The Lockboxx — Privacy Policy

Last updated: July 30, 2026

The Lockboxx, LLC ("The Lockboxx," "we," "us," "our") operates inthelockboxx.com (the "Site"). This Privacy Policy explains what personal information we collect, how we use and share it, and the choices you have. By using the Site or purchasing from us, you agree to this Policy.

1. Information We Collect

• Information you provide: your name, email address, billing address, order details, and anything you submit when you create an account, contact us, join our email list, or post in our community channels. Payment card details are entered with and processed by our payment providers — we do not store full card numbers.
• Information collected automatically: when you visit the Site, we and our providers may collect your IP address, device and browser type, pages viewed, referring URLs, and similar usage data through cookies and similar technologies (see Section 4).
• Information from third parties: we may receive data from our payment processors, advertising platforms, and analytics providers (for example, conversion and audience measurement data).

Plugin Licensing and Activation Data

When you purchase a Lockboxx software product (such as Circuit Bandit), our license server processes and stores information necessary to deliver, activate, and enforce your license, including:

• License key issued to you at purchase, tied to your purchase email address.
• Machine identifier — a hashed, non-reversible fingerprint of each computer you activate the plugin on. We use this only to enforce the maximum number of concurrent activations permitted by your license. We do not use it for advertising, cross-site tracking, or resale.
• Activation and deactivation timestamps — the date/time each activation or deactivation event occurs, per machine.
• IP address of activation attempts — used to detect abuse (e.g., mass activation from unrelated regions) and troubleshoot connectivity issues. IP addresses are retained for no more than 90 days unless required longer for fraud investigation.
• Machine name — a friendly label for each activated computer (for example “Studio iMac”), supplied by the plugin and shown on your account page so you can tell your devices apart when deactivating one. If the name your computer reports contains your own name, that name is stored with it; you can rename your computer before activating if you would prefer it did not.

We do not collect audio you process through the plugin, the DAW sessions you use it in, the presets you select, or any other content you create with our software. All audio processing happens entirely on your computer.

Where this data is stored: our license server infrastructure runs on Supabase (same as the rest of our site data). Data is stored in the United States.

Who we share it with: we do not sell or share license activation data with any third party except (a) our infrastructure provider (Supabase, subject to their security and privacy commitments), and (b) as required by law.

How to request deletion: if you'd like your license and activation history erased (for example, when you no longer use a Lockboxx plugin), email contact@inthelockboxx.com. Note that deletion will also revoke your license key.

2. How We Use Your Information

• Process and deliver your orders and digital downloads;
• Provide customer support and respond to your inquiries;
• Send transactional messages such as receipts and download links;
• Send marketing emails and updates if you opt in (you can unsubscribe anytime);
• Operate, measure, and improve the Site and our products;
• Run and measure advertising, including retargeting;
• Detect, prevent, and address fraud, abuse, and security issues;
• Comply with legal obligations and enforce our Terms.

3. How We Share Information

We do not sell your personal information for money. We share it only as needed:

• Service providers who help us run the business, including our hosting and infrastructure providers (e.g., Vercel and Supabase), payment processors (e.g., Stripe), email/marketing tools (e.g., Klaviyo), and analytics providers (e.g., PostHog and Google Analytics);
• Advertising partners such as Meta (Facebook/Instagram) and TikTok, through advertising pixels that help us measure and target ads (see Section 5). Depending on your state, this activity may be treated as "sharing" or a "sale" of personal information, and you may opt out (see Section 7);
• Legal and safety reasons — to comply with law, respond to lawful requests, or protect our rights, our users, and our business;
• Business transfers — in connection with a merger, acquisition, or sale of assets.

4. Cookies and Tracking Technologies

We use cookies, pixels, and similar technologies to keep the Site working, remember your cart and preferences, analyze traffic, and support advertising. You can control cookies through your browser settings; disabling some may affect Site functionality. Where required by law, we display a cookie banner and honor your choices.

5. Advertising and Analytics

We use product-analytics, web-analytics, and advertising tools — including PostHog (first-party product analytics) and Google Analytics (web analytics), and the Meta (Facebook/Instagram) Pixel and TikTok Pixel (advertising) — to understand how visitors use the Site, measure performance, and show relevant ads on those platforms, including retargeting. Our product analytics logs usage events such as pages viewed, products viewed, items added to cart, checkout steps, and similar on-site interactions; for signed-in users, this activity may be associated with your account. The advertising platforms may combine the information they collect with data they already hold about you. You can opt out of personalized advertising or analytics through:

• Site analytics (PostHog): decline analytics cookies in our cookie banner;
• Meta: your Facebook/Instagram ad preferences;
• TikTok: your TikTok ad settings;
• Google: your Google Ads Settings and the Google Analytics Opt-out Browser Add-on;
• Industry tools: optout.aboutads.info and youradchoices.com.

6. Legal Bases for Processing (EEA/UK)

If you are located in the European Economic Area or the United Kingdom, we process your personal data only where we have a legal basis to do so under Article 6 of the GDPR. The basis depends on what we are doing:

• Performing our contract with you (Art. 6(1)(b)) — taking payment, delivering your purchase, creating and maintaining your account, and issuing, activating, validating and deactivating plugin licenses. This includes processing the machine identifier of each computer you activate on, because enforcing the activation limit is part of the license you agreed to.
• Our legitimate interests (Art. 6(1)(f)) — detecting and preventing license abuse, piracy, fraud and automated attacks; rate-limiting our servers; keeping the Site secure; and emailing existing customers about our own similar products. We balance these against your rights, and you may object at any time.
• Your consent (Art. 6(1)(a)) — marketing emails where you signed up without purchasing, and non-essential cookies and advertising technologies. You may withdraw consent at any time, with no effect on processing carried out beforehand. Every marketing email contains a one-click unsubscribe link, and you can change cookie choices from the banner at any time.
• Compliance with a legal obligation (Art. 6(1)(c)) — retaining transaction and tax records for the period required by law.

Your License File Contains Your Email Address

When you activate a plugin, our server issues a small signed license file that the plugin stores on your computer. That file contains the email address used for the purchase, the machine identifier of that computer, and the license expiry. The email is included both so the plugin can display who the license belongs to and as a watermark that discourages license sharing. It is stored locally on your own machine and is not transmitted to any third party.

Erasure and Active Licenses

You may ask us to erase your personal data at any time (see Section 7). Please be aware of the consequence for software you have bought: your license record is the proof that you own the plugin. If we erase it, the plugin will stop activating and any installed copy will cease to function at the end of its current license period, and we may be unable to restore your access or verify a future support request. We will always tell you this before acting, and you may instead ask us to erase your marketing data only and keep your license intact. We may also retain a minimal record of a purchase where we are legally required to do so for tax purposes.

7. Your Privacy Rights

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal information, and to opt out of marketing and of the "sale" or "sharing" of your data for targeted advertising.

• U.S. (e.g., California's CCPA/CPRA and similar state laws): rights to know, delete, correct, and opt out of sale/sharing; we will not discriminate against you for exercising these rights.
• EEA/UK (GDPR): rights of access, rectification, erasure, restriction, portability, and objection, and the right to lodge a complaint with your supervisory authority.

To exercise any right, email us at contact@inthelockboxx.com. We may need to verify your identity before responding.

8. Email Marketing

If you opt into our emails, you can unsubscribe anytime using the link in any email or by contacting us. We may still send transactional messages related to your purchases.

9. Data Retention

We keep personal information for as long as needed to provide our products, comply with legal obligations, resolve disputes, and enforce our agreements.

10. Security

We use reasonable administrative, technical, and physical safeguards to protect your information. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

11. International Visitors

We operate from the United States. If you access the Site from outside the U.S., your information will be processed in the U.S., where data-protection laws may differ from those in your country.

12. Children's Privacy

The Site is not directed to children under 13 (or under 16 in some regions), and we do not knowingly collect their personal information. If you believe a child has provided us information, contact us and we will delete it.

13. Third-Party Links

The Site may link to third-party sites and services we do not control. Their privacy practices are governed by their own policies.

14. Changes to This Policy

We may update this Policy from time to time. Changes take effect when posted with an updated "Last updated" date.

15. Contact

Questions or requests regarding this Policy: contact@inthelockboxx.com The Lockboxx, LLC — inthelockboxx.com