← Back to LumaKeys

Privacy Policy

This policy explains how we process personal data under the EU General Data Protection Regulation (GDPR). It covers two things: this website, and the LumaKeys app on your Mac. The app has no account, sends no usage telemetry, and never uploads your recordings, audio, or MIDI files. It does make a small number of technical network requests, which are listed in section 3.

1. Controller

The controller responsible for the processing of personal data on this website and in the app is:

Ramon Melchior
Auf dem Römer 8, 55765 Birkenfeld, Germany
Email: ramon@lumakeys.app

Full legal details are in our Imprint.

2. The website

Hosting and server logs

When you visit this website, our hosting provider (Cloudflare, see section 5) automatically processes technical access data that your browser transmits: your IP address, the date and time of the request, the page or file requested, the referring URL, and information about your browser and operating system.

Purpose: to deliver the website reliably and securely, and to detect and defend against attacks and abuse.
Legal basis: our legitimate interest in a secure, stable, and functioning website, Art. 6 (1)(f) GDPR.
Retention: only as long as needed for security and stable operation, then deleted or anonymised.

Newsletter

When you sign up for the newsletter, we send your email address to our email provider (Resend, see section 5) to store it, to send you a confirmation, and to send you occasional emails with updates and special offers about LumaKeys. We do not use your address for any other purpose and do not share it.

Data: your email address; technical metadata of the email (send timestamp, delivery status).
Legal basis: your consent, Art. 6 (1)(a) GDPR. You can withdraw it at any time with effect for the future, for example by emailing us or using the unsubscribe link.
Retention: until you unsubscribe or otherwise withdraw consent.

Analytics

To understand how the site is used, we run DataFast, a web-analytics tool, in its cookieless mode. It sets no cookies and does not build cross-site profiles. It does use your browser’s session storage to keep a random session identifier for the duration of your visit; this is cleared when you close the tab. For each page view it sends the page URL, the referrer, your browser language, time zone, and screen size, plus your IP address and browser type as part of the request. DataFast derives from this a short-lived pseudonymous visitor identifier and gives us aggregate statistics; we never see individual visitors.

Purpose: aggregate statistics about how the site is used.
Legal basis: our legitimate interest in understanding and improving our website, Art. 6 (1)(f) GDPR. You can object at any time (see section 8), and you can block the script with any content blocker without losing site functionality.

Purchasing Pro

When you buy LumaKeys Pro, the checkout is run by Polar Software, Inc. as merchant of record. Polar is the seller for the transaction and processes your name, email address, billing address, and payment data as an independent controller under its own privacy policy. We receive from Polar your email address, the order details, and the license key issued to you, so we can support you and honour refunds.

Legal basis: performance of the contract, Art. 6 (1)(b) GDPR; and our statutory retention duties under tax and commercial law, Art. 6 (1)(c) GDPR.
Retention: order records for the statutory retention periods (up to 10 years under German tax law).

Contacting us

If you email us, we process the details you provide (such as your email address and the content of your message) solely to handle your request.

Legal basis: our legitimate interest in responding to enquiries, Art. 6 (1)(f) GDPR, and, where your enquiry relates to a (pre-)contractual matter, Art. 6 (1)(b) GDPR.
Retention: as long as needed to handle your request.

3. The LumaKeys app

LumaKeys runs locally on your Mac. There is no account and no sign-in. Your pieces, recordings, audio files, MIDI files, and settings stay on your disk. Audio-to-MIDI transcription runs on your machine and never uploads audio. The app collects no usage telemetry and contains no analytics or crash-reporting service. It makes exactly the following network requests:

Update checks

The app checks our release server (releases.lumakeys.app, hosted on Cloudflare) for a new version about once an hour while it is running, and downloads an update in the background when one exists. This is a plain download of a version manifest; the server sees your IP address as with any web request. No identifier for you or your Mac is sent.

Legal basis: our legitimate interest in keeping the app secure and up to date, Art. 6 (1)(f) GDPR, and our duty to provide updates for digital products (§ 327f BGB).

Optional sample download

If you choose to download the full-quality piano samples (about 700 MB) or an additional instrument, the app fetches them from the same release server. This only happens when you start the download yourself.

Legal basis: performance of the contract / your request, Art. 6 (1)(b) GDPR.

Pro license activation and validation

When you enter a Pro license key, the app sends the key and a label for your Mac (its computer name) to Polar (see section 5) to activate it. Afterwards the app re-validates the key with Polar at most once every three days while it is running. If your Mac is offline, the app keeps working; validation simply waits for the next opportunity. Polar sees your IP address as part of the request. Deactivating a Mac sends the same key and activation reference.

Legal basis: performance of the license contract, Art. 6 (1)(b) GDPR, and our legitimate interest in preventing misuse of license keys, Art. 6 (1)(f) GDPR.

Feedback form (optional)

The app has a feedback form. If you use it, your message, the app version, your plan (Free or Pro), and, only if you enter it, your email address are sent to our feedback endpoint (feedback.lumakeys.app, hosted on Cloudflare) and delivered to us as an email via Resend. Nothing is sent unless you press send.

Legal basis: your consent, Art. 6 (1)(a) GDPR.
Retention: as long as needed to handle the feedback.

Third-party instruments

If you use your own Audio Unit instruments (for example Pianoteq or Vienna Synchron) inside LumaKeys, those plug-ins run under their own licenses and may make their own network requests, which are outside our control and this policy.

4. Cookies

This website sets no cookies of its own and uses no advertising or tracking cookies. The analytics session storage is described in section 2. The Polar checkout runs on Polar’s own domain and may set cookies needed for the purchase; see Polar’s privacy policy.

5. Recipients and processors

We use the following service providers. Unless marked otherwise, each processes personal data on our behalf as a processor under a data processing agreement (Art. 28 GDPR):

• Cloudflare (Cloudflare, Inc., USA) — hosting and delivery of the website, the release server (updates and sample downloads), and the feedback endpoint. Processes IP addresses and request logs.
• Resend (Plus Five Five, Inc., USA) — email delivery for the waitlist and for in-app feedback. Processes your email address, name (if provided), IP address, and email metadata. We use Resend’s EU sending region; the associated sending data is logged and stored by Resend in the United States.
• DataFast (JustShipIt Pte. Ltd., Singapore) — cookieless web analytics, as described in section 2.
• Polar (Polar Software, Inc., USA) — merchant of record for Pro purchases and operator of the license-key service. For the purchase itself Polar is an independent controller; for license activation and validation it processes the data described in section 3 on our behalf.

6. International data transfers

Cloudflare, Resend, and Polar are US companies and process data on infrastructure that includes the United States. These transfers are safeguarded under the EU Standard Contractual Clauses (Art. 46 GDPR) and, where the provider is certified, the EU–US Data Privacy Framework (Art. 45 GDPR). DataFast (Singapore) processes the analytics data described in section 2 on infrastructure located mostly outside the EU, including the United States; DataFast states that it relies on the Standard Contractual Clauses concluded by its sub-processors. We limit what the analytics script sends to the technical data listed in section 2, and you can block it at any time.

7. Retention

Retention periods are stated with each processing activity above. Where statutory retention periods apply (for example under tax or commercial law), we retain the relevant data for the duration of those periods.

8. Your rights

Under the GDPR you have the right to:

• access your personal data (Art. 15);
• rectification of inaccurate data (Art. 16);
• erasure of your data (Art. 17);
• restriction of processing (Art. 18);
• data portability (Art. 20);
• object to processing based on our legitimate interests (Art. 21); and
• withdraw any consent you have given, at any time and with effect for the future (Art. 7 (3)).

To exercise any of these rights, email ramon@lumakeys.app. There is no cost to you, and we will respond within the statutory time limits.

9. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate (Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz). You may also contact the supervisory authority in your EU country of residence or workplace.

Last updated: September 2026.