. The legal basis is performance of the contract and, for the tax and social-security aspects, a legal obligation. Accounting records are kept for ten years.

Before every payment we check your name against the European Union's restrictive-measures lists: this is an obligation that applies to anyone making funds available to a third party, not a discretionary choice of ours.

If you promote the programme of a third-party advertiser, the conversion data is processed by us and by the advertiser under joint controllership (Article 26 GDPR): the essential content of the arrangement is available to you, and you may exercise your rights against either party indifferently.

The details of the affiliate cookie, including its name and duration, are set out in this site's Cookie Policy.

Stripe and PayPal process data as independent controllers

We rely on Stripe and PayPal to collect payments and to pay out the amounts owed to affiliates. For the purposes they determine themselves — fraud prevention, anti-money-laundering obligations, payment system security — these providers do not act on our behalf: they are independent controllers and answer for their own choices. Their privacy notices are available at stripe.com/privacy and paypal.com.

We disclose to them only the data the operation requires: for a payment, the transaction and billing details; for a commission payout, the recipient's email address and the amount. Both may process data outside the European Economic Area, on the basis of the standard contractual clauses approved by the European Commission.