Privacy Policy

Intrect builds audio plug-ins (de-artifact, de-leak-rt, Intrect HPSS) and a related licensing service. This policy explains what personal data we collect when you visit intrect.io, install one of our plug-ins, or purchase a license — and what we do with it.

Operator. This service is operated by INTRECT (business registration number 107-36-71163), based at 서울 중구 충무로 5길 2, Seoul, Republic of Korea. For privacy questions, open a support ticket.

1. What we collect

When you buy a license (Paddle)

Payments are processed by Paddle.com Market Limited as our Merchant of Record. They collect your name, email, billing address, country, IP, and card details to charge the order, calculate tax, and comply with anti-fraud regulation. We receive a subset of this from Paddle webhooks: order ID, plugin purchased, billing email, country code, and the Paddle customer ID. We never see your card number. Paddle's own privacy notice: paddle.com/legal/privacy.

When you activate a plug-in

The plug-in talks to license.intrect.io with three pieces of data:

• The license key we emailed you after purchase.
• A 32-character machine fingerprint derived from your hardware (macOS IOPlatformUUID, Linux machine-id, or Windows wmic UUID + hostname, hashed with SHA-256). This is not your IP address.
• The plug-in name being activated (e.g. de-artifact).

We store this in a Cloudflare D1 database to track which seats are active, enforce the per-license seat limit, and re-issue blobs when they expire. The fingerprint cannot be reversed back to your hardware ID.

When you download an installer

The download server (downloads.intrect.io) writes one row per request to a separate analytics database. The row contains: timestamp, the file path, request method, HTTP status, bytes streamed, country, Cloudflare colo code, browser User-Agent, Referer, and a salted, truncated hash of your IP. The salt rotates daily, so cross-day visitor correlation is not possible from the stored data alone. Raw rows are deleted after 30 days; only daily aggregates (counts per file, country, etc.) are kept long-term.

When you request a free plug-in from your Intrect account

Intrect HPSS requires you to sign in through app.intrect.io before requesting a download. We do not create a separate HPSS account. The download service verifies your existing Intrect session and stores your Intrect account ID and email, the plug-in requested, request and delivery timestamps, country code, and a daily salted IP hash. The private link contains only the account identifier and an expiring signature; it does not contain your email address. The link permits the installer download for seven days. When the installer is downloaded, Intrect receives a private operational notification containing your account email and download details; that email address is not added to the public URL or general download-event log.

The delivery email is transactional and does not add you to a marketing list. Delivery/rate-limit events retain only truncated hashes of the account ID and IP address, not a second copy of the email.

When you visit the website

We use Cloudflare for hosting, DNS, and CDN — Cloudflare logs request metadata for security and abuse mitigation. We use Google Tag Manager and Google Analytics on public Intrect marketing pages for site-traffic measurement; Analytics uses first-party cookies and IP truncation. We use Cloudflare Turnstile on other product download gates to block bot scraping; Turnstile reads limited browser environment information and does not track you across sites.

When you contact us

Outbound transactional email (license keys, password resets, etc.) is sent through Resend. Support requests you submit at our help center are stored (Cloudflare D1) and read by the operator. We do not run a mailing list at this time.

To answer support requests faster we use a language model to prepare a draft reply for the operator. The ticket subject and message are sent for that purpose to OpenRouter, which routes the request to Atlas Cloud as the model provider; Cloudflare Workers AI is used as a fallback if that route is unavailable. Your email address is not included in what we send. No draft is ever sent to you automatically — the operator reviews, edits and sends every reply. If you would rather your ticket was not processed this way, say so in the ticket and we will handle it manually.

When you open a support ticket

A ticket may contain your email address, product, operating-system details, optional license key, subject, and message. We store the ticket in Cloudflare D1, send the confirmation and replies through Resend, and create a matching internal issue in Linear so our support team can investigate and respond. Do not include payment-card data or other sensitive information in a ticket. License keys are optional; enter one only when it is needed to investigate an activation problem.

When you use the de-artifact online preview

The preview uploads the audio file and filename you choose to deartifact.intrect.io for processing. The file is held in Cloudflare R2 and is made available to the processing worker through a short-lived signed URL; if the local worker is unavailable, the same processing job may run on RunPod. The input and preview result are deleted after the preview is returned; an R2 lifecycle rule removes abandoned preview objects within two days. Do not upload audio you do not have the right to process.

When you use Support Assistant

The authenticated Support Portal can answer common product questions before you create a support ticket. To provide that immediate answer, we send the product you select and the question you enter to support.intrect.io, where Cloudflare Workers AI processes it against an Intrect-curated product knowledge pack. If that service cannot return a valid structured answer, the same redacted input is sent to OpenRouter's DeepSeek V4 Flash service as a fallback. That request is restricted to an OpenRouter Zero Data Retention (ZDR) endpoint; if no such endpoint is available, it fails closed rather than sending the question to a non-ZDR provider. Your account email is used only to verify that you may use the portal; it is not included in the model prompt. We also redact common email, telephone, and license-key patterns before the model request. Please do not enter any other personal, payment, order, or sensitive information. The assistant accepts only product-support questions; it does not browse, execute code, access account data, or follow instructions embedded in a question.

Intrect does not write Support Assistant questions or answers to our support-ticket database, Linear, or email system, and asking a question does not create a ticket. Cloudflare processes the content to provide Workers AI; Cloudflare states that it does not use Workers AI customer content to train its models or improve Cloudflare or third-party services without explicit consent. The assistant can be wrong or unable to verify a case, so it routes account, billing, security, privacy, delivery, and uncertain questions to the ticket form instead of making a decision about you.

2. Why we hold it

• License delivery + seat enforcement — without the email and machine fingerprint we cannot tell whose license a request belongs to.
• Free plug-in delivery — your authenticated Intrect account determines where to send the signed installer link and prevents unrestricted direct downloads.
• Pre-ticket support assistance — answer routine product questions without creating a support ticket; it is not used for automated decisions about you.
• Refunds + tax compliance — Paddle requires the order metadata for the statutory retention period in the buyer's country.
• Service operation + abuse mitigation — request logs let us detect mass scraping or license abuse.
• Legitimate interest in product improvement — aggregate download counts tell us which installer builds are actually used.

3. Who else sees it

• Paddle — payment processing.
• Cloudflare — hosting (Workers, R2, D1, Pages), DNS, bot protection, and Workers AI processing for Support Assistant. See Cloudflare's Workers AI data-usage documentation.
• OpenRouter (routing to Atlas Cloud) — AI processing in two places: as the fallback for Support Assistant when the Cloudflare model cannot return a valid answer, where it receives only the selected product and the redacted question and is restricted to a Zero Data Retention (ZDR) endpoint; and to draft a support-ticket reply for the operator to review, where it receives the ticket text only. Not used for any other data. See OpenRouter's Privacy Policy.
• Resend — outbound email.
• Linear — internal support-ticket tracking. Ticket fields are copied to the issue so the support team can investigate and reply.
• RunPod — GPU processing for the de-artifact online preview when the local processing worker is unavailable. It receives short-lived access to that preview job's audio input and result.
• Google — Tag Manager / Analytics on the public site only (not in the plug-in or on license.intrect.io).

We do not sell or rent personal data to third parties.

4. How long we keep it

• License records and Paddle order metadata: as long as the license is active, plus the period required for refunds and tax (typically 5–10 years depending on jurisdiction).
• Raw download analytics events: 30 days, then deleted.
• Free plug-in delivery records: 24 months after the last link request, then deleted. Delivery/rate-limit events are deleted after 30 days.
• Daily aggregates derived from those events: indefinitely (no personal data, only counts and country codes).
• Support Assistant questions and answers: not retained by Intrect as a ticket, Linear record, or email. They are processed only to return the immediate answer; Cloudflare and OpenRouter handling is described in their linked provider documentation.
• Support tickets and their message threads: 24 months from ticket creation, then deleted from our support database. Internal Linear issues and outbound email may follow the retention settings of those providers.
• de-artifact online-preview audio: deleted from our R2 processing bucket after the preview is returned; abandoned preview objects expire within two days. Preview request metadata (daily salted IP hash, filename, size, status, and job ID) is retained for 30 days for abuse prevention and reliability work.
• Email correspondence: until the matter is resolved, plus a reasonable archival period.

5. Your rights

Depending on where you live (GDPR / Korea PIPA / CCPA / etc.) you can ask us to:

• Confirm what data we hold about you and supply a copy.
• Correct anything that's wrong.
• Delete your data — subject to retention obligations from Paddle and tax law.
• Stop processing for a particular purpose (e.g. analytics).

Submit the request via our help center. We respond within 30 days and will not charge a fee for reasonable requests.

6. Children

Intrect is sold to professional musicians and audio engineers; we do not knowingly collect data from anyone under 14. If you believe a minor's data has reached us, write to us and we'll delete it.

7. Cookies

The marketing site (intrect.io) uses cookies set by Cloudflare (security) and Google Tag Manager (anonymous traffic measurement). The download server uses no cookies. The licensing API and the plug-in itself use no cookies.

8. Changes to this policy

Material changes will be announced on the homepage and dated at the top of this document. The Last updated field is authoritative.

See also Terms of Service and Third-Party Notices.