Privacy Policy
Last updated: 20 October 2026
Neva DSP develops professional audio plug-ins. Neva DSP is based in Türkiye and is legally represented by Hüseyin Oğuz Yaşar, who is responsible for the data described on this page. Wherever this page says "we", "us" or "Neva DSP", it means Neva DSP, operated by Hüseyin Oğuz Yaşar.
This policy covers the website at nevadsp.com, our licence server, and the PINCH-76 plug-in. It explains what personal data we handle, why we need it, who else sees it, how long we keep it, and what you can ask us to do with it. Cookies are covered in more detail in our Cookie Policy. If anything here is unclear, write to [email protected] and ask. You'll get an answer from the person who wrote it.
The short version
- We don't sell personal data, and there are no ads on our website.
- Analytics and advertising cookies are used only if you accept them in our cookie banner. Until you do, they don't load at all.
- Payments go through Paddle. We never see your card or bank details.
- To deliver and protect your licence, we keep your name, your e-mail address, your licence key and a short record of each computer you activate.
- PINCH-76 talks to our server only to activate, to re-check your licence about once a week, and (unless you switch it off) to look for updates. It never sends audio, project names, file names or usage statistics.
The rest of this page gives the details.
1. Who is responsible for your data
The data controller, under the EU and UK GDPR and under Türkiye's Personal Data Protection Law No. 6698 (KVKK), is:
Hüseyin Oğuz Yaşar, trading as Neva DSP Karşıyaka Mah. 1627 Sk. No 12/1, Afyonkarahisar, Türkiye E-mail: [email protected]
There is no separate data protection officer. Privacy questions come straight to the owner at the addresses above.
[IF APPOINTED: name and address of our representative in the EU and in the UK]
2. What we collect, and why
When you buy or claim a licence
Our checkout is run by Paddle (see section 4). You enter your payment details on Paddle's checkout, not on our site, and Paddle handles them as an independent controller under its own privacy notice.
When an order is complete, Paddle passes us:
- your name and e-mail address;
- your country;
- Paddle's order and customer reference numbers;
- what you bought: product, quantity, price paid and any discount code used.
If you type a name on our site before checkout for the "Licensed to" line, we receive that too.
We use these details to create your licence key (or keys, if you buy more than one), e-mail them to you with the download link, show "Licensed to" followed by your name in the plug-in's About screen, answer questions about your order, cancel keys when an order is refunded or charged back, and keep the business records the law requires.
The same applies to free licences given out during launch week. There, your e-mail address is also how we check the limit of one free licence per address.
When we e-mail your licence key
Licence e-mails are sent by our own licence server through Resend, an e-mail delivery service. Resend handles your e-mail address and the content of the message so that it reaches you, and keeps short delivery logs.
If you lose your key, you can enter your e-mail address in the "Lost your key?" form on our site and we'll send all keys linked to that address again. We log each request (e-mail address, time and IP address) so the form can't be used to flood someone's inbox.
When you activate PINCH-76
Activation needs an internet connection once per computer. The plug-in sends our licence server, over an encrypted connection:
- the e-mail address and licence key you typed in;
- a machine ID;
- your operating system version and the plug-in version.
The server records when the activation happened. Your IP address appears in our server logs.
The machine ID is a one-way hash worked out from identifiers of your computer. We can't turn it back into your hardware details, and it doesn't tell us who you are. It does two jobs: it lets us count how many computers a licence is using (the limit is three at once), and it locks the activation to that computer so a copied licence file won't work somewhere else.
When you choose Deactivate this computer in the plug-in menu, the plug-in tells the server to free that computer's slot. We record the date, because each licence can be reset up to six times a year.
After activation, PINCH-76 checks its licence in the background about every fourteen days. That check sends the licence key, the machine ID and the plug-in version. If our server can't be reached, the plug-in keeps working offline for up to 30 days.
If one key is activated from many different places in a short time, the server can pause it automatically and alert us. A person looks at every paused key before anything permanent happens. If you think your key was paused by mistake, write to us and we'll sort it out.
When the plug-in checks for updates
Unless you switch it off, PINCH-76 looks for a newer version when you open its window, at most once a day. It downloads a small signed file from our website that names the latest version.
That request carries no licence key, e-mail address or machine ID. Our server sees your IP address and a short line naming the plug-in version and operating system, for example PINCH-76/1.0.4 (Windows).
To switch it off, open the plug-in menu (☰) and untick Check for updates.
Files that stay on your computer
PINCH-76 keeps its settings, your presets, its licence file and its log files on your own computer (on Windows, in %APPDATA%\Neva DSP\PINCH-76 and Documents\Neva DSP). None of this is uploaded.
The log files exist to help with troubleshooting. They are never sent anywhere automatically. If you attach one to a support e-mail, we treat it like the rest of your message. They are plain text, so feel free to read one before you send it. They can contain file paths, and a file path on Windows often includes your user name.
The plug-in does not collect audio, project or file names, usage statistics or crash reports, and it contains no advertising or third-party tracking code.
When you contact us
If you e-mail [email protected] or use the contact form, we receive your name, your e-mail address, your message and anything you attach. Contact form messages are delivered to the same support inbox, and the form's server logs your IP address to keep spam out.
E-mail to our address is forwarded by Cloudflare Email Routing and stored in our mailbox at Google (Gmail).
When you subscribe to the newsletter
If you enter your e-mail address in the newsletter form, we store the address, the date and time you signed up and confirmed, and the IP address used to confirm. We first send one e-mail asking you to confirm; nothing else is sent until you click the link in it. After that we send news about our plug-ins, updates and mixing articles, about once a month. Every e-mail has a one-click unsubscribe link, and you can also write to [email protected]. We use your consent as the legal reason, and you can withdraw it at any time. The newsletter list is kept in our Cloudflare database and the e-mails are sent through Resend.
When you visit the website
Hosting. The website is hosted on Cloudflare. To deliver pages and protect the site from attacks, Cloudflare processes technical data such as your IP address, browser type and the pages you request. If Cloudflare needs to check whether a visitor is a real person, it may set a short-lived security cookie.
Your cookie choice. On your first visit, a banner asks whether you accept analytics and advertising cookies. You can accept all, reject all, or choose by category under Settings. We store your choice on your device so we don't ask again on every page. You can change it at any time through the Cookie settings link at the bottom of every page.
Analytics (only if you accept). If you accept analytics cookies, we use Google Analytics 4 to understand how the site is used: which pages are read, how visitors found us, roughly where they are and what devices they use. Google Analytics sets cookies that give your browser a random identifier, and it sends Google details of your visit such as the pages you view, your browser and device, and the referring site. Google states that for visitors in the EU, Switzerland and the UK, IP addresses are used only to work out an approximate location and are then deleted, never logged or stored. We have switched off Google signals and do not share Analytics data with Google for its own purposes.
Advertising (only if enabled, and only if you accept). We may advertise PINCH-76 on Google and, later, on Meta platforms (Facebook and Instagram). If we switch on Google Ads conversion tracking or the Meta Pixel and you accept advertising cookies, these tools record that you visited our site after seeing an ad, or that you bought a licence, so we can tell which ads work. They may also let us show our ads to people who have visited the site before. Google and Meta can link this information with what they already know about you, under their own privacy policies.
How the banner works. We use Google Consent Mode in its basic form: all Google tags start in a "denied" state and are not loaded at all until you make a choice. If you reject, or simply close the banner, no analytics or advertising data is sent to Google or Meta. If your browser sends a Global Privacy Control signal, we treat it as a rejection of advertising cookies.
Paddle. When you open the checkout, Paddle's checkout window loads from Paddle's servers. Paddle may use its own necessary cookies there, as described in its privacy notice and the cookie notice linked from it.
The Cookie Policy lists every cookie by name, with its purpose, provider and lifetime.
What we don't do
We don't send marketing e-mails unless you subscribe to the newsletter yourself.
3. Our legal reasons for using your data
EU and UK data protection law (the GDPR and UK GDPR) and Turkish law (KVKK) each require a legal basis for every use of personal data. These are ours:
| What we do | GDPR / UK GDPR | KVKK |
|---|---|---|
| Create and send licence keys, run activation, licence checks and deactivation, show "Licensed to", provide support to licence holders | Performance of our contract with you (Art. 6(1)(b)) | Necessary for the performance of a contract (Art. 5(2)(c)) |
| Keep order and income records | Legal obligation under Turkish tax and bookkeeping law (Art. 6(1)(c)) | Legal obligation (Art. 5(2)(ç)) |
| Stop key sharing and fraud, keep security logs, deal with chargebacks and disputes | Legitimate interests (Art. 6(1)(f)): protecting our business and our customers from misuse and being able to defend our rights | Legitimate interests (Art. 5(2)(f)); establishing, exercising or defending a right (Art. 5(2)(e)) |
| Update check | Legitimate interests (Art. 6(1)(f)): telling you about fixes and new versions. You can switch it off at any time | Legitimate interests (Art. 5(2)(f)) |
| Answer messages from people who haven't bought anything | Legitimate interests (Art. 6(1)(f)): replying to what you asked us | Legitimate interests (Art. 5(2)(f)) |
| Host and secure the website, remember your cookie choice | Legitimate interests (Art. 6(1)(f)): running a secure site and remembering what you chose | Legitimate interests (Art. 5(2)(f)) |
| Newsletter | Your consent (Art. 6(1)(a)), given in the sign-up form and confirmed by e-mail | Your explicit consent (Art. 5(1)) |
| Google Analytics | Your consent (Art. 6(1)(a)), given in the cookie banner | Your explicit consent (Art. 5(1)) |
| Google Ads conversion tracking and remarketing, Meta Pixel | Your consent (Art. 6(1)(a)), given in the cookie banner | Your explicit consent (Art. 5(1)) |
Analytics and advertising cookies also need your consent under the EU ePrivacy rules and the UK's PECR, because they store and read information on your device.
You can withdraw consent at any time through Cookie settings. Withdrawing doesn't affect what happened before, but from then on those tools stop loading. Where we rely on legitimate interests, you can object (see section 8).
Do you have to give us this data? You need to give an e-mail address to receive a licence key, and the plug-in has to send activation data for the licence to work. Without them, PINCH-76 stays in trial mode. The update check, the newsletter, analytics cookies and advertising cookies are all optional. Saying no to them changes nothing about what you can do on the site.
How we collect it. By automated means: through Paddle's checkout, our website, its forms and (if you accept them) cookies, the plug-in's connections to our server, and e-mail.
4. Who else receives your data
We use a small number of services to run the business. Each gets only what it needs.
| Who | What they do for us | Data involved | Where |
|---|---|---|---|
| Paddle (Paddle.com Market Limited, UK; Paddle.com Inc. for buyers in the US; Paddle.com (Canada) Ltd for buyers in Canada) | Our reseller and Merchant of Record: checkout, payment, tax, receipts, refunds and chargebacks. Paddle acts as an independent controller. We may tell Paddle about your licence status when handling a refund or dispute. | Order and payment details, name, e-mail, country | UK, US and Canada |
| Cloudflare, Inc. | Website hosting (Pages), licence server (Workers), licence database (D1), e-mail forwarding (Email Routing) | Licence records, activation records, server logs, forwarded e-mail | US and Cloudflare's global network |
| Resend, Inc. | Sending licence e-mails and, if you subscribe, the newsletter | E-mail address, e-mail content, delivery logs | US |
| Google (Gmail) | Our support mailbox | Support e-mails and contact form messages | United States |
| Google (Google Ireland Limited for visitors in the EEA and UK; Google LLC elsewhere) | Google Analytics 4, and Google Ads conversion tracking if enabled. Only if you accept cookies. For Analytics, Google acts as our processor. For some advertising measurement, Google acts as an independent controller under its own terms. | Cookie identifiers, pages visited, device and browser data, approximate location, ad clicks and purchases on our site | EU and US |
| Meta (Meta Platforms Ireland Limited for visitors in the EEA and UK; Meta Platforms, Inc. elsewhere) | Meta Pixel, only if we enable it and you accept advertising cookies. We and Meta are joint controllers for collecting the data on our site and sending it to Meta; after that, Meta is responsible for what it does with it. | Cookie identifiers, pages visited, device and browser data, ad clicks and purchases on our site | Ireland and US |
| Our accountant and other professional advisers | Bookkeeping, tax and legal advice | Only what they need, under a duty of confidentiality | Türkiye |
| Public authorities | Only when the law requires us to share data | As required | As required |
Cloudflare, Resend and Google (Gmail) act as our processors and work under data processing terms. Google's and Meta's own use of data is described in Google's privacy policy and Meta's privacy policy.
We do not sell personal data.
5. International transfers
Neva DSP is based in Türkiye, and the services above run mainly in the United States, the United Kingdom and Ireland. Your data will therefore be handled outside the country you live in.
For people in the EU, EEA and UK: Cloudflare, Resend and Google take part in the EU-U.S. Data Privacy Framework and its UK Extension, and Cloudflare and Resend also include the EU Standard Contractual Clauses (with the UK Addendum) in their data processing terms. Meta's transfers to the US are covered by the mechanisms described in its privacy policy. [CONFIRM Meta's current transfer mechanism before enabling the Pixel] Paddle is based in the UK and handles checkout data under its own privacy notice. Türkiye has no EU adequacy decision; we apply the protections in this policy to your data whatever country it is in. You can ask us for a copy of the relevant safeguards.
For people in Türkiye: transfers abroad are made under Article 9 of the KVKK, relying on [CONFIRM KVKK TRANSFER MECHANISM: standard contracts notified to the Personal Data Protection Authority, or another Article 9 ground].
6. How long we keep data
| Data | How long |
|---|---|
| Licence records (name, e-mail, key, order references, status) | As long as the licence exists. Licences don't expire, and you may need to reactivate years from now. If a licence is refunded or charged back, we keep the record for 2 years after it is cancelled, to handle disputes and misuse. |
| Order and income records | For the period Turkish tax and bookkeeping law requires, currently 5 years after the end of the year of the sale |
| Activation records | While the activation is in use, then 12 months after deactivation so we can apply the six-resets-a-year limit |
| Server logs with IP addresses, including "Lost your key?" requests | Up to 30 days, unless we need them longer to investigate a specific case of abuse |
| Support e-mails and contact form messages | 2 years after our last exchange |
| Newsletter subscription (address, sign-up and confirmation records) | Until you unsubscribe. Unconfirmed sign-ups are deleted after 30 days. After you unsubscribe we keep only the address on a suppression list, so we never e-mail you by mistake. |
| Your cookie choice | 12 months, then we ask again |
| Google Analytics data | The cookies last up to 2 years (see the Cookie Policy). Event data linked to a cookie identifier is deleted from Google Analytics after 14 months. |
| Advertising cookies | Up to 90 days for the Google Ads and Meta cookies on our site (see the Cookie Policy). Google and Meta keep the data they receive under their own retention rules. |
| E-mail delivery logs at Resend | A short period set by Resend's own retention rules |
When a period ends, we delete the data or make it anonymous.
If you ask us to delete your licence records before then, we can do it, but your licence will stop working, because we would no longer be able to confirm it.
7. Keeping data safe
- Every connection between the plug-in, the website and our server is encrypted (HTTPS).
- Activation files and update files are digitally signed, so the plug-in can tell a real file from a forged one. The private signing key is kept offline and is not stored on any server.
- Machine IDs reach us only as one-way hashes.
- Access to the licence database, the support mailbox and the analytics and advertising accounts is limited to the people who need it, and each account has its own strong password.
No system is perfectly secure. If a data breach affects you, we will tell you and the relevant authorities as the law requires.
8. Your rights
You can write to [email protected] about any of the rights below, wherever you live. We may ask you to write from the e-mail address linked to your licence, or to confirm your identity in another way, so that we don't hand your data to someone else.
If you are in the EU, EEA or UK
Under the GDPR and UK GDPR you have the right to:
- get a copy of your personal data (access);
- have inaccurate data corrected;
- have your data deleted;
- restrict how we use it;
- object to uses based on legitimate interests, including the update check and security logging;
- receive data you gave us in a common machine-readable format (portability);
- withdraw your consent to analytics or advertising cookies at any time, through Cookie settings;
- not be subject to a decision based solely on automated processing that significantly affects you. As explained in section 2, a person reviews every paused key.
We reply within one month. If a request is complex, we may need up to two more months, and we'll tell you if so.
You can also complain to a data protection supervisory authority, in particular in the EU country where you live or work. In the UK, that is the Information Commissioner's Office (ico.org.uk). We'd appreciate the chance to fix the problem first, but you don't have to come to us before going to them.
If you are in Türkiye (KVKK)
Under Article 11 of Law No. 6698 you have the right to:
- learn whether your personal data is processed;
- request information about that processing;
- learn the purpose of the processing and whether the data is used for that purpose;
- know the third parties, in Türkiye or abroad, to whom your data is transferred;
- ask for incomplete or inaccurate data to be corrected;
- ask for your data to be deleted or destroyed under the conditions in Article 7;
- ask for third parties who received your data to be told about any correction or deletion;
- object to a result against you that arises solely from automated analysis of your data;
- claim compensation if you suffer damage because your data was processed unlawfully.
You can also withdraw your explicit consent to analytics and advertising cookies at any time through Cookie settings.
To use these rights, apply to us under Article 13 of the Law: in writing to Karşıyaka Mah. 1627 Sk. No 12/1, Afyonkarahisar, Türkiye, or by e-mail to [email protected] from the e-mail address you have registered with us (registered e-mail (KEP), secure e-signature and mobile signature are also accepted). Please include your full name, your identity details, your address for correspondence and what you are asking for, as the Communiqué on the Procedures and Principles of Application to the Data Controller requires.
We will answer within 30 days, free of charge. A fee under the tariff set by the Personal Data Protection Board can only be charged if a request involves an extra cost.
If we reject your application, if you find our answer insufficient, or if we don't answer in time, you can complain to the Personal Data Protection Board (kvkk.gov.tr) within 30 days of learning of our answer, and in any case within 60 days of your application.
9. If you are in the United States
We collect the following categories of personal information, for the purposes described in section 2: identifiers (name, e-mail address, IP address, licence key, machine ID, cookie identifiers), commercial information (what you bought), and internet activity on our own site (server logs and, if you accept cookies, analytics and advertising data). Section 4 lists everyone we share it with.
We do not sell personal information for money. If you accept advertising cookies, Google and Meta may collect information about your visit and use it for advertising on other sites and apps. Under California law, that can count as "sharing" personal information for cross-context behavioral advertising. It only happens if you opt in, and you can opt out again at any time through Cookie settings. We also treat a Global Privacy Control signal from your browser as an opt-out.
You can ask us to tell you what personal information we hold about you, to correct it or to delete it, by writing to [email protected]. We won't treat you differently for asking.
Do Not Track. Our site does not respond to the Do Not Track browser setting as such, because nothing that tracks you loads unless you opt in through the cookie banner. If you accept advertising cookies, Google and Meta can collect information about your activity over time and across different websites. If you reject them, they can't do so through our site.
10. Children
Our products and website are not aimed at children under 16, and we don't knowingly collect their data. If you believe a child has given us personal data, let us know and we'll delete it.
11. Changes to this policy
When we change this policy, we'll update the date at the top of this page. If a change significantly affects how we use data you've already given us, we'll e-mail licence holders before it takes effect. If we add new kinds of cookies that need consent, we'll ask you again through the banner.
12. Contact
Hüseyin Oğuz Yaşar, trading as Neva DSP Karşıyaka Mah. 1627 Sk. No 12/1, Afyonkarahisar, Türkiye [email protected]