— Privacy
Privacy Policy
Last updated: June 26, 2026
This policy explains what personal data Orchestr collects, why, how long it is kept, who it is shared with, and what your rights are. We comply with the General Data Protection Regulation (GDPR) and the French Data Protection Act.
1. Data controller
The data controller is:
- Caustic Studio, SASU (French simplified joint-stock company), publisher of Orchestr, represented by Romain Lalire
- Registered office: 3 rue Paul de Kock, 75019 Paris, France
- Business ID (SIRET): 106 100 613 00012 — RCS Paris 106 100 613
- Contact: contact@orchestr.software
2. Data we collect
We only collect the data necessary to run the service. Depending on how you interact with Orchestr, this may include:
2.1 Newsletter signup
- Your email address.
Signup uses double opt-in: you receive a confirmation email to validate before being added to our list. No email is sent without this confirmation.
2.2 License purchase
- Your email address, name and billing address.
- Transaction data (amount, date, product, country).
- Your payment details (card) are processed directly by our payment provider Stripe. Orchestr never has access to them and does not store them.
2.3 License activation and validation
- Your email address and one or more hardware identifiers from your devices (an anonymous technical fingerprint), needed to bind your license to your devices and prevent fraudulent use.
2.4 Support and contact
- Your email address and the content of your messages when you write to us.
2.5 Technical browsing data
The site contains no analytics, advertising or tracking tools (no Google Analytics, no advertising pixel). Our host may keep technical logs (IP address, browser type) for security and operational purposes. Demo videos are served through Vimeo, which may set its own cookies when played (see section 8).
3. Purposes and legal bases
| Processing | Purpose | Legal basis |
|---|---|---|
| Newsletter | Inform you about Orchestr news and updates | Your consent |
| Purchase & billing | Sell you a license and issue the invoice | Contract performance + legal obligation (accounting) |
| License | Activate, validate and secure your license | Contract performance |
| Support | Respond to your requests | Legitimate interest |
| Site security | Prevent fraud and keep the service running | Legitimate interest |
4. Recipients and processors
We never sell or rent your data. It is shared only with the technical providers strictly necessary to the service:
| Provider | Role | Location |
|---|---|---|
| Brevo (Sendinblue SAS) | Newsletter and email delivery | European Union (France) |
| Stripe (Stripe Payments Europe Ltd.) | Payment processing | EU / United States |
| Vercel (Vercel Inc.) | Website and infrastructure hosting | United States |
| Vimeo (Vimeo Inc.) | Demo video delivery | United States |
5. Transfers outside the European Union
Some providers (Stripe, Vercel, Vimeo) are located in the United States. These transfers are covered by appropriate safeguards under the GDPR: the European Commission's Standard Contractual Clauses and/or membership of the Data Privacy Framework.
6. Retention periods
- Newsletter — until you unsubscribe (link in every email).
- Billing data — 10 years, in accordance with legal accounting obligations.
- License — for the entire validity period of the license.
- Support exchanges — 3 years after the last contact.
- Technical logs — a short period set by our host, for security purposes.
7. Your rights
Under the GDPR, you have the following rights over your data: the right of access, rectification, erasure, restriction, objection, portability, and the right to withdraw your consent at any time (notably by unsubscribing from the newsletter).
To exercise these rights, email us at contact@orchestr.software. We respond within one month at most.
If you believe your rights are not being respected, you may file a complaint with the French data protection authority, the CNIL — www.cnil.fr.
8. Cookies
The Orchestr website uses no analytics or advertising cookies. Only the following may be stored:
- strictly technical local storage items (for example remembering your language), which do not require consent;
- cookies set by Vimeo only if you start playing a demo video, subject to Vimeo's privacy policy.
9. Security
We implement reasonable technical and organizational measures to protect your data against unauthorized access, alteration or disclosure: encrypted connections (HTTPS), restricted access, and the use of reputable providers for payment and email.
10. Changes
This policy may be updated to reflect legal or technical changes. The last-updated date appears at the top of this page. In the event of a significant change, we will inform you by an appropriate means.
11. Contact
For any question about this policy or the processing of your data: contact@orchestr.software.