Chaos Audio Privacy Policy

Effective as of August 20, 2026. Last updated August 20, 2026.

Notice at Collection and State Privacy Rights Notice: See Section 13 (U.S. State Privacy Rights Notice) below for important information about your rights under applicable U.S. state privacy laws, including your right to opt out of the sale or sharing of your personal information and its use for targeted advertising.

Notice to European users: If you are located in the European Economic Area or the United Kingdom, please see Section 15 (Notice to European Users) for additional information about how we process your personal information and the rights available to you.

Chaos Audio LLC, a Florida limited liability company ("Chaos Audio," "we," "us," or "our"), designs and sells guitar effects hardware, including the Stratus® multi-effects pedal and the Nimbus™ amplifier; develops companion desktop and mobile applications, firmware update tools, and audio plugins; operates the AI FX Builder, a subscription service for creating audio effects; and operates an online store and a marketplace through which independent developers distribute effects, plugins, and neural amp models.

This Privacy Policy describes how Chaos Audio processes personal information that we collect through our digital and online properties and services that link to this Privacy Policy — including chaosaudio.com, build.chaosaudio.com, our support center, our companion applications, update tools, and plugin installers, our newsletter, our Discord server, our Developer Portal and Affiliate Artist Program, and our social media pages — as well as through our marketing activities, crowdfunding campaigns, dealer relationships, live events, and trade show presence (collectively, the "Service").

The terms used in this Privacy Policy have the meanings given to them in our Terms and Conditions, available at chaosaudio.com/pages/terms-and-conditions, unless otherwise defined here.

1. Personal Information We Collect

1.1 Information you provide to us

Personal information you may provide to us through the Service or otherwise includes:

Contact data. such as your first and last name, email address, billing and shipping addresses, phone number, and, where applicable, your business or artist name.

Account and profile data. such as the username and password you set to establish a Chaos Audio account, your account preferences and settings, your saved presets and device configurations, links to your profiles on social networks or streaming platforms, and any other information you add to your account profile.

Transactional data. such as information relating to or needed to complete your orders, including order numbers, products purchased, purchase and subscription history, license and activation records, warranty registrations, returns, and support history.

Payment data. needed to complete transactions. Payment card and bank account details are collected and processed directly by our payment processors — Stripe and Shopify Payments — and are not stored by us. We receive limited information such as the last four digits of your card, the card brand, the billing address, and the authorization result.

Subscription data. relating to your AI FX Builder subscription, including your plan, billing cycle, renewal and cancellation history, and usage against any applicable plan limits.

Communications data. based on our exchanges with you, including when you contact us through our support center, by email, through social media, or through our Discord server, and including the contents of those communications and any attachments.

Marketing data. such as your preferences for receiving our email and SMS marketing communications, your newsletter subscription status, and details about your engagement with those communications.

User content and audio data. such as audio files, recordings, impulse responses, neural amp models, tone captures, presets, effect chains and configurations, text prompts and descriptions you enter into the AI FX Builder, project files, comments, reviews, forum and Discord messages, and other content you generate, upload, transmit, or otherwise make available on or through the Service, together with associated metadata such as when and how the content was created, formatted, or edited.

Developer and marketplace data. if you participate in our Developer Portal or marketplace, such as your legal or business name, contact details, developer profile and biography, the products you list, and sales and payout records. Developers onboard directly with Stripe through Stripe Connect. Stripe collects and holds developer identity verification information, banking and payout account details, and tax documentation including taxpayer identification numbers. We do not collect or store that information.

Affiliate data. if you participate in our Affiliate Artist Program, such as your contact and social media details, referral and commission records, and payment information.

Promotion and event data. including information you share when you enter a contest, giveaway, or survey, back a crowdfunding campaign, register for an event, or visit us at a trade show. If you participate in a sweepstakes, contest, or giveaway, we may ask for contact data to verify your identity, determine your eligibility, notify you of the results, and send prizes. We recommend that you read the rules for each promotion you enter.

Other data. not specifically listed here, which we will use as described in this Privacy Policy or as otherwise disclosed at the time of collection.

Biometric sign-in. Our mobile application lets you use fingerprint or face recognition to sign in, so that you do not have to enter your password each time. That check is performed entirely by your device’s operating system and secure hardware, which tells our application only whether the check succeeded. We never receive, process, or store your fingerprint, facial geometry, or any other biometric information.

1.2 Third-party sources

We may combine personal information we receive from you with personal information falling within one of the categories identified above that we obtain from other sources, such as:

Our e-commerce and hosting platform. Shopify, which operates our storefront and checkout and provides us with order, customer, and analytics data.

Payment processors and payout providers. which provide us with transaction, authorization, chargeback, and dispute information.

Dealers and retailers. that sell our products and may provide us with warranty registration or customer support information.

Crowdfunding and fulfillment platforms. such as Kickstarter and PledgeBox, in connection with campaigns for our products. These platforms provide us with backer, pledge, and fulfillment information, and retain their own copies of that information under their own privacy policies.

Advertising, analytics, and marketing partners. which provide us with information about your interaction with our advertising and online properties.

Social media and community platforms. including where you link a third-party account to your Chaos Audio account, or interact with us on those platforms. The information we receive is governed by your settings on those platforms.

Public sources and data providers. such as public records, publicly available sources, and information services and data licensors.

Business transaction partners. in connection with an actual or prospective business transaction, such as an entity we acquire or are acquired by, a successor or assignee, or any party involved in a merger, acquisition, sale of assets, financing, or similar transaction, or in the context of an insolvency, bankruptcy, or receivership.

1.3 Automatic data collection

We, our service providers, and our business partners may automatically log information about you, your computer or mobile device, your Chaos Audio hardware, and your interaction over time with the Service and our communications, such as:

Device data. such as your computer or mobile device’s operating system type and version, manufacturer and model, browser type, screen resolution, device type, IP address, unique identifiers (including identifiers used for advertising purposes), language settings, mobile carrier, network information, and general location information such as city, state, or geographic area derived from your IP address.

Application usage data. from our Chaos Audio mobile application and the AI FX Builder at build.chaosaudio.com, which record your activity and transmit it to servers we operate. This data is associated with your Chaos Audio account. It includes events such as connections between the application and Chaos Audio hardware over Bluetooth; screens and pages viewed; effects viewed and effects added to a pedalboard; the fact that a preset was saved, though not the contents of the preset; checkout sessions started, completed, and abandoned; firmware update attempts and their outcomes; whether you have linked a TONE3000 account; AI FX Builder generation activity; and similar interactions with the Service. We also collect software versions, performance metrics, and crash and error logs.

Online activity data. such as pages or screens you viewed, how long you spent on a page or screen, the website you visited before browsing to the Service, navigation paths, information about your activity on a page or screen, mouse movements, clicks, scrolling and keystroke timing captured through session replay technology, access times and duration of access, and whether you have opened our emails or clicked links within them.

Communication interaction data. such as your interactions with our email, text, and other communications, including whether you open or forward emails. We may collect this using pixel tags, also known as clear GIFs, which may be embedded invisibly in our emails.

Push notification tokens. If you enable push notifications, we collect the token your device uses to receive them. We send notifications both to all users and to groups of users selected on the basis of the application usage data described above.

Device permissions. Our mobile application asks for access to files on your device so that you can import and export audio and presets, and for Bluetooth so that it can connect to your Chaos Audio hardware. On older versions of Android, the operating system requires an application to hold location permission in order to scan for Bluetooth devices. Where that permission is requested for that reason, we do not use it to determine, collect, or track your location.

Our hardware products, the Stratus Update Tool, and our VST/AU plugin installer do not transmit usage data to us.

For more information about our automatic collection of data, see Section 2 below.

1.4 Data about others

We may offer features that let you invite friends or contacts to use the Service, refer customers to us, or send a gift, and we may collect contact details about those people so we can deliver the invitation or order. Please do not refer someone to us or share their contact details with us unless you have their permission to do so.

2. Cookies, Tracking Technologies, and Artificial Intelligence

2.1 What these technologies are

Cookies are small text files placed on your device when you visit a website. Similar technologies include pixels and tags (small pieces of code that record that a page was loaded or an email was opened), software development kits embedded in mobile applications, and local storage in your browser. We and our service providers and partners use these technologies on the Service to operate and secure the site, remember your preferences and cart contents, measure and analyze usage, and deliver and measure advertising.

2.2 Categories of technologies we use

Strictly necessary

• What it does: Operates the storefront, cart, checkout, and account sign-in, and supports fraud prevention and security. The Service will not function correctly without these.
• Can you turn it off?: No. These are required to provide the Service.

Analytics and performance

• What it does: Tells us how visitors find and move through the Service, which pages and products draw attention, and where errors occur.
• Can you turn it off?: Yes, through your browser settings or the provider opt-outs described in Section 2.5.

Session replay

• What it does: Records your interactions with our website and reconstructs them as a viewable recording, so we can diagnose problems and improve page design. Described further in Section 2.4.
• Can you turn it off?: Yes, as described in Section 2.4 and Section 2.5.

Advertising

• What it does: Measures the performance of our advertising and allows advertising to be shown to you, and to audiences resembling our customers, on other platforms.
• Can you turn it off?: Yes, as described in Section 2.5 and Section 13.

2.3 Providers we use on our website

The technologies currently deployed on chaosaudio.com include the following.

Shopify. which provides essential storefront, cart, checkout, and fraud-prevention cookies, together with native store analytics.

Google Tag Manager and Google Analytics. which we use to deploy tags and to understand how visitors find and use the Service. You can prevent Google Analytics from collecting information about your visits by installing the Google Analytics Opt-out Browser Add-on.

Meta Pixel. which we use to measure the performance of our advertising on Facebook and Instagram and to deliver advertising to you and to audiences resembling our customers.

TikTok Pixel. which we use to measure and deliver advertising on that platform.

Microsoft Clarity. which we use to capture how you interact with our website through behavioral metrics, heatmaps, and session replay. This is described further in Section 2.4. For more information about how Microsoft collects and uses this data, see the Microsoft Privacy Statement at privacy.microsoft.com/privacystatement.

Separately, the Chaos Audio mobile application and the AI FX Builder use analytics code we have written ourselves. That data is transmitted to and stored on servers we operate and is not shared with a third-party analytics provider. See Section 1.3 for a description of what it records.

2.4 Session replay

We use session replay technology, currently provided by Microsoft Clarity, which records your interactions with our website — including pages viewed, mouse movements, clicks, scrolling, and the timing of your inputs — and reconstructs them as a viewable session recording. We use these recordings to diagnose technical problems, understand how visitors navigate the Service, and improve the design of our pages.

Our session replay provider is configured to mask text you type into form fields, including payment and password fields. However, information you enter into free-text fields may be captured. Please do not enter sensitive personal information into free-text fields on the Service.

You can prevent session replay by blocking third-party cookies in your browser, by using a browser or extension that blocks the Clarity script, or by contacting us at support@chaosaudio.com and asking us to exclude you.

2.5 Your choices regarding cookies and tracking

Browser controls. Most browsers let you block or delete cookies and clear local storage through their settings. Blocking strictly necessary cookies will prevent parts of the Service from working, including the cart and checkout.

Provider opt-outs. Google offers a Google Analytics Opt-out Browser Add-on. Meta and TikTok offer advertising controls within your account settings on those platforms.

Industry opt-out tools. You can opt out of interest-based advertising from participating companies through the Digital Advertising Alliance at optout.aboutads.info and the Network Advertising Initiative at optout.networkadvertising.org. These tools are cookie-based, so you will need to repeat the process on each browser and device you use.

Mobile device controls. Your mobile operating system provides controls for limiting ad tracking and resetting your advertising identifier, in your device privacy settings.

Contact us. You can also email support@chaosaudio.com to ask us to stop processing your information for advertising purposes. See Section 13 for how we handle those requests.

Our privacy banner and opt-out page. Visitors in certain regions are shown a Shopify-operated privacy banner that lets you accept or decline non-essential cookies. We also operate a data sharing opt-out page at chaosaudio.com/pages/data-sharing-opt-out for visitors in the U.S. states where we offer one. You can change your choice at any time by reopening the banner or returning to that page.

Global Privacy Control. We honor the Global Privacy Control signal as a request to opt out of the sale or sharing of personal information and of processing for targeted advertising, for visitors in the U.S. states where we offer a data sharing opt-out page. Wherever you are located, you can also email support@chaosaudio.com and ask us to stop processing your information for advertising purposes.

2.6 Artificial intelligence and the AI FX Builder

The AI FX Builder uses machine learning models to generate and modify audio effects based on the instructions, audio, and models you provide. We currently use Google’s Gemini models through Google Cloud’s Vertex AI platform as the underlying model for this feature. We may in the future substitute models that we have developed or fine-tuned ourselves.

What we do not use to train models. We do not use audio files, recordings, impulse responses, neural amp models, or tone captures that you upload to the Service to train or fine-tune any machine learning model, whether ours or a third party’s.

What we do use to train models. We use the following to train, fine-tune, and evaluate our own machine learning models:

the text prompts and instructions you enter into the AI FX Builder;

the number of iterations required to reach a working result;

intermediate error states and the corrections applied to them, including error codes returned by a failed generation attempt and the changes made in a subsequent attempt;

the effect code produced by a generation, including the final output; and

your ratings of generated results and any written feedback you submit with them.

Prompts and written feedback are free-text fields. Please do not include your name, contact details, or other personal information in them.

Opting out of model training. If you would like us to exclude your prompts, feedback, and generation records from model training, contact us at support@chaosaudio.com. Opting out does not affect models that have already been trained, and does not affect our use of this information to operate, debug, secure, and support the Service.

Third-party model providers. Google does not use content submitted through Vertex AI to train its own models, and processes that content only to provide the service to us. We contractually require our AI service providers to maintain appropriate data protection safeguards and to process your content only in order to provide services to us.

3. How We Use Your Personal Information

We may use your personal information for the following purposes, or as otherwise described at the time of collection.

3.1 Service delivery and operations

We use your personal information to:

provide, operate, and maintain the Service, including our online store, the AI FX Builder, our hardware and its companion software, and our marketplace;

process, fulfill, and ship your orders, and manage returns, exchanges, warranty claims, and repairs;

create and maintain your Chaos Audio account, and authenticate you when you sign in;

deliver, license, and activate digital products, plugins, and firmware, and sync your presets and settings across devices;

administer your AI FX Builder subscription, including billing, renewal, and cancellation;

administer the marketplace and Developer Portal, including listing management, sales reporting, and payouts processed through Stripe Connect;

administer the Affiliate Artist Program, including tracking referrals and paying commissions;

enable security features of the Service and detect and prevent fraud;

communicate with you about the Service, including by sending order confirmations, shipping notifications, service-related announcements, updates, security alerts, and support and administrative messages; and

provide support and respond to your requests, questions, and feedback.

3.2 Product and model development

We use application usage data, audio data, and other information to develop, test, tune, and improve our hardware, software, plugins, and the AI FX Builder, including to diagnose defects, evaluate the performance of audio processing, and develop new products and features. We separately use prompts, generation records, and feedback to train and fine-tune our own machine learning models, as described in Section 2.6. Audio you upload is not used for model training.

3.3 Personalization

We use your personal information to understand your needs and interests, personalize your experience with the Service and our communications, recommend products and content, and remember your selections and preferences as you navigate the Service.

3.4 Service improvement and analytics

We use your personal information to analyze your usage of the Service, understand user activity including which pages are most and least visited and how visitors move through the Service, measure the effectiveness of our communications and advertising, and improve the Service and the rest of our business.

3.5 Marketing and advertising

Direct marketing. We may send you email and, where you have opted in, SMS marketing communications about our products, promotions, product launches, artist content, and company news, and we may personalize these messages based on your interests and purchase history. You may opt out as described in Section 6 and Section 14.

Interest-based advertising. We, our service providers, and our third-party advertising partners use cookies and similar technologies to collect information about your interaction with the Service, our communications, and other online services over time, and use that information to serve online advertisements that we or they believe will interest you. We may also share information about our users with these companies to facilitate advertising to those users or to audiences resembling them on other platforms. You can learn about your choices for limiting interest-based advertising in Section 2.5, Section 6, and Section 13.

3.6 Events, promotions, and contests

We use your personal information to administer promotions, contests, giveaways, and crowdfunding campaigns, to communicate with you about promotions or contests in which you participate, and to contact or market to you after collecting your personal information at an event or trade show.

3.7 Compliance and protection

We use your personal information to:

comply with applicable laws, lawful requests, and legal process, including responding to subpoenas, investigations, or requests from government authorities;

meet our tax, customs, export control, and financial reporting obligations, including reporting marketplace and affiliate payouts;

protect our rights, privacy, safety, or property, and those of you or others, including by making and defending legal claims;

audit our internal processes for compliance with legal and contractual requirements and our internal policies;

enforce the terms and conditions that govern the Service, including our marketplace and community rules; and

prevent, identify, investigate, and deter fraudulent, harmful, unauthorized, unethical, or illegal activity, including software piracy, license abuse, cyberattacks, and identity theft.

3.8 Aggregated, de-identified, and anonymized data

We may create aggregated, de-identified, or anonymized data from your personal information and from the personal information of other individuals, by removing information that makes the data identifiable to you. We will not attempt to reidentify any such data except to test whether our de-identification processes comply with applicable law. We may use and share this data for our lawful business purposes, including analyzing and improving the Service and promoting our business.

3.9 Further uses

In some cases we may use your personal information for further purposes. Where those purposes are not compatible with the purpose for which the information was originally collected, we will ask for your consent.

4. Retention

We generally retain personal information for as long as necessary to fulfill the purposes for which we collected it, including to satisfy legal, tax, accounting, warranty, and reporting requirements, to establish or defend legal claims, and for fraud prevention purposes. To determine the appropriate retention period, we consider the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure, the purposes for which we process it and whether we can achieve those purposes through other means, and applicable legal requirements.

In general:

Account, profile, preset, and application usage records are retained for as long as your Chaos Audio account remains open. They are deleted when the account is deleted, whether you ask us to delete it or we close it.

Order, transaction, and payout records are retained for the period required by applicable tax, accounting, and customs law, which may be longer than the life of your account.

Support tickets and the communications in them are retained until our team deletes them.

Marketing contact data is retained after you opt out so that we can record and continue to honor your opt-out. We do not send you marketing after you opt out.

Session replay recordings are retained by our provider for 30 days, and recordings that our team has labeled or saved, together with aggregated heatmap and click data, for 13 months. Other website analytics data is retained until we delete it.

AI FX Builder prompts, generation records, and feedback are retained until we delete them or until you ask us to remove them from model training as described in Section 2.6.

When we no longer require personal information, we will delete it, anonymize it, or isolate it from further processing.

5. How We Share Your Personal Information

We may share your personal information with the following parties, or as otherwise described in this Privacy Policy, in other applicable notices, or at the time of collection.

Service providers. Third parties that provide services on our behalf or help us operate the Service or our business. These currently include Shopify for our online store; Microsoft Azure and Google Cloud Platform for server hosting; Google Cloud’s Vertex AI for the AI FX Builder; Klaviyo, Beehiiv, Shopify Email, and Amazon SES for email delivery; Google Workspace for customer support email; Blueberry for text messaging; Stripe and Shopify Payments for payments; and Google, Meta, TikTok, and Microsoft for website analytics and advertising measurement. We also use providers for order fulfillment and shipping, information technology, and customer support.

Shopify. Our online store is hosted by Shopify. Shopify processes information about your visit and your purchases in order to provide the store to us, including to provide services based on your interactions with other merchants and with Shopify. Shopify’s consumer privacy policy is available at shopify.com/legal/consumer-privacy-policy.

TONE3000. If you choose to link a TONE3000 account, you authorize a connection between that account and your Chaos Audio account so that you can browse TONE3000 and select neural amp models and impulse responses to save to your Chaos Audio account and run on your hardware. Linking is completed through TONE3000’s own authorization process, and TONE3000’s handling of your information is governed by its privacy policy. We do not share your order history, payment information, or contact details with TONE3000.

Payment processors. Payment card and bank account information is collected and processed directly by our payment processors and is not stored by us. We use Stripe for purchases and subscriptions made in our mobile application and on build.chaosaudio.com, including one-time Build packs and recurring subscriptions, and Shopify Payments for purchases made on chaosaudio.com, including payments made through Shop Pay, Apple Pay, and Google Pay where offered. These providers process your payment data in accordance with their own privacy policies, available at stripe.com/privacy and shopify.com/legal/privacy.

Marketplace developers and Stripe Connect. Sales of third-party products through our marketplace are processed using Stripe Connect. Independent developers onboard directly with Stripe, which verifies their identity, collects their tax and banking information, and issues their payouts. Stripe allocates each transaction between us and the developer automatically. We do not share your name, email address, billing location, or other personal information with marketplace developers. Developers see only their own sales and payout records.

Advertising partners. Third-party advertising companies for the interest-based advertising purposes described in Section 3.5. As described in Section 13, sharing personal information with these partners may be considered a "sale" or "sharing" of personal information, or processing for "targeted advertising," under certain U.S. state privacy laws.

Community and social platforms. Where you post content, comments, or messages on our Discord server, our social media pages, or public areas of the Service, that content and your associated profile information are visible to other users and, depending on the setting, to the public. This information can be seen, collected, copied, screen-captured, cached, or stored by others, including search engines, and we are not responsible for that use.

Third parties you designate. We may share your personal information with third parties where you have instructed us or provided your consent to do so, including where you link your Chaos Audio account to a third-party service.

Partners. Third parties with whom we partner, including dealers and retailers, artists, co-sponsors of events or promotions, and parties with whom we jointly offer products or services.

Professional advisors. Professional advisors such as lawyers, accountants, auditors, bankers, and insurers, in the course of the professional services they render to us.

Authorities and others. Law enforcement, government authorities, and private parties, as we believe in good faith to be necessary or appropriate for the compliance and protection purposes described in Section 3.7.

Business transferees. We may disclose personal information in the context of an actual or prospective business transaction, such as an investment in, financing of, or sale, transfer, or merger of all or part of our business, assets, or membership interests, including to prospective counterparties and their advisers, and to any acquirer, successor, or assignee, or in the event of insolvency, bankruptcy, or receivership.

6. Your Choices

This section describes rights and choices available to all users. Users located in certain U.S. states and in Europe have additional rights described in Section 13 and Section 15.

Access or update your information. If you have a Chaos Audio account, you can review and update certain account information by signing in to your account.

Opt out of marketing emails. You can opt out of marketing emails by following the unsubscribe instructions at the bottom of any marketing email, or by contacting us. If you opt out of marketing emails, you may continue to receive service-related and other non-marketing emails, such as order confirmations and security notices.

Opt out of SMS messages. You can opt out of marketing text messages at any time by replying STOP. See Section 14 for full details.

Opt out of model training. You can ask us to exclude your AI FX Builder prompts, generation records, and feedback from use in training our machine learning models by contacting us at support@chaosaudio.com. See Section 2.6.

Cookies and tracking technologies. For information about the technologies used on the Service and how to control them, including browser controls, provider opt-outs, and industry opt-out tools, see Section 2.5.

Opt out of targeted advertising. You can ask us to stop processing your information for advertising purposes by emailing support@chaosaudio.com, and you can use our privacy banner, our data sharing opt-out page, the Global Privacy Control signal, and the browser, provider, and industry opt-out tools described in Section 2.5.

Blocking images and clear GIFs. Most browsers and devices let you configure your device to prevent images from loading, which will prevent the pixel tags in our emails from functioning. Follow the instructions in your browser or device settings.

Do Not Track. Some browsers can be configured to send "Do Not Track" signals. We do not currently respond to "Do Not Track" signals.

Declining to provide information. We need to collect certain personal information to provide the Service. If you do not provide information we identify as required, we may not be able to provide the relevant products or services to you.

Linked third-party platforms. If you connect to the Service through a social media or other third-party account, you may be able to use your settings on that platform to limit the information we receive. Revoking our access will not apply to information we have already received.

Delete your content or close your account. You can delete certain content, including presets and saved projects, through your account. To request account closure, contact us at support@chaosaudio.com. Closing your account does not require us to delete records we are required to retain by law, and does not delete content you have made publicly available or distributed to others.

7. Other Sites and Services

The Service contains links to websites, mobile applications, and other online services operated by third parties, including our support center, community platforms, crowdfunding pages, dealer sites, and developer websites. In addition, our content may be integrated into web pages or other online services not associated with us. These links and integrations are not an endorsement of, or representation that we are affiliated with, any third party. We do not control third-party services and are not responsible for their actions. We encourage you to read the privacy policies of the other websites, applications, and online services you use.

8. Security

We employ technical, organizational, and physical safeguards designed to protect the personal information we collect. However, security risk is inherent in all internet and information technologies, and we cannot guarantee the security of your personal information.

9. International Data Transfer

We are headquartered in the United States and use service providers that operate in other countries. Your personal information may be transferred to, stored in, and processed in the United States or other locations where privacy laws may not be as protective as those in your state, province, or country. Users in Europe should read Section 15 for important information about transfers of personal information outside Europe.

10. Children

The Service is not directed to children. You must be at least 13 years old to create a Chaos Audio account or otherwise use the Service. We do not knowingly collect personal information from anyone under 13.

We do not ask for or collect date of birth, and we therefore do not have actual knowledge of the age of the people who use the Service. If you are a parent or guardian and you believe that a person under 13 has provided us with personal information, please contact us at support@chaosaudio.com and we will delete it and close the associated account.

If you are between 13 and 17 years old, you may use the Service only with the involvement and permission of a parent or guardian. We do not knowingly sell or share the personal information of consumers under 16 years of age, and we do not knowingly process the personal information of anyone under 18 for targeted advertising. If you are a parent or guardian and you would like us to stop processing your child’s information for advertising purposes, or to delete their information, contact us at support@chaosaudio.com.

11. Changes to This Privacy Policy

We reserve the right to modify this Privacy Policy at any time. If we make material changes, we will notify you by updating the date at the top of this Privacy Policy and posting the updated version on the Service, or by other appropriate means. Any modification is effective upon posting the modified version, or as otherwise indicated at the time of posting. Your use of the Service after the effective date of a modified Privacy Policy indicates your acknowledgment that the modified Privacy Policy applies to your interactions with the Service and our business.

12. How to Contact Us

If you have questions about our privacy practices, or if you would like to exercise a privacy right available to you, please contact us:

Email: support@chaosaudio.com

Mail: Chaos Audio LLC, 7543 Holley Circle, Panama City Beach, Florida 32408, United States

We will respond to privacy requests sent to this address. See Section 13 and Section 15 for the rights that may be available to you.

13. U.S. State Privacy Rights Notice

Several U.S. states have enacted comprehensive privacy laws granting their residents rights over personal information. Most of those laws apply only to businesses above specified size thresholds, and we do not currently meet those thresholds. We provide the rights described in this section to residents of all U.S. states as a matter of practice, whether or not a particular statute requires it. If our size or practices change so that a statute does apply to us, we will update this section.

For purposes of this section, "Personal Information" has the meaning given to "personal data," "personal information," or similar terms, and "Sensitive Personal Information" has the meaning given to "sensitive personal information," "sensitive data," or similar terms, in those laws, except that neither term includes information exempted from their scope.

13.1 Our advertising practices, stated plainly

We do not sell your personal information for money, and we do not provide your name, email address, postal address, phone number, or order history to third parties for those third parties to use for their own marketing.

We do use advertising and analytics services on our website, as described in Section 2. Those services — currently including Meta, TikTok, Google, and Microsoft — receive information about your device and your activity on our site, and use it to measure our advertising and to show our advertising to you and to audiences resembling our customers on their own platforms. Several state privacy laws classify that arrangement as a "sale" or "sharing" of personal information, or as processing for "targeted advertising," even though no money changes hands and no contact details are transferred. We describe it here so that you can decide for yourself, and so that you can opt out if you would prefer we did not do it.

13.2 Your privacy rights

Information. You can request information about the categories of Personal Information we have collected, the categories of sources it came from, the business or commercial purpose for collecting it, and the categories of third parties with which we share it.

Access. You can request a copy of the Personal Information we have collected about you, and where practical, in a portable format.

Correction. You can ask us to correct inaccurate Personal Information we have collected about you.

Deletion. You can ask us to delete the Personal Information we have collected from you, subject to records we are required to retain by law.

Appeal. You can appeal our denial of any request you have validly submitted.

Opt out of advertising-related processing. You can ask us to stop processing your information for advertising purposes, including the arrangement described in Section 13.1.

Opt out of model training. You can ask us to exclude your AI FX Builder prompts, generation records, and feedback from use in training our machine learning models. See Section 2.6.

Profiling. We do not use your Personal Information to engage in profiling or automated decision-making that produces legal or similarly significant effects. The AI FX Builder generates audio effects; it does not make decisions about you.

Sensitive Personal Information. The only Sensitive Personal Information we hold is your account log-in credentials, which we use solely to authenticate you and secure your account. We do not use Sensitive Personal Information to infer characteristics about you. Marketplace developer tax and identity documentation is collected and held by Stripe, not by us.

Nondiscrimination. We will not discriminate against you for exercising any of these rights.

13.3 How to exercise your rights

Email support@chaosaudio.com with the request you would like to make. For advertising-related opt-outs you can also visit chaosaudio.com/pages/data-sharing-opt-out, use the privacy banner shown on our website, or use the browser, provider, and industry opt-out tools described in Section 2.5. Those take effect immediately and do not require you to contact us.

We may need to verify your identity before acting on a request to access, correct, or delete information. We will generally do this by confirming information already associated with your Chaos Audio account or order history, such as the email address used to place an order and details of a recent transaction. We will respond within the time required by applicable law, and in any event within 45 days of receiving a request, unless we tell you that we need more time.

You may authorize an agent to make a request on your behalf. We may need to verify your agent’s identity and authority to act for you.

13.4 Information practices

The following describes our practices currently and during the 12 months preceding the effective date of this Privacy Policy. We collect the categories of Personal Information described below from the sources and for the purposes described in Sections 1 and 3. Retention is described in Section 4. We do not attempt to reidentify de-identified information, except to test whether our de-identification processes comply with applicable law. Information you voluntarily provide in free-form fields may contain categories of Personal Information not described below.

Contact data; Account and profile data; Device data

• CCPA statutory category: Identifiers
• Purposes: Service delivery; personalization; marketing; compliance and protection
• Disclosed for a business purpose to: Service providers; professional advisors; authorities; business transferees
• Made available to advertising and analytics platforms: Device identifiers and online identifiers only, via website tags. Not name, email, or address.

Contact data; limited payment data; developer sales and payout records

• CCPA statutory category: Customer records (Cal. Civ. Code §1798.80(e))
• Purposes: Service delivery; payment and payout processing; compliance and protection
• Disclosed for a business purpose to: Service providers; payment processors (Stripe, Shopify Payments); professional advisors; authorities; business transferees
• Made available to advertising and analytics platforms: None

Transactional data; Subscription data; Marketing data

• CCPA statutory category: Commercial information
• Purposes: Service delivery; personalization; analytics; marketing; compliance and protection
• Disclosed for a business purpose to: Service providers; professional advisors; authorities; business transferees
• Made available to advertising and analytics platforms: Website purchase events only, via advertising tags

Online activity data; application usage data; Communication interaction data

• CCPA statutory category: Internet or other electronic network activity information
• Purposes: Service delivery; analytics and improvement; personalization; marketing; security
• Disclosed for a business purpose to: Service providers; analytics providers; business transferees
• Made available to advertising and analytics platforms: Website activity only. Mobile application and AI FX Builder usage data is not shared.

General location derived from IP address

• CCPA statutory category: Geolocation data
• Purposes: Service delivery; security; analytics; tax and shipping
• Disclosed for a business purpose to: Service providers; business transferees
• Made available to advertising and analytics platforms: Approximate location from website visits

User content and audio data; AI FX Builder prompts, generation records, and feedback; session replay recordings; support communications

• CCPA statutory category: Audio, electronic, visual, or similar information
• Purposes: Service delivery; model training as described in Section 2.6; support; analytics
• Disclosed for a business purpose to: Service providers; AI model providers; analytics providers; business transferees
• Made available to advertising and analytics platforms: Session replay recordings of website activity only

Developer and marketplace data; artist and affiliate data

• CCPA statutory category: Professional or employment-related information
• Purposes: Marketplace and affiliate administration; payouts; compliance
• Disclosed for a business purpose to: Service providers; Stripe; professional advisors; authorities
• Made available to advertising and analytics platforms: None

Preferences and interests inferred from purchase and browsing behavior

• CCPA statutory category: Inferences
• Purposes: Personalization; marketing and advertising; analytics
• Disclosed for a business purpose to: Service providers; business transferees
• Made available to advertising and analytics platforms: Advertising platforms, for audience targeting

Account log-in credentials

• CCPA statutory category: Sensitive personal information
• Purposes: Account authentication and security
• Disclosed for a business purpose to: Service providers
• Made available to advertising and analytics platforms: None

13.5 Additional information for California residents

Shine the Light. Under California Civil Code Section 1798.83, California residents who have formed a business relationship with us primarily for personal, family, or household purposes may ask us to identify any third parties to which we disclosed personal information during the preceding calendar year for those third parties’ own direct marketing purposes, and the categories of information disclosed. We do not make such disclosures. Send requests to support@chaosaudio.com with the statement "Shine the Light Request," your first and last name, and your mailing address, and certify that you are a California resident.

13.6 Additional information for Nevada residents

Nevada residents have the right to opt out of the sale of certain personal information for monetary consideration. We do not engage in such sales. If you are a Nevada resident and would like to submit a request to opt out of any potential future sales, email support@chaosaudio.com.

13.7 Additional information for Texas residents

The Texas Data Privacy and Security Act does not apply to small businesses as defined by the United States Small Business Administration, except with respect to the sale of sensitive personal data. We do not sell sensitive personal data. Texas residents may exercise the rights described in Section 13.2 using the methods in Section 13.3.

13.8 Additional information for Florida residents

The Florida Digital Bill of Rights applies only to entities meeting specified revenue thresholds, which we do not meet. Florida residents may nonetheless exercise the rights described in Section 13.2 using the methods in Section 13.3.

14. SMS and Text Message Communications

If you opt in to receive text messages from Chaos Audio, this section describes how our messaging program works. Opting in to text messages is not a condition of any purchase.

14.1 What we collect and how we use it

We collect your mobile phone number, records of your consent including the date, time, and method of opt-in, and records of your opt-out requests. We use your phone number to send you the categories of messages you have opted in to receive, which may include promotional messages about new products, sales, and exclusive offers; product announcements and company news; and, separately, transactional messages such as order confirmations and shipping updates.

Marketing messages and transactional messages are separate programs with separate consent. Opting out of one does not opt you out of the other.

14.2 Message frequency and cost

Message frequency varies. We typically send 2–6 marketing messages per month, and this may increase during promotional periods. Message and data rates may apply. Chaos Audio does not charge for text messages, but your mobile carrier’s standard rates apply, and carriers are not liable for delayed or undelivered messages.

14.3 Opting out and getting help

You can opt out of marketing text messages at any time by replying STOP to any message. After you reply STOP, we will send a single confirmation message and will not send further marketing texts to that number. You can also opt out by emailing support@chaosaudio.com.

For help, reply HELP to any message or email support@chaosaudio.com.

14.4 No sharing of mobile information

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All of the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties, excluding aggregators and providers of the text message services, who use the information solely to deliver messages on our behalf and are contractually prohibited from using it for any other purpose.

15. Notice to European Users

This section applies only to individuals located in the United Kingdom and the European Economic Area (together, "Europe"). References to "personal information" in this Privacy Policy should be understood to include "personal data" as defined in the EU General Data Protection Regulation and the UK GDPR (together, the "GDPR").

15.1 Controller and representatives

Chaos Audio LLC is the controller in respect of the processing of your personal information covered by this Privacy Policy. Our contact details are in Section 12.

You can contact us about any matter covered by this section using the details in Section 12.

15.2 Our legal bases for processing

The GDPR requires us to have a legal basis for each purpose for which we use your personal information. The legal bases we rely on are contractual necessity, our legitimate interests where your interests and fundamental rights do not override them, compliance with a legal obligation, and your consent. The table below sets out the legal bases we rely on for each purpose described in Section 3.

Service delivery and operations

• Categories of personal information: Contact, account and profile, transactional, subscription, payment, communications, user content and audio, developer and marketplace, device data
• Legal basis: Contractual necessity

Security and fraud prevention

• Categories of personal information: Contact, account, device, online activity, telemetry data
• Legal basis: Compliance with law. Legitimate interests — we have a legitimate interest in ensuring the ongoing security and proper operation of the Service and our systems and networks.

Product development

• Categories of personal information: Application usage data, online activity data, crash and error logs
• Legal basis: Legitimate interests — we have a legitimate interest in developing, testing, and improving our products.

Machine learning model training

• Categories of personal information: AI FX Builder prompts, iteration and error-correction records, generated effect code, ratings and written feedback
• Legal basis: Legitimate interests — we have a legitimate interest in improving the quality and reliability of the AI FX Builder. You may object to this processing at any time, and we offer an opt-out to all users as described in Section 2.6. Uploaded audio, impulse responses, and neural amp models are not used for this purpose.

Service improvement and analytics

• Categories of personal information: Account and profile, device, online activity, telemetry, communication interaction data
• Legal basis: Legitimate interests — we have a legitimate interest in understanding how the Service is used and improving it. Consent, in respect of any optional cookies and session replay used for this purpose.

Personalization

• Categories of personal information: Account and profile, transactional, online activity data
• Legal basis: Legitimate interests — we have a legitimate interest in providing a service personalized to you. Consent, where required.

Direct marketing

• Categories of personal information: Contact, account and profile, transactional, marketing, communication interaction data
• Legal basis: Legitimate interests — we have a legitimate interest in promoting our products. Consent, in circumstances or jurisdictions where consent is required for the sending of any given marketing communication.

Interest-based advertising

• Categories of personal information: Device, online activity, general location data
• Legal basis: Consent

Events, promotions, and contests

• Categories of personal information: Promotion, contact, account and profile, communications data
• Legal basis: Contractual necessity, to administer the promotion in accordance with its rules. Legitimate interests and, where required, consent, in respect of promoting them.

Compliance and protection

• Categories of personal information: Any and all data types relevant in the circumstances
• Legal basis: Compliance with law. Legitimate interests — where compliance with law does not apply, we and relevant third parties have a legitimate interest in participating in and following legal process, and in protecting and enforcing our and their rights, property, and safety.

Corporate transactions

• Categories of personal information: Any and all data types relevant in the circumstances
• Legal basis: Legitimate interests — we and relevant third parties have a legitimate interest in providing information to parties involved in an actual or prospective corporate event. We seek to minimize the amount and sensitivity of personal information shared in these contexts.

Creating aggregated, de-identified, and anonymized data

• Categories of personal information: Any and all data types relevant in the circumstances
• Legal basis: Legitimate interests — we have a legitimate interest, which we believe is also in your interest, in ensuring the Service operates as intended.

15.3 Retention

We retain personal information for as long as necessary to fulfill the purposes for which we collected it, as described in Section 4. When we no longer require it, we will delete or anonymize it, or, where that is not possible — for example because it is stored in backup archives — we will securely store it and isolate it from further processing until deletion is possible. If we anonymize your personal information so that it can no longer be associated with you, we may use that information indefinitely without further notice to you.

15.4 Sensitive personal information and automated decision-making

We ask that you not provide us with sensitive personal information — such as information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health data, genetic or biometric data, or data concerning your sex life or sexual orientation — through the Service or otherwise, and we ask that you not include such information in audio recordings, prompts, or free-text fields you submit to us.

We do not engage in automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you.

15.5 Your rights

European data protection law gives you certain rights regarding your personal information. If you are located in Europe, you may ask us to:

Access. provide information about our processing of your personal information and give you access to it;

Correct. update or correct inaccuracies in your personal information;

Delete. delete your personal information where there is no good reason for us to continue processing it, including where you have exercised your right to object;

Transfer. transfer a machine-readable copy of your personal information to you or to a third party of your choice;

Restrict. restrict the processing of your personal information, for example while we establish its accuracy or the reason for processing it;

Object. object to our processing where we rely on legitimate interests, and object at any time to processing for direct marketing purposes; and

Withdraw consent. withdraw your consent at any time where we process your personal information on the basis of consent. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

You can submit these requests by email to support@chaosaudio.com or by post to the address in Section 12. We may request specific information to help us confirm your identity and process your request. Whether we are required to fulfill a request depends on a number of factors, including why and how we are processing your personal information. If we reject a request in whole or in part, we will tell you our grounds for doing so at the time, subject to any legal restrictions.

15.6 Right to lodge a complaint

If you are not satisfied with our response to a request, or with how we process your personal information, you can complain to the data protection regulator in your habitual place of residence. Contact information for EEA data protection authorities is available through the European Data Protection Board. The UK regulator is the Information Commissioner’s Office, Water Lane, Wycliffe House, Wilmslow, Cheshire SK9 5AF, telephone +44 303 123 1113, ico.org.uk.

15.7 Data processing outside Europe

We are a U.S.-based company, and many of our service providers, advisers, partners, and other recipients of data are also based in the United States. If you use the Service, your personal information will necessarily be accessed and processed in the United States, and may be provided to recipients in other countries outside Europe.

Where we transfer your personal information to a country or territory that has not been the subject of an adequacy decision by the European Commission or the UK government, we use appropriate safeguards designed to give your personal information effectively the same protection it has in Europe — for example, standard contractual clauses approved by the relevant authorities, together with any supplementary measures required. You can request a copy of the safeguards we use by contacting us at support@chaosaudio.com.