Privacy Policy

Intrect builds audio plug-ins (de-artifact, de-leak-rt, Intrect HPSS) and a related licensing service. This policy explains what personal data we collect when you visit intrect.io, install one of our plug-ins, or purchase a license — and what we do with it.

Operator. This service is operated by INTRECT (business registration number 107-36-71163), based at 서울 중구 충무로 5길 2, Seoul, Republic of Korea. For privacy questions, open a support ticket.

1. What we collect

When you buy a license (Paddle)

Payments are processed by Paddle.com Market Limited as our Merchant of Record. They collect your name, email, billing address, country, IP, and card details to charge the order, calculate tax, and comply with anti-fraud regulation. We receive a subset of this from Paddle webhooks: order ID, plugin purchased, billing email, country code, and the Paddle customer ID. We never see your card number. Paddle's own privacy notice: paddle.com/legal/privacy.

When you activate a plug-in

The plug-in talks to license.intrect.io with three pieces of data:

• The license key we emailed you after purchase.
• A 32-character machine fingerprint derived from your computer (the computer's name, plus macOS IOPlatformUUID, Linux machine-id, or Windows MachineGuid, hashed with SHA-256). This is not your IP address.
• The plug-in name being activated (e.g. de-artifact).

We store this in a Cloudflare D1 database to track which seats are active, enforce the per-license seat limit, and re-issue blobs when they expire. The fingerprint cannot be reversed back to your hardware ID. Starting the free trial sends the fingerprint and plug-in name only (there is no key yet), and we store them with the trial dates so a machine gets one trial per plug-in.

When a plug-in reports how it is used

About once a day, a licensed or trial plug-in sends license.intrect.io a short usage report:

• The same machine fingerprint and plug-in name as above.
• The plug-in format it is running as (VST3, CLAP, AU or standalone).
• Your operating system (macOS, Windows or Linux) and CPU type (for example x86_64 or aarch64).
• The name of the host program that loaded the plug-in (for example Ableton Live or REAPER). The plug-in reads only the program's file name, never its folder path, and our server keeps a name only if it matches a list of known host programs; anything else is stored as “other”.
• The plug-in version.

It does not include audio, project or file names, your account, your email address, or your location. We do not store your IP address or country for these reports: the address is used only to rate-limit requests and is kept as a one-way hash for about two days. The reports go to our own database, not to Google or another analytics vendor.

This is on by default and separate from licensing. To turn it off, clear Share anonymous usage info in the plug-in's License panel, or set the environment variable INTRECT_NO_TELEMETRY=1. Your trial, license and updates work the same either way. Reports are tied to a machine fingerprint rather than a name, but because that fingerprint also appears in your license record we treat them as personal data.

When you download an installer

The download server (downloads.intrect.io) writes one row per request to a separate analytics database. The row contains: timestamp, the file path, request method, HTTP status, bytes streamed, country, Cloudflare colo code, browser User-Agent, Referer, and a salted, truncated hash of your IP. The salt rotates daily, so cross-day visitor correlation is not possible from the stored data alone. Raw rows are deleted after 30 days; only daily aggregates (counts per file, country, etc.) are kept long-term.

When you request a free plug-in from your Intrect account

Intrect HPSS requires you to sign in through app.intrect.io before requesting a download. We do not create a separate HPSS account. The download service verifies your existing Intrect session and stores your Intrect account ID and email, the plug-in requested, request and delivery timestamps, country code, and a daily salted IP hash. The private link contains only the account identifier and an expiring signature; it does not contain your email address. The link permits the installer download for seven days. When the installer is downloaded, Intrect receives a private operational notification containing your account email and download details; that email address is not added to the public URL or general download-event log.

The delivery email is transactional and does not add you to a marketing list. Delivery/rate-limit events retain only truncated hashes of the account ID and IP address, not a second copy of the email.

Product-update email is separate and optional. When you create an Intrect account, the sign-in page shows an unticked checkbox; Intrect sends its own product updates only if you tick it, records that choice with the time and the wording you saw, and stops at once if you use the unsubscribe link in any update. Accounts created before 1 October 2026 were never shown the box, and we do not send them product updates unless they opt in. Every update is marked as advertising, names us as the sender, and is not sent between 21:00 and 08:00 Korea time. Details are in the account privacy policy (§ 2.1a).

When you visit the website

We use Cloudflare for hosting, DNS, and CDN — Cloudflare logs request metadata for security and abuse mitigation. We use Google Analytics on the Intrect website and dashboard for site-traffic and funnel measurement; Analytics uses first-party cookies and IP truncation. Intrect also keeps bounded first- and last-touch campaign labels for up to 90 days so a checkout can retain its originating visit across Intrect subdomains. If you create an account, we copy that bounded snapshot and the current Google Analytics client/session identifiers to the account so signup, first use, and purchase can be measured as one funnel. It contains landing paths, referrer hostnames, campaign labels, and advertising click-identifier type, never the click identifier value or a full referrer URL. Later visits do not overwrite the original signup attribution. When an installer download succeeds, the download service copies only the anonymous attribution identifier into its 30-day raw event log, not the campaign fields stored in the cookie. When an Intrect payment completes (an ArtifactNet plan or top-up, plug-in licence, or Clean Audio top-up), we also send Google Analytics a server-confirmed purchase measurement and delivery marker, a refund measurement and marker for each approved Paddle refund adjustment, and bounded adjustment, transaction, and subscription lifecycle markers. These contain Paddle transaction/event/adjustment identifiers, product category, status, currency, amount, tax, and the bounded analytics/attribution identifiers above. They contain no email, card data, or raw Paddle payload; each retry record is kept for no more than 400 days whether delivery succeeds or fails. We use Cloudflare Turnstile on other product download gates to block bot scraping; Turnstile reads limited browser environment information and does not track you across sites.

For a signed-in dashboard session or API-key request, we also keep one account activity date per Korea Standard Time day. This daily record contains only the account ID and date — no endpoint, IP address, browser identifier, or request count — and is used to measure account retention.

When you contact us

Outbound transactional email (license keys, password resets, etc.) is sent through Resend. Support requests you submit at our help center are stored (Cloudflare D1) and read by the operator. Product-update email goes only to accounts that opted in, as described above.

To answer support requests faster we use a language model to prepare a draft reply for the operator. The ticket subject and message are sent for that purpose to OpenRouter, which routes the request to Atlas Cloud as the model provider; Cloudflare Workers AI is used as a fallback if that route is unavailable. Your email address is not included in what we send. No draft is ever sent to you automatically — the operator reviews, edits and sends every reply. If you would rather your ticket was not processed this way, say so in the ticket and we will handle it manually.

When you open a support ticket

A ticket may contain your email address, product, operating-system details, optional license key, subject, and message. We store the ticket in Cloudflare D1, send the confirmation and replies through Resend, and create a matching internal issue in Linear so our support team can investigate and respond. Do not include payment-card data or other sensitive information in a ticket. License keys are optional; enter one only when it is needed to investigate an activation problem.

When you use the de-artifact online preview

The preview uploads the audio file and filename you choose to deartifact.intrect.io for processing. The file is held in Cloudflare R2 and is made available to the processing worker through a short-lived signed URL. The worker runs on our own hardware and pulls the job itself; no third-party GPU provider receives the file. The input and preview result are deleted after the preview is returned; an R2 lifecycle rule removes abandoned preview objects within two days. Do not upload audio you do not have the right to process.

When you use Support Assistant

The authenticated Support Portal can answer common product questions before you create a support ticket. To provide that immediate answer, we send the product you select and the question you enter to support.intrect.io, where Cloudflare Workers AI processes it against an Intrect-curated product knowledge pack. If that service cannot return a valid structured answer, the same redacted input is sent to OpenRouter's DeepSeek V4 Flash service as a fallback. That request is restricted to an OpenRouter Zero Data Retention (ZDR) endpoint; if no such endpoint is available, it fails closed rather than sending the question to a non-ZDR provider. Your account email is used only to verify that you may use the portal; it is not included in the model prompt. We also redact common email, telephone, and license-key patterns before the model request. Please do not enter any other personal, payment, order, or sensitive information. The assistant accepts only product-support questions; it does not browse, execute code, access account data, or follow instructions embedded in a question.

Intrect does not write Support Assistant questions or answers to our support-ticket database, Linear, or email system, and asking a question does not create a ticket. Cloudflare processes the content to provide Workers AI; Cloudflare states that it does not use Workers AI customer content to train its models or improve Cloudflare or third-party services without explicit consent. The assistant can be wrong or unable to verify a case, so it routes account, billing, security, privacy, delivery, and uncertain questions to the ticket form instead of making a decision about you.

2. Why we hold it

• License delivery + seat enforcement — without the email and machine fingerprint we cannot tell whose license a request belongs to.
• Free plug-in delivery — your authenticated Intrect account determines where to send the signed installer link and prevents unrestricted direct downloads.
• Pre-ticket support assistance — answer routine product questions without creating a support ticket; it is not used for automated decisions about you.
• Refunds + tax compliance — Paddle requires the order metadata for the statutory retention period in the buyer's country.
• Service operation + abuse mitigation — request logs let us detect mass scraping or license abuse. They also let us apply the free analysis allowance per person rather than per account: where accounts share a mailbox or have recently used the same network address, we may treat them as one person and decline to re-analyse audio one of them has already analysed. This affects the free allowance only, never paid plans, and a support ticket reaches a human.
• Browser identifier — alongside each request we store a short one-way hash of request headers your browser already sends (User-Agent, language, encodings, and the Sec-CH-UA client hints). We use it for one thing: telling "two accounts on one office connection", which is normal, apart from "two accounts in one browser", which is not. It is not canvas, WebGL, font or device fingerprinting — no script runs on your machine to produce it, it is derived only from headers we already receive, and it cannot be reversed into those headers. It is deleted with the request log after 30 days.
• Legitimate interest in product improvement — aggregate download counts tell us which installer builds are actually used. The plug-in usage report tells us which formats, host programs and operating systems to test and support; you can turn it off at any time.

3. Who else sees it

• Paddle — payment processing, as our Merchant of Record.
• Neon (managed PostgreSQL) — hosts the account database: your account record, usage history and credit ledger.
• Upstash (managed Redis) — short-lived operational data such as rate-limit counters and the one-hour demo result cache.
• Cloudflare — hosting (Workers, R2, D1, Pages), DNS, bot protection, and Workers AI processing for Support Assistant. See Cloudflare's Workers AI data-usage documentation.
• OpenRouter (routing to Atlas Cloud) — AI processing in two places: as the fallback for Support Assistant when the Cloudflare model cannot return a valid answer, where it receives only the selected product and the redacted question and is restricted to a Zero Data Retention (ZDR) endpoint; and to draft a support-ticket reply for the operator to review, where it receives the ticket text only. Not used for any other data. See OpenRouter's Privacy Policy.
• Resend — outbound email.
• Linear — internal support-ticket tracking. Ticket fields are copied to the issue so the support team can investigate and reply.
• Google and GitHub — sign-in, if you choose to sign in with them.
• Google — Analytics on the website and dashboard, and server-side measurement events from license.intrect.io when a plug-in trial starts or a licence is issued or activated. Those events name the plug-in and the milestone and are keyed by a one-way hash of the machine fingerprint or licence key, never the key itself. When a plug-in shows a trial or purchase prompt, the licence service also relays an impression event (product, plug-in version and trial-day bucket) keyed by a daily one-way hash of the network address. The plug-in never contacts Google directly.

We do not sell or rent personal data to third parties.

4. How long we keep it

• License records and Paddle order metadata: as long as the license is active, plus the period required for refunds and tax (typically 5–10 years depending on jurisdiction).
• Account signup acquisition snapshot: until you delete the account.
• Free-trial records (machine fingerprint, plug-in, trial dates): kept while we offer trials, so that a machine is not given a second trial of the same plug-in.
• Plug-in usage reports (fingerprint, plug-in, format, host, OS, version, first and last report dates, count): 365 days after the last report, then deleted.
• Raw download analytics events: 30 days, then deleted.
• API request logs (timestamp, path, status, your account ID, IP address, browser identifier): 30 days, then deleted. This is the window the per-person free allowance is calculated over.
• Per-account activity dates (account ID and KST date only): 365 days or until you delete the account, whichever comes first.
• Free plug-in delivery records: 24 months after the last link request, then deleted. Delivery/rate-limit events are deleted after 30 days.
• Daily aggregates derived from those events: indefinitely (no personal data, only counts and country codes).
• Support Assistant questions and answers: not retained by Intrect as a ticket, Linear record, or email. They are processed only to return the immediate answer; Cloudflare and OpenRouter handling is described in their linked provider documentation.
• Support tickets and their message threads: 24 months from ticket creation, then deleted from our support database. Internal Linear issues and outbound email may follow the retention settings of those providers.
• de-artifact online-preview audio: deleted from our R2 processing bucket after the preview is returned; abandoned preview objects expire within two days. Preview request metadata (daily salted IP hash, filename, size, status, and job ID) is retained for 30 days for abuse prevention and reliability work.
• Email correspondence: until the matter is resolved, plus a reasonable archival period.

5. Your rights

Depending on where you live (GDPR / Korea PIPA / CCPA / etc.) you can ask us to:

• Confirm what data we hold about you and supply a copy.
• Correct anything that's wrong.
• Delete your data — subject to retention obligations from Paddle and tax law.
• Stop processing for a particular purpose (e.g. analytics).

Submit the request via our help center. We respond within 30 days and will not charge a fee for reasonable requests.

6. Children

Intrect is sold to professional musicians and audio engineers; we do not knowingly collect data from anyone under 16. If you believe a minor's data has reached us, write to us and we'll delete it.

7. Cookies

The marketing site (intrect.io) uses cookies set by Cloudflare (security) and Google Tag Manager (anonymous traffic measurement). The download server uses no cookies. The licensing API and the plug-in itself use no cookies.

8. Changes to this policy

Material changes will be announced on the homepage and dated at the top of this document. The Last updated field is authoritative.

See also Terms of Service and Third-Party Notices.