We build instruments to help you create, and we want you to feel confident using them. Respecting your privacy is part of that. This policy explains how we handle your data and the choices you have. If you have a question, we’re here to help.

Last updated: 2 October 2026

1. Who is responsible for your data?

The controller is Paweł Uszyński, trading as Warsaw Wave Paweł Uszyński, ul. Gilarska 43, 03-589 Warszawa, Poland, NIP 9511911919. Contact: contact@warsaw-wave.com. This policy covers warsaw-wave.com, our newsletter, support, and the purchase and activation of Revolt Patchable Synth.

2. Website and support

We process connection and security records, including IP addresses, request times, visited pages, browser information and errors, to operate and protect the website. Our basis is our legitimate interest in availability and security (Article 6(1)(f) GDPR). Hosting and email are provided by dhosting.pl sp. z o.o., Poland.

We use contact details, messages and relevant support information to answer you: on the basis of Article 6(1)(b) GDPR for contractual enquiries and support, or our legitimate interest in responding to other correspondence (Article 6(1)(f)).

3. Purchases and activation

Moonbase provides checkout, accounts, downloads and licensing. We are the controller for our customer relationship, including customer accounts, licenses, activations and downloads; Moonbase processes these data on our behalf.

The Moonbase entity named on your order or receipt is the seller (Merchant of Record) and an independent controller for orders, payments, refunds, chargebacks, tax records and transaction fraud prevention. Its Privacy Policy explains that processing and how to exercise your rights with Moonbase.

We use your name, email and billing address, customer and order identifiers, transaction status and license entitlements received from you and Moonbase to deliver products and manage licenses. Activation processes device identifiers or signatures, device names, IP addresses, product and license identifiers, and activation records. These data are provided by you or generated when using the services. Revolt does not use optional usage analytics or extended diagnostic telemetry.

Delivery and licensing rely on Article 6(1)(b) GDPR; statutory recordkeeping on Article 6(1)(c); and fraud prevention and legal claims on our legitimate interests (Article 6(1)(f)). Automated checks can refuse activation when a license is invalid or its activation limit is reached. Contact us to request a human review and challenge an incorrect result.

4. Newsletter

With your consent, we use your email address and subscription records to send product news and offers (Article 6(1)(a) GDPR and Article 398 of the Polish Electronic Communications Law). Subscription requires email confirmation. Unsubscribe through any newsletter or contact us; withdrawal does not affect earlier lawful processing. Purchases and essential service messages do not require marketing consent.

Sendinblue SAS (Brevo), France, processes mailing-list data and delivers emails on our behalf. Email open and click statistics use Brevo’s anonymous tracking setting and are reported in aggregate, without linking those events to individual recipients.

5. Cookies and analytics

Necessary cookies or browser storage support requested functions such as login, checkout and remembering privacy choices. Strictly necessary storage is exempt from consent under Article 399(3) of the Polish Electronic Communications Law. You can manage or delete stored data in your browser; blocking necessary storage may prevent those functions from working.

Only with your consent, Google Analytics 4 (Google Ireland Limited) processes browser identifiers, page views and device/browser information to measure visits and improve the website (Article 6(1)(a) GDPR and Article 399 of that Law). We do not use advertising features or send names or email addresses. You can refuse analytics or withdraw consent in the website’s cookie preferences. See how Google uses information from partner sites.

Analytics cookies expire after 60 days without renewal on each visit; consent preferences last 30 days. Analytics user and event data are retained for two months without resetting on new activity. This limit does not apply to aggregated reports.

6. Recipients and international processing

Data are accessible to authorised personnel and the providers named above as needed for their services, and to IT/security providers, accounting or legal advisers and public authorities where necessary. We require providers processing data on our behalf to do so under data-processing agreements.

dhosting stores hosting data in Poland. Moonbase AS (Norway) stores customer data in AWS Ireland, within the European Economic Area (EEA). Moonbase has confirmed that EEA customers’ data are neither transferred to nor accessed from the United States. Moonbase LLC (USA) processes relevant data for US customers’ payments. This statement concerns Moonbase; international processing by Brevo and Google is described below.

Brevo stores its databases in the EU; support and subprocessors may involve the United States and India. Transfers use European Commission standard contractual clauses and supplementary safeguards. Google may process data outside the EEA, including in the United States and countries identified in its subprocessor list. Google relies on adequacy decisions, including the EU–US Data Privacy Framework for covered US transfers (Article 45 GDPR), and standard contractual clauses where applicable (Article 46 GDPR). Contact us for a copy of applicable transfer safeguards.

7. Retention

License identifiers, entitlements and necessary activation information are kept for as long as needed to provide and verify your license, including a perpetual license. Unnecessary activation history is deleted or anonymised. When an erasure request is fulfilled, Moonbase clears personal identifying fields while retaining order and license records needed for audit trails and continuing license entitlements. Personal data retained for our services remain subject to the legal grounds and retention limits in this policy. Moonbase separately retains transaction records as an independent controller for its legal obligations and claims, as described in its Privacy Policy.

Newsletter data are used until you unsubscribe. We retain limited consent and subscription records to demonstrate lawful marketing and address claims (our legitimate interest, Article 6(1)(f) GDPR). Five years after withdrawal, we remove unnecessary custom contact data. Your email address and blocklist status are retained as long as necessary to honour your opt-out and prevent accidental marketing. Brevo also retains system contact history alongside the blocklisted record. We restrict the use of these retained records to compliance and review the necessity of continued retention; they are not used to send marketing.

Enquiries and support correspondence are retained for up to five years after closure where needed for follow-up or claims (Article 6(1)(f) GDPR). Records needed for an ongoing dispute remain until it is resolved and relevant limitation periods expire. Tax records are kept until the relevant tax liability becomes time-barred, normally five years from the end of the year in which payment was due, longer if the limitation period is suspended or interrupted (Article 6(1)(c) GDPR).

dhosting retains web-server logs for 30 days, mail-server logs for up to three years and hosting backups for seven days. Analytics and cookie periods are given in section 5.

8. Your rights and required data

Subject to GDPR conditions, you can request access, correction, deletion, restriction and portability. You may object to processing based on legitimate interests for reasons relating to your situation, and to direct marketing at any time. You can withdraw consent without affecting earlier lawful processing. Contact us using the address above. You may complain to the President of the Polish Personal Data Protection Office (UODO), or the competent authority where you live, work or where an alleged infringement occurred.

Newsletter subscription and analytics consent are voluntary. Information required for an account, order, activation or support is necessary to provide that service; without it, we may be unable to fulfil your request. Statutorily required billing information is identified at checkout.