Privacy — the short version
The app is offline. Palpito never sends your music, your files, or anything about how you use it. No telemetry, no account. The one exception is yours to press: Check for updates… fetches a small version file from palpito.audio, which reveals your IP address to our host — like opening any web page. It never runs on its own.
The only personal data we ask for is your email, and we need it: it is the only way to send you the free app.
We will never use it for marketing. No promotional email, no launch campaigns, no pre-order or upgrade offers. You hear from us to get the app, to be told when a new version is out and how to get it, and when you write to us for help. We never sell or share your address.
If you buy Pro, we never see your payment details: Paddle is the seller and handles cards, invoices and refunds.
You can leave anytime — every email has an unsubscribe link, and deletion or export is one message to supporto@palpito.audio.
Privacy notice — Palpito
Controller: Palpito Audio Contact for any privacy matter: supporto@palpito.audio Applies to: the website palpito.audio and the Palpito desktop application Last updated: 13 September 2026
Information pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and to Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018 (the "Codice Privacy").
1. Who is responsible for your data
The data controller is Palpito Audio, the trading name under which Andrea Pierantoni operates as an individual author in Italy. You can reach the controller for any privacy matter — including any request under Articles 15 to 22 GDPR — at supporto@palpito.audio.
No Data Protection Officer has been appointed: the conditions in Article 37(1) GDPR are not met (no public-authority processing, no large-scale systematic monitoring, no large-scale processing of special categories). The address above reaches the controller directly.
2. What we collect, why, and on what legal basis
| What | When | Why | Legal basis |
|---|---|---|---|
| Email address | you request the free app | to send you the confirmation and the download link — the address is necessary to obtain the free download, because there is no other way to deliver it | Performance of a contract / pre-contractual measures — Art. 6(1)(b) |
| Email address | after you have it | to tell you when a new or security-related version is released and how to get it, and to answer your support requests | Consent — Art. 6(1)(a), given with an unticked box and a confirmation click, withdrawable at any time |
| Consent timestamp, confirmation click and its IP address, and the page you signed up from | at double opt-in | to prove a valid consent exists, as the GDPR requires us to | Legal obligation / accountability — Art. 6(1)(c) with Art. 7(1) |
| A pseudonymous handle derived from your email (keyed HMAC), the time a download link was issued and used, which release it was for, and a coarse platform (macOS/Windows) | when a download link is issued | to make each link single-use, to know how many people actually received the app, and to prevent abuse of the download system | Legitimate interests — Art. 6(1)(f) |
| IP address and standard server logs | whenever you visit the site, or the app checks for updates | to serve the site, keep it secure, and defend against attack | Legitimate interests — Art. 6(1)(f) |
| Anti-bot signal from Cloudflare Turnstile | when you submit a form | to stop automated abuse of the signup form | Legitimate interests — Art. 6(1)(f) |
| Your licence file and the email it was sent to | when you buy Pro | to create and deliver your licence and to support it | Performance of a contract — Art. 6(1)(b) |
Where we rely on legitimate interests, our interest is keeping a free download and a mailing list working without being abused. We have weighed that against your rights, we collect the minimum that achieves it, and you may object at any time under Article 21 GDPR by writing to supporto@palpito.audio.
What we will never do with your address
Your email address is used only for the technical and support purposes listed above. We will never use it to market or sell anything to you: no promotional messages, no launch announcements, no pre-order or upgrade campaigns, no newsletters. We will never sell, rent, or share your address with anyone for their own purposes. If we ever wanted to change that, we would have to ask you first, separately, and you would be free to say no.
What we do not collect
We do not collect your name, your postal address, your payment or card details, or anything about the music you make. We do not profile you, and we do not use advertising or analytics trackers of any kind — there is no Google Analytics, no tag manager, no advertising pixel on this site.
About the download record
The download ledger deliberately holds no email address and no IP address — only a one-way keyed handle derived from your address. Being honest about what that means: because the key is stable, that handle is pseudonymised data, not anonymous data, and it remains personal data under the GDPR (Recital 26). Your rights apply to it in full. We use it only to match a download link to the request that created it.
3. The application itself
Palpito runs entirely on your computer. It does not create an account, does not phone home, and transmits neither your MIDI files nor your projects nor any usage data. Its only network activity is the manual update check: when you press Check for updates…, the app requests a small version file from palpito.audio. That request necessarily discloses your IP address to our hosting provider, in the same way as loading any web page, and nothing else about you or your work is sent.
4. Who else processes your data
| Who | Role | What for | Where |
|---|---|---|---|
| Brevo (Sendinblue SAS) | Processor, under an Art. 28 agreement | sending the confirmation, the download link, new-version notices and support replies; storing the consent proof. The list held there is a technical and support list only — it is not used for campaigns | France (EU) |
| Cloudflare, Inc. | Processor, under an Art. 28 agreement | hosting the site (Pages), storing the app files (R2), the download ledger (D1), and the anti-bot check (Turnstile) | EU data locations; US parent company |
| Paddle.com Market Ltd | Independent controller for the payment, and processor for parts of the checkout | selling Palpito Pro as merchant of record: taking payment, issuing the invoice, handling VAT and refunds | UK / EU / US |
Paddle is the seller. If you buy Pro, Paddle collects and controls your payment and billing data for its own legal, tax and anti-fraud purposes, under its own privacy notice, and you exercise your rights in respect of that data directly with Paddle. Refund and billing questions go through Paddle, not through supporto@palpito.audio. We receive from Paddle only what we need to issue your licence.
We never sell personal data and never disclose it for anyone else's marketing. We may disclose data where we are legally obliged to, or to establish, exercise or defend a legal claim.
5. Transfers outside the EEA
Our email provider (Brevo) processes data in the European Union. Cloudflare serves this site from EU locations, but is a company established in the United States; Paddle operates from the United Kingdom and other countries. Where personal data is transferred outside the European Economic Area, that transfer is covered by an adequacy decision of the European Commission (for the United Kingdom), by the EU–US Data Privacy Framework where the recipient is certified, or otherwise by the European Commission's Standard Contractual Clauses, together with the additional safeguards required by Articles 44 to 49 GDPR. You can ask us for details at supporto@palpito.audio.
6. Storage on your device (cookies and similar)
This site sets no advertising, analytics or profiling cookies. It does use two kinds of local storage in your browser, which we disclose here because Article 5(3) of the ePrivacy Directive and Article 122 of the Codice Privacy apply to any storage on your device, not only to cookies:
| What | Why |
|---|---|
palpito_waitlist | remembers, in your browser only, that you already signed up, so the form does not ask you twice |
| Blind-test entries | on the listening-test pages, remembers your answer so the page can show you the result |
These are used solely to provide the function you asked for and are not used to track you, to build a profile, or to share anything with anyone. Cloudflare Turnstile, which checks that form submissions are not automated, does not use tracking cookies. You can clear this storage at any time in your browser settings; the only effect is that the site will forget you signed up.
7. How long we keep it
| What | How long |
|---|---|
| Email address and subscription record | until you unsubscribe or ask for deletion; then deleted without undue delay |
| Consent proof (timestamp, confirmation IP, source page) | 5 years after the consent ends, to be able to demonstrate it was validly given |
| Download ledger entries (pseudonymous handle, times, release, platform) | 12 months from issue — the link itself expires in 48 hours, so nothing beyond this is needed |
| Server and security logs | 12 months |
| Licence records for Pro purchases | for the life of the licence and 10 years thereafter — the accounting retention period under art. 2220 of the Italian Civil Code |
These periods are proposed and remain subject to the pending lawyer's review; if any changes, this notice will be updated and the date above will change. After these periods we delete or irreversibly anonymise the data, unless a longer period is required by law or to establish, exercise or defend a legal claim.
8. Your rights
Under Articles 15 to 22 GDPR you may ask us at any time to: access your data; rectify it; erase it; restrict its processing; object to processing based on legitimate interests (Art. 21); and receive it in a portable form (Art. 20). Where processing is based on consent, you may withdraw it at any time (Art. 7(3)) — this does not affect processing carried out before you withdrew it. Every email we send carries an unsubscribe link.
Write to supporto@palpito.audio. We answer within one month, as Article 12(3) requires.
You also have the right to lodge a complaint with the Italian supervisory authority — the Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Roma, www.garanteprivacy.it — or with the authority of the EU country where you live or work (Art. 77).
9. Is providing your data mandatory?
You are never obliged to give us your email address — but it is necessary if you want the free app, because sending you the download link is the only way we can deliver it, and there is nowhere else to send it. If you prefer not to provide it, you simply do not receive the download and the new-version notices; nothing else follows.
Once you have the application, it needs no personal data at all to run — it works offline, with no account.
10. Automated decision-making
We do not carry out automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you (Art. 22).
11. Children
This site and this application are not directed at children. In Italy, consent to information-society services is valid from the age of 14 (Art. 8 GDPR; Art. 2-quinquies Codice Privacy). If you are below that age, please do not send us your email address. If we learn that we hold the data of a child below that age without the consent of a parent or guardian, we will delete it.
12. Security
Download links are single-use and expire after 48 hours; the app files are held in private storage with no public URL; the download ledger holds no email address and no IP address; and the application is signed and notarised by Apple. No system is perfectly secure, but personal data here is kept to the minimum that makes the service work.
13. Changes to this notice
We may update this notice. The "last updated" date will change, and for material changes affecting people on our list we will say so by email.
About this notice
⚠️ This notice was prepared with AI assistance, on the basis of the GDPR, the Codice Privacy and the Garante's guidelines on cookies and other tracking tools (10 June 2021), and is awaiting review by a qualified Italian/EU lawyer. Everything stated above is truthful and describes what we actually do; the legal wording may be refined after that review, and this notice will be updated if it changes — the "last updated" date will tell you. This is not legal advice. Questions: supporto@palpito.audio.