Legal

Privacy Policy

Last updated: 11 September 2026  ·  Applies to mixlock.app, the Mix Lock desktop app and all Mix Lock services

1. Who We Are

Mix Lock is operated as a sole trader by Paul Smith ("we", "us", "our"). For the purposes of UK GDPR, Paul Smith is the Data Controller.

2. What Data We Collect

We collect data in these contexts:

Mailing list sign-up (voluntary)

• Email address
• Your answers to the sign-up questions: primary DAW, where you are as a producer, whether you finish your tracks, and how you heard about Mix Lock
• Your tick of the email-consent box
• Date, time, and source of sign-up (logged automatically by our email platform)
• IP address at time of consent (logged automatically for GDPR consent audit trail)

Licence purchase (via LemonSqueezy)

• Name and email address
• Payment details — processed and stored solely by LemonSqueezy; we never see or store card data
• Licence key and machine activation records

Mix Lock account (optional, on the account page)

• Your name, email address and password. The password is handled by Google Firebase sign-in; we never see it
• Your newsletter choice, any licence key you register and whether it verified, and your purchase records
• If you download the demo while signed in: which platform, how many downloads, and when

Free demo sign-up (voluntary)

• Email address, where you found us (campaign tags on the link), IP address, browser identifier, and your marketing-consent choice with its date
• When the demo first opens: a random ID for that computer, the app version, and activation dates, so the 72-hour window can be enforced

The Mix Lock desktop app

• Your tracks, notes, Fix Queue, settings, and any bounce you analyse in the Mix Scorecard stay on your computer. The Scorecard analyses audio locally and never uploads it
• Licence activation and a roughly weekly re-check send your licence key, activation ID and (at activation) your computer's name to LemonSqueezy
• An update check asks our update server whether a new version exists; it sends no personal content
• Bug reports you choose to send: your description, the page you were on, app version, browser identifier, recent in-app error log and a random reporter ID
• The optional AI assistant runs only with your own Google Gemini API key. Your question and the track context it needs go directly from your computer to Google under your own agreement with Google; we don't receive them

This site uses a cookie-free analytics script on every visit, and two ad-measurement pixels that only load if you accept them. See Section 10 for the full detail.

3. Why We Collect It and Our Legal Basis

• Mailing list — Consent (UK GDPR Art. 6(1)(a)). You tick an explicit opt-in box. You can withdraw consent at any time.
• Purchase / licence — Contract performance (UK GDPR Art. 6(1)(b)). Required to fulfil your order and provide licence support.
• Legal obligations — Legitimate interest (Art. 6(1)(f)). We retain minimal purchase records as required by UK tax law.
• Ad measurement — Consent. The Meta and Reddit pixels load only after you accept them in the cookie banner, and you can withdraw that at any time (Section 10).

4. What We Use It For

• Sending you the 10% discount code you signed up for
• Emailing you about Mix Lock product updates, new editions, and relevant offers (mailing list subscribers only)
• Delivering and supporting your Mix Lock licence
• Delivering the free demo and enforcing its time limit
• Investigating bug reports you send
• Understanding what DAWs and experience levels our users have, to guide product development
• Measuring whether our ads bring people to this site, only if you accept the ad-measurement pixels (Section 10)

We will never sell your data. Meta and Reddit receive information about your visit through their ad-measurement pixels only if you accept them; see Sections 5 and 10.

5. Who We Share Data With

Service providers — these handle data on our behalf to run Mix Lock, under their own published terms:

• Mailchimp (Intuit Inc.) — mailing-list sign-ups and delivery (the sign-up form posts directly to Mailchimp). Data may be stored on US servers; Mailchimp participates in the EU-US Data Privacy Framework. Mailchimp DPA
• LemonSqueezy — payment processing and licence management. LemonSqueezy Privacy Policy
• Google Firebase — account sign-in and profiles, demo sign-ups, demo activations and bug reports, and hosts app updates. Firebase privacy
• Resend — sends the demo download email and demo follow-ups. Resend Privacy Policy
• Netlify — hosts this website and its sign-up functions. Netlify Privacy Policy

Advertising companies, only with your consent — if you accept the cookie banner, the Meta (Facebook) and Reddit pixels send information about your visit and these actions:

• Page views and demo or guide sign-ups: Meta and Reddit receive a page view. Meta receives a lead event when you sign up for the demo or a guide, including through the sign-up popup; it names the page or form and its source. Reddit also receives a lead event for homepage demo sign-ups.
• Mailing-list sign-ups: Meta receives a mailing-list sign-up event with the form name and your answers about your primary DAW, producer stage, and how you heard about Mix Lock.
• Checkout clicks: Meta receives a checkout-click event when you click a purchase link on the homepage or account page, with the product name, price, currency and discount code.

Our event calls do not include your email address. The pixels also process visit information under the companies' own policies: Meta Privacy Policy · Reddit Privacy Policy. If you decline, neither pixel loads.

Embedded content — see Section 10 for the YouTube player, Google Fonts and sign-in service some pages load.

Apart from the above, no other third parties receive your personal data.

6. How Long We Keep It

• Mailing list — until you unsubscribe, or 2 years after your last interaction, whichever comes first
• Purchase records — 6 years from purchase date (UK tax / accounting obligation)
• Licence records — for the duration of the licence relationship

7. Your Rights

Under UK GDPR you have the right to:

• Access — request a copy of the personal data we hold about you
• Correction — ask us to correct inaccurate data
• Erasure — ask us to delete your data ("right to be forgotten")
• Portability — receive your data in a portable format
• Object — object to processing based on legitimate interests
• Withdraw consent — unsubscribe from the mailing list at any time using the link in every email, or by contacting us directly

To exercise any right, email mixlockadmin@gmail.com. We will respond within 30 days. There is no charge for most requests.

8. Mailing List — Double Opt-In

When you sign up to our mailing list we send a confirmation email to the address you provided. Your subscription is not active until you click the confirmation link. This is called "double opt-in" and protects you from being added to our list without your knowledge.

9. Discount Code Terms

The 10% subscriber discount is subject to the following terms:

• One code issued per confirmed email address
• One redemption per person, applied to a single Mix Lock licence purchase only
• Cannot be combined with any other offer, promotion, or discount
• Valid until 31 December 2026
• No cash value; not transferable
• Mix Lock reserves the right to withdraw the offer at any time prior to a code being issued

10. Cookies and Tracking

Pages on this site load the following:

• Plausible Analytics — cookie-free, aggregate traffic analytics (page views and referral source only). Runs on every visit, and also counts sign-ups (for example a demo sign-up and where it came from). No personal data is stored on your device and no consent is required for it under UK PECR, because it sets no cookie.
• Meta (Facebook) ad-measurement pixel — sets a cookie (_fbp) so we can tell whether an ad you saw led you to this site. Present on the homepage, account page, and our free interactive guide pages. Doesn't load until you accept the cookie banner shown on your first visit to any of those pages.
• Reddit ad-measurement pixel — sets a cookie (_rdt_uuid) for the same purpose. Present on the homepage only. Same consent gating.
• YouTube video player — the homepage embeds our demo video from YouTube. The player loads from YouTube when the page opens, not only when you press play, so YouTube receives your visit and may set its own cookies or similar storage. Google Privacy Policy
• Google Fonts — the Mix Lock Lite page loads its fonts from Google, so Google receives the request (including your IP address).
• Sign-in (Firebase) — the account page uses Google Firebase to sign you in and keep you signed in, which stores sign-in data in your browser.

Declining means neither ad pixel runs and neither ad cookie is set; the other items above are unaffected by the banner. You can change your choice at any time: manage cookie preferences clears your saved choice and shows the banner again next time you visit a page carrying either pixel.

If this changes — a new pixel, a new analytics tool, new embedded content — this policy will be updated first.

11. Complaints

If you believe we have handled your data unlawfully, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO):

We would always prefer to resolve any concern directly — please contact us first at mixlockadmin@gmail.com.

12. Changes to This Policy

We may update this policy when our practices change. The "Last updated" date at the top will change accordingly. If you are a mailing list subscriber we will notify you of any material changes.