This Privacy Policy explains what personal data Ecliptum collects when you visit ecliptum.pro, purchase a one-time asset, or activate a subscription; why we collect it; how we use it; and what rights you have over it. It should be read alongside the Ecliptum Terms of Service.

1.1. Ecliptum (ecliptum.pro) operates under the trading name Ecliptum — Neuro-Acoustic Laboratory ("Ecliptum", "we", "us", "our") and acts as the data controller for personal data collected directly through the Site, as described in this Policy. Paddle acts as a separate, independent data controller for payment data, as described in Section 4.

1.2. Contact for all privacy matters: lab@ecliptum.pro

2.1. Account and Contact Data. The email address you provide at checkout or account creation, and any correspondence you send us, such as support requests or licensing inquiries.

2.2. Transaction and Access Entitlement Data. A record of which SKUs and subscription tiers you have purchased, your subscription status and billing interval, and the access entitlements tied to your account (such as remaining weekly asset allotment and Archive Recall Token balance), used to deliver and manage your purchases.

2.3. Technical and Usage Data. Standard technical data generated when you use the Site or download assets: IP address, browser and device type, and timestamps of key actions such as login and download initiation. A limited subset — specifically download timestamps, cumulative transfer volume per session, and concurrent-session indicators — is used to detect and prevent abuse of subscription download limits, as described in Section 7 of the Terms of Service. This data is not used for any purpose beyond platform security, abuse prevention, and service delivery.

2.4. Consent Log Data. At checkout, you confirm your agreement to Ecliptum's legal documents via a mandatory checkbox. The timestamp of this confirmation, the document version references accepted, and your associated email address are logged and retained as a record of your informed consent, as required by applicable data protection law.

2.5. Digital Identification Metadata. As described in Section 5.4 of the Terms of Service, Ecliptum embeds unique order-reference and delivery identifiers within the file metadata of delivered assets. This metadata does not contain personal financial data. Its sole purpose is to identify the origin of files in the event of unauthorized redistribution and to support intellectual property enforcement.

2.6. Payment Data. We do not collect, process, or store your card number, billing address, or other raw payment credentials. This data is collected and processed directly and exclusively by Paddle — see Section 4.

2.7. Cookies. We use two categories of cookies:
— Essential cookies: strictly necessary for session management, secure checkout, and platform functionality. These are set without requiring consent, as they are required for the Site to operate.
— Analytics cookies: used to understand aggregate, anonymized Site usage patterns. These are not essential to Site operation and, where required by applicable law (including for visitors from the EU, EEA, and UK), are only set following your active consent via the cookie management tool on the Site. You can select "Essential Only" to decline analytics cookies while retaining full Site functionality. You may withdraw or change your consent at any time via the cookie settings link in the Site footer.

2.8. We do not intentionally collect health data, biometric data, or other special-category personal data as defined under GDPR Article 9. The health and sensitivity advisory published on the Site and in the Terms of Service is informational only; it does not involve the collection or processing of any health data about you.

3.1. Where we rely on legitimate interest as a legal basis, we have assessed that the processing is necessary and proportionate, limited to what is required for the stated purpose, and does not override your fundamental rights and interests. You have the right to object to processing carried out on this basis; see Section 8.

4.1. All payments are processed by Paddle.com Market Limited and its applicable affiliates ("Paddle"), acting as Merchant of Record and as an independent data controller for the billing and payment data it collects directly from you at checkout. Paddle's processing of this data is governed by Paddle's own privacy policy, not this one.

4.2. Where our systems detect a confirmed violation of the download-abuse or fair-use limits described in Section 7 of the Terms of Service, we may share relevant account identifiers and supporting technical data — including digital identification metadata from delivered files — with Paddle to assist with fraud prevention and chargeback defense, consistent with our obligations under the Paddle merchant agreement.

5.1. We use third-party infrastructure providers — including cloud hosting, file delivery, and Site analytics services — to operate the Site and Store. These providers act as data processors on our behalf under written data processing agreements, are bound to protect your data, and are not permitted to use it for their own purposes.

6.1. Account, transaction, and access-entitlement data is retained for as long as your account is active and for as long as necessary to honor purchased perpetual licenses, manage active subscriptions, and satisfy applicable tax and accounting obligations (typically up to 7 years for financial records, in line with standard accounting retention requirements).

6.2. Consent log data is retained for a minimum of 3 years from the date of the associated transaction, consistent with standard data protection audit requirements.

6.3. Technical and usage data collected for abuse-prevention purposes (Section 2.3) is retained for a limited period sufficient for its security purpose — ordinarily no longer than 90 days — except where specific records are retained as evidence of a confirmed and documented policy violation.

6.4. Digital identification metadata embedded in delivered files remains with those files as part of the asset and is not separately stored or processed by Ecliptum beyond the initial delivery record.

6.5. If you request erasure of your account (Section 8), we will delete your account and associated personal data subject to the qualifications in Section 8.4.

7.1. Ecliptum and its service providers may store and process data in countries outside your own, including outside the EU, EEA, and UK. Where personal data of EU/EEA/UK users is transferred internationally, we rely on recognized legal safeguards such as the European Commission's Standard Contractual Clauses or an equivalent lawful transfer mechanism to ensure an adequate level of data protection.

8.1. Subject to applicable law, you may have the following rights regarding your personal data:
(a) Access: request a copy of the personal data we hold about you. (b) Rectification: request correction of inaccurate or incomplete data. (c) Erasure: request deletion of your personal data ("right to be forgotten"), subject to Section 8.4. (d) Objection or Restriction: object to processing based on legitimate interest, or request that we restrict processing in certain circumstances. (e) Portability: receive your data in a structured, commonly used format where technically feasible.

8.2. If you are located in the United States, you may have additional rights under applicable state privacy law (including the California Consumer Privacy Act/CPRA and equivalent legislation in other states). These rights may include the right to know what categories of personal data we collect, to request deletion, and to opt out of the sale of personal data. Ecliptum does not sell personal data to third parties.

8.3. To exercise any right under Section 8.1 or 8.2, contact lab@ecliptum.pro. We will respond within 30 days of a verified request.

8.4. Effect of Account Erasure. Deleting your account will permanently end your ability to access cloud-delivered or dashboard-based assets — including any remaining subscription allotments and Archive Recall Tokens — and cannot be reversed. It does not affect files you have already downloaded and retained locally under your perpetual personal-use license (Terms of Service, Section 4.1). We may retain limited transaction and consent-log records after erasure where required by applicable tax, accounting, or legal-compliance obligations.

8.5. Right to Lodge a Complaint. If you are located in the EU, EEA, or UK and believe we are processing your personal data in violation of applicable law, you have the right to lodge a complaint with your local data protection supervisory authority.

9.1. We implement industry-standard technical and organizational safeguards, including encryption in transit (TLS/SSL) and access controls on our internal systems, to protect personal data against unauthorized access, loss, alteration, or disclosure.

9.2. Data Breach Notification. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, as required under GDPR Article 33. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify affected individuals directly without undue delay, as required under GDPR Article 34, using the contact information on file.

10.1. Ecliptum is not directed to persons under 18 years of age, consistent with the eligibility requirement in Section 3.1 of the Terms of Service. We do not knowingly collect personal data from anyone under this age. If we become aware that we have inadvertently collected data from a person under 18, we will delete it promptly.

11.1. We may update this Policy from time to time. Material changes will be reflected by an updated Effective Date and Document Ref at the top of this document. For significant changes, active account holders will be notified by email prior to the change taking effect. Continued use of the Site after an update constitutes acceptance of the revised Policy.

12.1. Severability. If any provision of this Policy is found to be invalid or unenforceable, the remaining provisions will continue in full force and effect.

12.2. Jurisdiction Update. These terms currently reflect Ecliptum operating as a pre-incorporation individual business. In the event that Ecliptum incorporates as a registered legal entity, the data controller details and governing law provisions will be updated and active users notified.

For privacy inquiries or to exercise your rights: lab@ecliptum.pro

This Policy is executed in English. Any translated version is provided for convenience only; the English version governs in the event of any conflict.