Advertising, analytics & marketing partners
This section supplements “Who we share your information with” above. While analytics or marketing cookies are active on your device — that is, you have opted in where we show a cookie banner (for example in the UK, the EEA and Switzerland), or have not opted out where we do not show a cookie banner — see our Cookies Policy — we share limited information with the partners below — such as online identifiers, device and usage data, and your interactions with our site. What each advertising partner receives differs:
- Meta (Facebook & Instagram) receives, through the Meta pixel and the server-side Conversions API, online identifiers, your IP address and browser information, and your interactions with our store — such as viewing a product, adding it to your basket, starting checkout, and purchasing. It also receives, in hashed (pseudonymised) form, the contact and order details you provide at checkout — your name, email address, phone number and postal address — and, for signed-in customers, a pseudonymous account identifier.
- Google Ads receives only the ad-click identifier from the link you arrived on and the details of the resulting purchase. It receives no contact details, no hashed customer data, and no record of your browsing on this site.
Those are the only advertising trackers on the pages of this site. Our checkout runs on pages hosted by Shopify, where Shopify also runs pixels from apps we have connected to our store (TikTok, Converlay and Google’s “Google & YouTube” app). The notice at collection below names every recipient and what each one receives.
We share this so that we can run and measure our marketing and operate the store. Each partner handles your data under its own privacy policy.
How long we keep this. The click identifier stays in our own cookie on your device for up to 90 days, or until you withdraw marketing consent or opt out — whichever comes first. Where it has been recorded against an order, it is kept with that order record for as long as we keep the order itself, because it forms part of the order’s commercial record. Where a purchase cannot be reported to Google straight away, it waits in a queue on our servers and is deleted as soon as Google confirms it or it permanently fails — in no case longer than 30 days. We do not write the click identifier to our diagnostic logs: those record only the order number, an error code and Google’s reference for the request, and are kept for 90 days.
You can withdraw your consent or opt out at any time. Where we show a cookie preferences banner (for example in the UK and EU), you can reopen it with the button below. Where we do not, use our Your Privacy Choices page, which lets you opt out of the sale or sharing of your personal information for targeted advertising and, separately, turn off analytics; we also honour the Global Privacy Control browser signal as an opt-out wherever you are. You can also manage cookies in your browser. Where a partner processes data outside the UK or EEA (PostHog is hosted in the EU; Meta, Google, Sentry, Klaviyo and Cloudflare are in the US), we rely on appropriate safeguards. For transfers from the UK, we rely on the UK Extension to the EU Standard Contractual Clauses (the “UK Addendum”), or the UK International Data Transfer Agreement, or a UK adequacy regulation where one covers the destination. For transfers from the EEA, we rely on the European Commission’s Standard Contractual Clauses, or an EU adequacy decision where one applies. You can request a copy of the safeguards that apply to a particular transfer by emailing us at help@vochlea.co.uk.
| Partner | What we use them for | Lawful basis | Privacy policy |
|---|---|---|---|
| Shopify | Our commerce platform: storefront hosting (Shopify Oxygen), checkout, payment processing, store analytics and cookie-consent management. | Performance of a contract / legitimate interest | View |
| PostHog | Product analytics (hosted in the EU) to understand and improve how the site is used; a service provider acting on our instructions. If you are signed in to your account while analytics is active on your device, we link your analytics profile to your account ID, email address and first name. If you subscribe to our marketing emails while analytics is active, we also attach your email address to your analytics profile, so that we can connect your subscription to how you use the site. If analytics is not active, neither your account details nor your email address are sent to PostHog — a subscription goes only to Klaviyo, so that we can send you the emails you asked for. We never enable PostHog session replay (recordings of how a page is used) for visitors in the United States or its territories. | Consent where we show a cookie banner (for example in the UK, the EEA and Switzerland); where we do not show a cookie banner, on by default with an opt-out (see Your Privacy Choices) | View |
| Meta Platforms (Facebook & Instagram) | Advertising measurement and delivery via the Meta pixel and the server-side Conversions API. To measure our advertising this includes your interactions with our store — such as viewing a product, adding it to your basket, starting checkout, and purchasing — together with your IP address and browser information, and hashed customer-matching data: your email, phone number, name, address and, for signed-in customers, a pseudonymous account identifier — all matching data sent in pseudonymised (hashed) form. When you arrive from one of our Facebook or Instagram ads, Meta adds an ad-click identifier to the link (an “fbclid”). While marketing cookies are active on your device (see our Cookies Policy) we store that identifier in the _fbc cookie for up to 90 days, so that a later purchase can be attributed to the ad. If you opt out, withdraw consent or send a Global Privacy Control signal, the pixel is suppressed and our servers send no events to Meta. One exception for now: the audience sync from Klaviyo to Meta (see “Inferences” in the Notice for US residents below) works on your email address, not your browser, so to be removed from it email us from the address you subscribed with. | Consent where we show a cookie banner (for example in the UK, the EEA and Switzerland); where we do not show a cookie banner, on by default with an opt-out (see Your Privacy Choices) | View |
| Google Ads (including YouTube ads) | Advertising measurement. When you arrive from one of our Google or YouTube ads, Google adds an ad-click identifier to the link (a “gclid” or “wbraid”). While marketing cookies are active on your device (see our Cookies Policy) we store that identifier in our own cookie for up to 90 days, and record it against your order, so that we can later report the purchase to Google Ads and attribute the sale to the ad. If you opt out, withdraw consent or send a Global Privacy Control signal, the identifier is not stored and nothing is reported. Google receives only the click identifier and the purchase details — no contact details, no browsing stream. We load no Google advertising script on this site, and Google sets no cookie here. | Consent where we show a cookie banner (for example in the UK, the EEA and Switzerland); where we do not show a cookie banner, on by default with an opt-out (see Your Privacy Choices) | View |
| Sentry | Error monitoring and performance diagnostics (hosted in the US). We do not include your name, email address or IP address in the crash reports we send — we also remove email addresses, codes and tokens from the web addresses recorded with them — though Sentry necessarily receives your IP address when your browser contacts it, and derives an approximate country from it. Each report carries a random identifier, held only in your browser’s memory and discarded when you leave the page, so that we can tell how many page views a given fault affected. | Legitimate interest | View |
| Gorgias | Customer-support helpdesk. When you send us a message through the contact form on the non-English versions of our Contact page, our backend passes your email address, your message and the details you choose to add (the reason for contacting us, the product, an order number, your music software and operating system) to Gorgias, so that we can track and answer your request. | Performance of a contract / legitimate interest | View |
| Cloudflare (Turnstile) | Bot-protection and abuse prevention on our login, sign-up and password-reset pages, the DubBox free-trial sign-up and the free-licence sign-up pop-up. When one of those pages or forms loads, the Turnstile challenge runs in your browser and your IP address and limited browser characteristics (such as your user-agent and a TLS fingerprint) are sent to Cloudflare so it can tell a genuine visitor from an automated bot; when you then submit the form, our server passes the resulting token (and your IP) back to Cloudflare to confirm the check before we process the request. Cloudflare states these signals are used solely to detect and block bots — not to identify, profile or target you, and not for advertising or cross-site tracking. | Legitimate interest (security & fraud prevention) | View |
| Klaviyo | Email marketing: your email address is sent from our backend to Klaviyo when you subscribe to our newsletter, and also when you start a free product trial and tick the optional box to receive our product news and offers (a trial itself only creates your account and sends a transactional set-password email — you are added to the marketing list solely if you opt in), so that we can send you relevant marketing emails; plus onsite tracking (a script that records your on-site activity, such as the pages you view) used to tailor those emails. The onsite tracking runs only while marketing cookies are active on your device; when they are not, the script is not loaded and we set Klaviyo’s __kla_off cookie so it stays off. Klaviyo acts as our service provider. | Emails: consent (your subscription). Onsite tracking: Consent where we show a cookie banner (for example in the UK, the EEA and Switzerland); where we do not show a cookie banner, on by default with an opt-out (see Your Privacy Choices) | View |
| Google (YouTube) | Embedded video content, in privacy-enhanced mode. Loaded automatically on pages containing a video, without waiting for a cookie choice. | Legitimate interest | View |
| Vimeo | Embedded video content. | Consent / legitimate interest | View |
| Typeform | Embedded forms, quizzes and surveys. The contact form on the English version of our Contact page is a Typeform form: it loads when you open that page, and what you type into it (such as your email address and message) is sent to Typeform so that we can answer you. | Consent / legitimate interest | View |
Notice for US residents
This section supplements the rest of this policy if you live in the United States. Which of the rights below you have depends on your state (for example California, Colorado, Connecticut, Texas, Virginia and the other states with a consumer privacy law). Terms such as “sell”, “share” and “personal information” have the meanings given in those laws.
Notice at collection
This is our notice at collection. It explains what personal information we collect when you visit our site, place an order or fill in one of our forms, why we collect it, whether we sell or share it, and how long we keep it.
What we collect. In the last 12 months we have collected these categories of personal information: identifiers (name, email address, postal address, phone number, account identifiers, IP address, online and advertising identifiers); commercial information (products you buy or trial, and your order history); internet or other electronic network activity (how you interact with our website, emails and software); and inferences drawn from that activity (see Inferences below). We collect it directly from you (orders, accounts, forms, trials, support), automatically from your device as you use our site, and from our partners (for example Shopify, which runs our checkout, and the advertising networks that tell us an ad was clicked). Payment card details are handled by Shopify and its payment providers and never reach our systems.
Why we use it. To provide and support our products and your account, process orders and licences, communicate with you, run and measure our marketing, understand and improve our site, prevent fraud and abuse, and meet our legal obligations.
Selling and sharing. We do not sell personal information for money. We do, unless you opt out, “share” (and, under some state laws, “sell”) personal information for targeted (cross-context behavioural) advertising. The categories involved are identifiers, internet activity, commercial information and inferences. These are the third parties that receive it:
- Meta Platforms (Facebook & Instagram) — through the Meta pixel on our site and the server-side Conversions API: online identifiers, your IP address and browser information, your interactions with our store (such as viewing a product, adding it to your basket, starting checkout and purchasing), and your checkout contact details in hashed form. Meta also receives, through a sync run by Klaviyo, our email marketing provider, the hashed email addresses in two of our email-engagement segments, which it uses to build advertising audiences.
- Google (Google Ads & YouTube) — the ad-click identifier from the link you arrived on and the details of the resulting purchase, which we report to Google Ads. Google’s “Google & YouTube” app for Shopify also runs a pixel on our checkout.
- TikTok — through a pixel that TikTok’s app for Shopify runs on our checkout: online identifiers, device information and your checkout and purchase events.
- Converlay — through a pixel on our checkout: online identifiers, device information and your checkout and purchase events, which it passes on to advertising networks to measure our ads.
- Shopify (Network Intelligence) — Shopify, which runs our store and checkout, also uses information about your visits and purchases across the stores it hosts for its own “Network Intelligence” services. For this use Shopify acts as a business in its own right, not as our service provider.
Shopify (for running our store and checkout), PostHog, Klaviyo (for sending our emails and its onsite tracking), Gorgias, Sentry and Cloudflare act as our service providers under contracts that restrict how they may use your information; we do not treat those disclosures as a sale or share.
How long we keep it. We keep each kind of personal information for the period below, and then delete it.
| Personal information | How long we keep it |
|---|---|
| Order records: your name, contact and delivery details, what you bought and paid, and any ad-click identifier recorded with the order | 6 years from the end of the financial year in which you placed the order, the period UK tax and accounting law requires us to keep them. |
| Your account: name, email address, licences and product registrations | While your account is open. When you ask us to delete your account, we delete this information, except what we must keep with your order records (above). |
| Email marketing (Klaviyo): your email address and name, the emails we send you and how you engage with them, your onsite activity, and the segments (inferences) based on them | Until you unsubscribe and ask us to delete your profile. After you unsubscribe we keep your email address on a suppression list, so that we do not email you again. |
| Analytics events (PostHog): the pages you view and how you interact with them, device and approximate location information, and a random identifier | Up to 7 years, the retention period of our PostHog plan, unless you ask us to delete them sooner. |
| Advertising identifiers in cookies on your device (_fbp, _fbc and our _vochlea_gads cookie) | Each cookie expires after 90 days. If you opt out or withdraw consent, we stop reading and sending all three, and we delete _fbc and _vochlea_gads straight away; _fbp stays on your device, unused, until it expires (you can delete it in your browser). Meta’s retention of the events it has already received is governed by Meta’s own terms. |
| Purchases waiting to be reported to Google Ads | Deleted as soon as Google confirms the report or it permanently fails, and never kept longer than 30 days. |
| Diagnostic logs (order number, error code and Google’s reference for the request) | 90 days. |
How to opt out. Use the switches on our Your Privacy Choices page: one opts you out of the sale and sharing of your personal information for targeted advertising (and turns off our advertising trackers in your browser and on our servers), and the other — shown where we do not show a cookie banner — turns off analytics. The switch cannot yet reach the Klaviyo audience sync to Meta, which works on your email address rather than your browser; to be removed from it, email us (see Inferences). Your opt-out is also recorded with Shopify, which runs our checkout, so that it can apply it to the pixels on the checkout. We also honour the Global Privacy Control browser signal as an opt-out of sale, sharing and targeted advertising, wherever you are (with the same email-sync exception), and show “Opt-out request honored” when we detect it. On our Shopify-hosted checkout, a Global Privacy Control signal on its own is applied to the checkout pixels only in the US states where Shopify honours it; elsewhere they may still run, and we are reviewing whether to remove them. Where we show a cookie banner instead, our analytics and advertising trackers stay off until you opt in. A few services run regardless of cookie choices because the page needs them: embedded YouTube videos (which load automatically), Sentry error reporting, Cloudflare’s bot check on our sign-in, sign-up and password-reset pages, the DubBox free-trial sign-up and the free-licence sign-up pop-up, and the Typeform contact form on the English version of our Contact page. Vimeo videos and other Typeform embeds follow your marketing cookie choice: where we show a cookie banner they wait for consent or a click on “Load content”. You can also email help@vochlea.co.uk.
Inferences
Klaviyo, our email marketing provider, groups our subscribers into segments based on how they engage with our emails and our site — for example whether you have opened recent emails or left something in your basket — so that we can choose which emails to send. These segments are inferences about your interests. Two of them are synced to Meta, as hashed email addresses, to build advertising audiences; that sync is part of the sharing described above. Because the sync works on your email address rather than on your browser, the switch on Your Privacy Choices does not reach it: to opt out of it, email help@vochlea.co.uk from the address you subscribed with and we will remove you from the synced segments. We do not use inferences to make decisions that have legal or similarly significant effects on you.
Sensitive personal information and your voice
We do not collect or use sensitive personal information for any purpose other than those the law permits, so we do not offer a separate “limit the use of my sensitive personal information” choice.
Dubler 2 and DubBox listen to your voice so that they can turn it into notes and sounds. This happens entirely on your own device: the audio, and anything worked out from it (such as pitch), never leaves your device and is never sent to us or to anyone else. These apps send us only your licence and sign-in details and usage events, which contain no audio. This statement covers Dubler 2 and DubBox only. Our Dubnote app works differently: it uploads the recordings you make in it so that it can process them.
Under-18s
Our site and products are for a general audience and are not directed at children. We do not knowingly collect personal information from children under 13, and we do not knowingly sell or share the personal information of anyone under 18 or use it for targeted advertising. If you are under 18, or you believe someone under 18 has given us personal information, email help@vochlea.co.uk and we will delete it.
Your rights
Depending on your state, you may have the right to know what personal information we collect, use and disclose about you and to access a copy of it; to correct it; to delete it; to opt out of its sale or sharing and of targeted advertising; and not to be discriminated against for exercising these rights. To make a request, email help@vochlea.co.uk. For access, correction and deletion requests we may take reasonable steps to verify your identity before we act; opt-out requests are not verified. You may use an authorised agent, in which case we may ask for proof of their authority. We will respond within the time your state’s law allows.
Appeals
If we decline your request, in whole or in part, we will tell you why in writing and explain how to appeal. To appeal, reply to our decision or email help@vochlea.co.uk with “Privacy appeal” in the subject line. We use the same process wherever you live in the US. We will decide your appeal within 45 days of receiving it — we do not extend this period — and tell you the outcome in writing, with our reasons. If we deny your appeal, you can complain to your state’s Attorney General:
Changes to this notice
- 16 October 2026: we now name the third parties we sell or share personal information with, and we added this notice at collection, how long we keep each kind of personal information, inferences, sensitive information and your voice, under-18s and appeals. We also describe where analytics and advertising cookies are on by default with an opt-out (where we do not show a cookie banner), instead of saying they are only ever used with your consent.
This list was last reviewed on 16 October 2026.
