Privacy & data protection
What this is
XOVND is run by Joan Raventós, a sole-trader audio-software studio based in Spain. This page explains what personal data we collect when you visit xovnd.com or use the CLVSTER plugin, why we collect it, how long we keep it, and how you ask us to delete it.
This policy is written to comply with the EU General Data Protection Regulation (GDPR) and Spain’s LOPDGDD. If anything here is unclear, email joan@xovnd.com and we’ll explain in plain language.
What we collect
- When you fill the “Request access” form on the site: your name, email, preferred social platform and your public handle / URL. We use it to send you a beta code and the occasional update.
- When you redeem a code: the code, the redemptiontimestamp and your browser’s user-agent string. We use it to spot abuse (codes shared widely) and to count uptake.
- When you sign in with Google: your email,name and profile picture URL, supplied by Google via OAuth. We never see your Google password.
- When you buy CLVSTER: your billing details(name, country, optionally tax/VAT ID) and payment instrument are collected by our payment processor Moonbase (see Processors below). We receive the resultingorder id, amount, and license key we issue you.
What we do not collect
- We do not run third-party advertising or fingerprinting trackers.
- We do not sell, rent or trade your contact details to anyone.
- The CLVSTER plugin itself does not phone home with telemetry — it only contacts Moonbase to verify your license, on launch and at activation time.
Legal basis
We process the data above on the following GDPR Art. 6 grounds:
- Consent (Art. 6(1)(a)) — for the lead-capture form, the cookie banner choice, and the optional newsletter when we ship it.
- Contract (Art. 6(1)(b)) — for delivering the plugin, license keys and support to people who buy it.
- Legitimate interest (Art. 6(1)(f)) — for logging code redemptions so we can detect abuse, and for short-lived server logs for security and debugging.
- Legal obligation (Art. 6(1)(c)) — for retaining invoices and accounting records as required by Spanish tax law.
Processors (third-parties who store data on our behalf)
- Vercel Inc. (USA, with EU edge) — site hosting, request logs (~30 days).
- Supabase Inc. (eu-central-1 / Germany) — database for leads and redemptions.
- Google LLC — Sign-in with Google (only if you choose to use it).
- Moonbase — payments, license issuing, customer dashboard for buyers. Moonbase acts as Merchant of Record and as such is the data controller for payment-card data; we never see your card number.
All these processors are GDPR-aligned and we use Standard Contractual Clauses where data leaves the EEA.
How long we keep your data
- Lead form submissions: 24 months after submission, then deleted unless you become a customer.
- Code redemptions: 24 months after redemption.
- Customer + invoice records: 6 years after the last purchase (Spanish accounting law minimum), then anonymised or deleted.
- Server logs (Vercel): ~30 days, then rotated.
Your rights under GDPR
You can ask us, free of charge, to:
- Access the personal data we hold about you (Art. 15)
- Correct it if it’s wrong (Art. 16)
- Delete it (Art. 17, the “right to be forgotten”)
- Restrict or object to processing (Art. 18, 21)
- Receive a portable copy (Art. 20)
- Withdraw consent at any time without affecting prior processing
Email joan@xovnd.com with your request. We’ll respond within 30 days (usually much sooner). You can also delete your local account state any time from the Account popup → Delete account.
You always have the right to file a complaint with the Spanish data protection authority (Agencia Española de Protección de Datos, aepd.es).
Cookies & local storage
The site only uses storage that is strictly necessary or that you explicitly accept:
- Essential cookies — Sign-in session (NextAuth), CSRF token. Always on; the site won’t work without them.
- Preferences (localStorage) — your redeemed license, your applied coupon. Only written after you click Accept on the cookie banner.
- Analytics — none today. If we add Vercel Analytics later, it will be IP-anonymised and listed here first.
Children
XOVND is not directed at children under 16. If you believe a child has signed up, contact us and we’ll delete the record.
Changes to this policy
We update this page when our processors, retention windows or legal basis change. The Last reviewed date at the top tells you when. Material changes will also be announced in the marquee at the top of the home page and (where we have your email) by email.
Contact
Joan Raventós — joan@xovnd.com